In the Linux kernel, the following vulnerability has been resolved: USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive locking violation in usb-storage: ============================================ WARNING: possible recursive locking detected 5.18.0 #3 Not tainted -------------------------------------------- kworker/1:3/1205 is trying to acquire lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 but task is already holding lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 ... stack backtrace: CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2988 [inline] check_deadlock kernel/locking/lockdep.c:3031 [inline] validate_chain kernel/locking/lockdep.c:3816 [inline] __lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747 usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109 r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622 usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:545 [inline] device_remove+0x11f/0x170 drivers/base/dd.c:537 __device_release_driver drivers/base/dd.c:1222 [inline] device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248 usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627 usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118 usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114 This turned out not to be an error in usb-storage but rather a nested device reset attempt. That is, as the rtl8712 driver was being unbound from a composite device in preparation for an unrelated USB reset (that driver does not have pre_reset or post_reset callbacks), its ->remove routine called usb_reset_device() -- thus nesting one reset call within another. Performing a reset as part of disconnect processing is a questionable practice at best. However, the bug report points out that the USB core does not have any protection against nested resets. Adding a reset_in_progress flag and testing it will prevent such errors in the future.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive locking     violation in usb-storage: ============================================ WARNING: possible recursive locking     detected 5.18.0 #3 Not tainted -------------------------------------------- kworker/1:3/1205 is trying to     acquire lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40     drivers/usb/storage/usb.c:230 but task is already holding lock: ffff888018638db8     (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 ...
    stack backtrace: CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3 Hardware name: QEMU Standard PC     (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace:
    <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106     print_deadlock_bug kernel/locking/lockdep.c:2988 [inline] check_deadlock kernel/locking/lockdep.c:3031     [inline] validate_chain kernel/locking/lockdep.c:3816 [inline] __lock_acquire.cold+0x152/0x3ca     kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x520     kernel/locking/lockdep.c:5630 __mutex_lock_common kernel/locking/mutex.c:603 [inline]
    __mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747 usb_stor_pre_reset+0x35/0x40     drivers/usb/storage/usb.c:230 usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109     r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622 usb_unbind_interface+0x1bd/0x890     drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:545 [inline] device_remove+0x11f/0x170     drivers/base/dd.c:537 __device_release_driver drivers/base/dd.c:1222 [inline]     device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248 usb_driver_release_interface+0x102/0x180     drivers/usb/core/driver.c:627 usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118     usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114 This turned out not to be an error in usb-storage     but rather a nested device reset attempt. That is, as the rtl8712 driver was being unbound from a     composite device in preparation for an unrelated USB reset (that driver does not have pre_reset or     post_reset callbacks), its ->remove routine called usb_reset_device() -- thus nesting one reset call     within another. Performing a reset as part of disconnect processing is a questionable practice at best.
    However, the bug report points out that the USB core does not have any protection against nested resets.
    Adding a reset_in_progress flag and testing it will prevent such errors in the future. (CVE-2022-49936)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02537-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
    - CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361     bsc#1226552).
    - CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
    - CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
    - CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain     (bsc#1222634).
    - CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
    - CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
    - CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
    - CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
    - CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
    - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
    - CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses     (bsc#1242782).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc     (bsc#1243330).
    - CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02334-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47212: net/mlx5: Update error handler for UCTX and UMEM (bsc#1222709).
    - CVE-2021-47455: ptp: Fix possible memory leak in ptp_clock_register() (bsc#1225254).
    - CVE-2021-47527: serial: core: fix transmit-buffer reset and memleak (bsc#1227768).
    - CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash (bsc#1242243).
    - CVE-2022-49154: KVM: SVM: fix panic on out-of-bounds guest IRQ (bsc#1238167).
    - CVE-2022-49622: netfilter: nf_tables: fix crash when nf_trace is enabled (bsc#1239042).
    - CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (bsc#1239071).
    - CVE-2022-49764: kABI: workaround 'bpf: Prevent bpf program recursion for raw tracepoint probes' changes     (bsc#1242301).
    - CVE-2022-49780: scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()     (bsc#1242262).
    - CVE-2022-49814: kcm: close race conditions on sk_receive_queue (bsc#1242498).
    - CVE-2022-49879: ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1242733).
    - CVE-2022-49881: wifi: cfg80211: fix memory leak in query_regdb_file() (bsc#1242481).
    - CVE-2022-49917: ipvs: fix WARNING in ip_vs_app_net_cleanup() (bsc#1242406).
    - CVE-2022-49921: net: sched: Fix use after free in red_enqueue() (bsc#1242359).
    - CVE-2022-50055: iavf: Fix adminq error handling (bsc#1245039).
    - CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
    - CVE-2022-50134: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (bsc#1244802).
    - CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
    - CVE-2023-53020: l2tp: fix lockdep splat (bsc#1240224).
    - CVE-2023-53090: drm/amdkfd: Fix an illegal memory access (bsc#1242753).
    - CVE-2023-53091: ext4: update s_journal_inum if it changes after journal replay (bsc#1242767).
    - CVE-2023-53133: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()     (bsc#1242423).
    - CVE-2024-26586: mlxsw: spectrum_acl_tcam: Fix stack corruption (bsc#1220243).
    - CVE-2024-26825: nfc: nci: free rx_data_reassembly skb on NCI device cleanup (bsc#1223065).
    - CVE-2024-26872: RDMA/srpt: Do not register event handler until srpt device is fully setup (bsc#1223115).
    - CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify (bsc#1223118).
    - CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device     attribute group (bsc#1224712).
    - CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info     (bsc#1224726).
    - CVE-2024-38588: ftrace: Fix possible use-after-free issue in ftrace_location() (bsc#1226837).
    - CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
    - CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
    - CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
    - CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
    - CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching     (bsc#1241544).
    - CVE-2025-23149: tpm: do not start chip while suspended (bsc#1242758).
    - CVE-2025-37756: net: tls: explicitly disallow disconnect (bsc#1242515).
    - CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit (bsc#1242521).
    - CVE-2025-37781: i2c: cros-ec-tunnel: defer probe if parent EC is not present (bsc#1242575).
    - CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
    - CVE-2025-37810: usb: dwc3: gadget: check that event count does not exceed event buffer length     (bsc#1242906).
    - CVE-2025-37836: PCI: Fix reference leak in pci_register_host_bridge() (bsc#1242957).
    - CVE-2025-37844: cifs: avoid NULL pointer dereference in dbg call (bsc#1242946).
    - CVE-2025-37862: HID: pidff: Fix null pointer dereference in pidff_find_fields (bsc#1242982).
    - CVE-2025-37892: mtd: inftlcore: Add error check for inftl_read_oob() (bsc#1243536).
    - CVE-2025-37911: bnxt_en: Fix out-of-bound memcpy() during ethtool -w (bsc#1243469).
    - CVE-2025-37923: tracing: Fix oob write in trace_seq_to_buffer() (bsc#1243551).
    - CVE-2025-37927: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (bsc#1243620).
    - CVE-2025-37928: dm-bufio: do not schedule in atomic context (bsc#1243621).
    - CVE-2025-37961: ipvs: fix uninit-value for saddr in do_output_route4 (bsc#1243523).
    - CVE-2025-37980: block: fix resource leak in blk_register_queue() error path (bsc#1243522).
    - CVE-2025-37982: wifi: wl1251: fix memory leak in wl1251_tx_work (bsc#1243524).
    - CVE-2025-37992: net_sched: Flush gso_skb list too during ->change() (bsc#1243698).
    - CVE-2025-37995: module: ensure that kobject_put() is safe for module type kobjects (bsc#1243827).
    - CVE-2025-37998: openvswitch: Fix unsafe attribute parsing in output_userspace() (bsc#1243836).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38004: can: bcm: add locking for bcm_op runtime updates (bsc#1244274).
    - CVE-2025-38023: nfs: handle failure of nfs_get_lock_context in unlock path (bsc#1245004).
    - CVE-2025-38024: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (bsc#1245025).
    - CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write()     (bsc#1245440).
    - CVE-2025-38072: libnvdimm/labels: Fix divide error in nd_label_data_init() (bsc#1244743).
    - CVE-2025-38078: ALSA: pcm: Fix race of buffer access at PCM OSS layer (bsc#1244737).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02308-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50085: dm raid: fix address sanitizer warning in raid_resume (bsc#1245147).
    - CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
    - CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
    - CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
    - CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
    - CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
    - CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
    - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc     (bsc#1243330).
    - CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02264-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
    - CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361     bsc#1226552).
    - CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
    - CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
    - CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain     (bsc#1222634).
    - CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
    - CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
    - CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (bsc#1235464).
    - CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
    - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
    - CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses     (bsc#1242782).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc     (bsc#1243330).
    - CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.214-120.368. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-036 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: Fix a potential use after free

    Free the adap structure only after we are done using it.This patch just moves the put_device() down a bit     to avoid theuse after free.

    [wsa: added comment to the code, added Fixes tag] (CVE-2019-25162)

    A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace.  A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. (CVE-2021-4159)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: Fix NULL pointer dereferences in of_thermal_ functions (CVE-2021-47202)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

    A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

    It was discovered that a nft object or expression could reference a nft set on a different nft table,     leading to a use-after-free once that table was deleted. (CVE-2022-2586)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger     the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE     handling. (CVE-2022-3176)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

    mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix UAF when detecting digest errors (CVE-2022-48686)

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when     setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment     Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID,     SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix kernel crash during module removal (CVE-2022-48688)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix use-after-free warning (CVE-2022-48695)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: fix a use-after-free (CVE-2022-48697)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: add a force flush to delay work when radeon (CVE-2022-48704)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't null dereference ops->destroy (CVE-2022-49568)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Prevent nested device-reset calls (CVE-2022-49936)

    In the Linux kernel, the following vulnerability has been resolved:

    vt: Clear selection before changing the font (CVE-2022-49948)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level (CVE-2022-49964)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Don't redirect packets with invalid pkt_len (CVE-2022-49975)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hidraw: fix memory leak in hidraw_release() (CVE-2022-49981)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report (CVE-2022-49984)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq (CVE-2022-49986)

    In the Linux kernel, the following vulnerability has been resolved:

    md: call __md_stop_writes in md_stop (CVE-2022-49987)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in __xfrm_policy_check() (CVE-2022-50007)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: don't call disarm_kprobe() for disabled kprobes (CVE-2022-50008)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers:md:fix a potential use-after-free bug (CVE-2022-50022)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (CVE-2022-50030)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix adminq error handling (CVE-2022-50055)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pnfs: Fix a use-after-free bug in open (CVE-2022-50072)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (CVE-2022-50083)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_status (CVE-2022-50084)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_resume (CVE-2022-50085)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (CVE-2022-50092)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) (CVE-2022-50093)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: s3fb: Check the size of screen before memset_io() (CVE-2022-50097)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: amba-clcd: Fix refcount leak bugs (CVE-2022-50109)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (CVE-2022-50126)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix error unwind in rxe_create_qp() (CVE-2022-50127)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential deadlock in __driver_attach (CVE-2022-50149)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (CVE-2022-50153)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (CVE-2022-50185)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints() (CVE-2022-50191)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: Add boundary check in put_entry() (CVE-2022-50200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: hibernate: defer device probing when resuming from hibernation (CVE-2022-50202)

    In the Linux kernel, the following vulnerability has been resolved:

    ext2: Add more validity checks for inode counts (CVE-2022-50205)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: fix oops in concurrently setting insn_emulation sysctls (CVE-2022-50206)

    In the Linux kernel, the following vulnerability has been resolved:

    md-raid10: fix KASAN warning (CVE-2022-50211)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sg: Allow waiting for commands to complete on removed device (CVE-2022-50215)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: Fix linkwatch use-after-free on disconnect (CVE-2022-50220)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: vt: initialize unicode screen buffer (CVE-2022-50222)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

    The upstream advisory describes this issue as follows:

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target     system in order to exploit this vulnerability.

    The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of     proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
    An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-2860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.144-127.601. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-020 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: Fix a potential use after free

    Free the adap structure only after we are done using it.This patch just moves the put_device() down a bit     to avoid theuse after free.

    [wsa: added comment to the code, added Fixes tag] (CVE-2019-25162)

    In the Linux kernel, the following vulnerability has been resolved:

    tun: avoid double free in tun_free_netdev (CVE-2021-47082)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

    A use-after-free flaw was found in the Linux kernel's POSIX CPU timers functionality in the way a user     creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user     to crash or potentially escalate their privileges on the system. (CVE-2022-2585)

    It was discovered that a nft object or expression could reference a nft set on a different nft table,     leading to a use-after-free once that table was deleted. (CVE-2022-2586)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

    An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger     the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE     handling. (CVE-2022-3176)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

    mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

    A double-free flaw was found in the Linux kernel's TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-4744)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/core: Fix a nested dead lock as part of ODP flow (CVE-2022-48675)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix UAF when detecting digest errors (CVE-2022-48686)

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when     setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment     Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID,     SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix kernel crash during module removal (CVE-2022-48688)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: clean up hook list when offload flags check fails (CVE-2022-48691)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix use-after-free warning (CVE-2022-48695)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: fix a use-after-free (CVE-2022-48697)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: add a force flush to delay work when radeon (CVE-2022-48704)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_l3mdev_accept. (CVE-2022-49599)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Prevent nested device-reset calls (CVE-2022-49936)

    In the Linux kernel, the following vulnerability has been resolved:

    vt: Clear selection before changing the font (CVE-2022-49948)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fix netdevice reference leaks in attach_default_qdiscs() (CVE-2022-49958)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level (CVE-2022-49964)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Don't redirect packets with invalid pkt_len (CVE-2022-49975)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix refcount bug in sk_psock_get (2) (CVE-2022-49979)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hidraw: fix memory leak in hidraw_release() (CVE-2022-49981)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report (CVE-2022-49984)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Don't use tnum_range on array range checking for poke descriptors (CVE-2022-49985)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq (CVE-2022-49986)

    In the Linux kernel, the following vulnerability has been resolved:

    md: call __md_stop_writes in md_stop (CVE-2022-49987)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: fix error exit of privcmd_ioctl_dm_op() (CVE-2022-49989)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Check for overflow while configuring loop (CVE-2022-49993)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix locking in rxrpc's sendmsg (CVE-2022-49998)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: policy: fix metadata dst->dev xmit null pointer dereference (CVE-2022-50004)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4.2 fix problems with __nfs42_ssc_open (CVE-2022-50006)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in __xfrm_policy_check() (CVE-2022-50007)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: don't call disarm_kprobe() for disabled kprobes (CVE-2022-50008)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers:md:fix a potential use-after-free bug (CVE-2022-50022)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (CVE-2022-50030)

    In the Linux kernel, the following vulnerability has been resolved:

    net: genl: fix error path memory leak in policy dumping (CVE-2022-50042)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix adminq error handling (CVE-2022-50055)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: don't leak snap_rwsem in handle_cap_grant (CVE-2022-50059)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: fix memory leak inside XPD_TX with mergeable (CVE-2022-50065)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pnfs: Fix a use-after-free bug in open (CVE-2022-50072)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix warning in ext4_iomap_begin as race between bmap and write (CVE-2022-50082)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (CVE-2022-50083)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_status (CVE-2022-50084)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid: fix address sanitizer warning in raid_resume (CVE-2022-50085)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (CVE-2022-50092)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) (CVE-2022-50093)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: Cleanup CPU timers before freeing them during exec (CVE-2022-50095)

    In the Linux kernel, the following vulnerability has been resolved:

    video: fbdev: s3fb: Check the size of screen before memset_io() (CVE-2022-50097)

    In the Linux kernel, the following vulnerability has been resolved:

    sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed (CVE-2022-50103)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (CVE-2022-50126)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix error unwind in rxe_create_qp() (CVE-2022-50127)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/srpt: Fix a use-after-free (CVE-2022-50129)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (CVE-2022-50138)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential deadlock in __driver_attach (CVE-2022-50149)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (CVE-2022-50153)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-gpu: fix a missing check to avoid NULL dereference (CVE-2022-50181)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (CVE-2022-50185)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints() (CVE-2022-50191)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: Add boundary check in put_entry() (CVE-2022-50200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: hibernate: defer device probing when resuming from hibernation (CVE-2022-50202)

    In the Linux kernel, the following vulnerability has been resolved:

    ext2: Add more validity checks for inode counts (CVE-2022-50205)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: fix oops in concurrently setting insn_emulation sysctls (CVE-2022-50206)

    In the Linux kernel, the following vulnerability has been resolved:

    md-raid10: fix KASAN warning (CVE-2022-50211)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not allow CHAIN_ID to refer to another table (CVE-2022-50212)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: do not allow SET_ID to refer to another table (CVE-2022-50213)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sg: Allow waiting for commands to complete on removed device (CVE-2022-50215)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix KASAN use-after-free Read in compute_effective_progs (CVE-2022-50219)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: Fix linkwatch use-after-free on disconnect (CVE-2022-50220)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: vt: initialize unicode screen buffer (CVE-2022-50222)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: arm64/poly1305 - fix a read out-of-bound (CVE-2022-50231)

    In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

    The upstream advisory describes this issue as follows:

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target     system in order to exploit this vulnerability.

    The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of     proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
    An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-2860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.294-220.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1852 advisory.

    An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver     functionality in the way a user triggers ioctl FBIOPUT_VSCREENINFO with malicious data. This flaw allows a     local user to crash or potentially escalate their privileges on the system. (CVE-2021-33655)

    A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace.  A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. (CVE-2021-4159)

    An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    A flaw was found in the Linux kernel's networking code. A use-after-free was found in the way the sch_sfb     enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed)     into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of     service. (CVE-2022-3586)

    A memory access flaw was found in the Linux kernel's XEN hypervisor for the virtual machine. This flaw     allows a local user to crash the system or potentially escalate their privileges on the system.
    (CVE-2022-36123)

    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

    A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses     the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash     the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
    (CVE-2022-36946)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

    mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when     setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment     Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID,     SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix use-after-free warning (CVE-2022-48695)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: add a force flush to delay work when radeon (CVE-2022-48704)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Prevent nested device-reset calls (CVE-2022-49936)

    In the Linux kernel, the following vulnerability has been resolved:

    vt: Clear selection before changing the font (CVE-2022-49948)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hidraw: fix memory leak in hidraw_release() (CVE-2022-49981)

    In the Linux kernel, the following vulnerability has been resolved:

    md: call __md_stop_writes in md_stop (CVE-2022-49987)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Check for overflow while configuring loop (CVE-2022-49993)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in __xfrm_policy_check() (CVE-2022-50007)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: don't call disarm_kprobe() for disabled kprobes (CVE-2022-50008)

    The upstream advisory describes this issue as follows:

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target     system in order to exploit this vulnerability.

    The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of     proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
    An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-2860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
247040	Linux Distros Unpatched Vulnerability : CVE-2022-49936	Nessus	Misc.	medium
242951	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:02537-1)	Nessus	SuSE Local Security Checks	high
242218	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:02334-1)	Nessus	SuSE Local Security Checks	critical
242100	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:02308-1)	Nessus	SuSE Local Security Checks	high
241963	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:02264-1)	Nessus	SuSE Local Security Checks	high
166131	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-036 (ALASKERNEL-5.4-2022-036)	Nessus	Amazon Linux Local Security Checks	high
166124	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-020 (ALASKERNEL-5.10-2022-020)	Nessus	Amazon Linux Local Security Checks	high
166118	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2022-008 (ALASKERNEL-5.15-2022-008)	Nessus	Amazon Linux Local Security Checks	high
165990	Amazon Linux 2 : kernel, --advisory ALAS2-2022-1852 (ALAS-2022-1852)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-49936

medium

Tenable Plugins

medium

high

critical

high

high

high

high

high

high