There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the     sibling thread after an SMT mode switch potentially resulting in information disclosure. (CVE-2022-27672)

  - A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking     configuration (redirecting egress packets to ingress using TC action 'mirred') a local unprivileged user     could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a     retransmission, resulting in a denial of service condition. (CVE-2022-4269)

  - The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The     ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL     MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the     TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to     the prctl syscall. The patch that added the support for the conditional mitigation via prctl     (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit     a664ec9158eeddd75121d39c9a0758016097fa96 (CVE-2023-0045)

  - There is a logic error in io_uring's implementation which can be used to trigger a use-after-free     vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the     last io_grab_identity call cannot return false is not true, and in this case the function will use the     init_cred or the previous linked requests identity to do operations instead of using the current identity.
    This can lead to reference counting issues causing use-after-free. We recommend upgrading past version     5.10.161. (CVE-2023-0240)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was     found in the way user can guess location of exception stack(s) or other important data. A local user could     use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)

  - A memory corruption flaw was found in the Linux kernel's human interface device (HID) subsystem in how a     user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2023-1073)

  - A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may     occur when a user starts a malicious networking service and someone connects to this service. This could     allow a local user to starve resources, causing a denial of service. (CVE-2023-1074)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the     user process. timens_install calls current_is_single_threaded to determine if the current process is     single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to     insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace     is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page     allocated by the kernel will be still available from the user-space process and can leak memory contents     via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit     788d0824269bef539fe31a785b1517882eafed93     https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring (CVE-2023-23586)

  - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

  - A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact     in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows     a local user to crash or potentially cause a denial of service. (CVE-2023-28327)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3349 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3349-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     March 02, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.162-1~deb10u1     CVE ID         : CVE-2022-2873 CVE-2022-3545 CVE-2022-3623 CVE-2022-4696                      CVE-2022-36280 CVE-2022-41218 CVE-2022-45934 CVE-2022-47929                      CVE-2023-0179 CVE-2023-0240 CVE-2023-0266 CVE-2023-0394                      CVE-2023-23454  CVE-2023-23455 CVE-2023-23586     Debian Bug     : 825141 1008501 1027430 1027483

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2022-2873

        Zheyu Ma discovered that an out-of-bounds memory access flaw in         the Intel iSMT SMBus 2.0 host controller driver may result in         denial of service (system crash).

    CVE-2022-3545

        It was discovered that the Netronome Flow Processor (NFP) driver         contained a use-after-free flaw in area_cache_get(), which may         result in denial of service or the execution of arbitrary code.

    CVE-2022-3623

        A race condition when looking up a CONT-PTE/PMD size hugetlb page         may result in denial of service or an information leak.

    CVE-2022-4696

        A use-after-free vulnerability was discovered in the io_uring         subsystem.

    CVE-2022-36280

        An out-of-bounds memory write vulnerability was discovered in the         vmwgfx driver, which may allow a local unprivileged user to cause         a denial of service (system crash).

    CVE-2022-41218

        Hyunwoo Kim reported a use-after-free flaw in the Media DVB core         subsystem caused by refcount races, which may allow a local user         to cause a denial of service or escalate privileges.

    CVE-2022-45934

        An integer overflow in l2cap_config_req() in the Bluetooth         subsystem was discovered, which may allow a physically proximate         attacker to cause a denial of service (system crash).

    CVE-2022-47929

        Frederick Lawler reported a NULL pointer dereference in the         traffic control subsystem allowing an unprivileged user to cause a         denial of service by setting up a specially crafted traffic         control configuration.

    CVE-2023-0179

        Davide Ornaghi discovered incorrect arithmetics when fetching VLAN         header bits in the netfilter subsystem, allowing a local user to         leak stack and heap addresses or potentially local privilege         escalation to root.

    CVE-2023-0240

        A flaw was discovered in the io_uring subsystem that could lead         to a use-after-free.  A local user could exploit this to cause         a denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2023-0266

        A use-after-free flaw in the sound subsystem due to missing         locking may result in denial of service or privilege escalation.

    CVE-2023-0394

        Kyle Zeng discovered a NULL pointer dereference flaw in         rawv6_push_pending_frames() in the network subsystem allowing a         local user to cause a denial of service (system crash).

    CVE-2023-23454

        Kyle Zeng reported that the Class Based Queueing (CBQ) network         scheduler was prone to denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23455

        Kyle Zeng reported that the ATM Virtual Circuits (ATM) network         scheduler was prone to a denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23586

        A flaw was discovered in the io_uring subsystem that could lead to         an information leak.  A local user could exploit this to obtain         sensitive information from the kernel or other users.

    For Debian 10 buster, these problems have been fixed in version     5.10.162-1~deb10u1.

    This update also fixes Debian bugs #825141, #1008501, #1027430, and     #1027483, and includes many more bug fixes from stable updates     5.10.159-5.10.162 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.165-143.735. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-026 advisory.

    In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

    In the Linux kernel, the following vulnerability has been resolved:

    rtc: cmos: Fix event handler registration ordering issue (CVE-2022-48953)

    The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the     kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a     syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

    A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could     allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to     the root user via arbitrary code execution. (CVE-2023-0179)

    There is a logic error in io_uring's implementation which can be used to trigger a use-after-free     vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the     last io_grab_identity call cannot return false is not true, and in this case the function will use the     init_cred or the previous linked requests identity to do operations instead of using the current identity.
    This can lead to reference counting issues causing use-after-free. We recommend upgrading past version     5.10.161. (CVE-2023-0240)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

    There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

    When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket.
    The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is     created from the listener, the context is inherited and vulnerable.

    The setsockopt TCP_ULP operation does not require any privilege.

    We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

    efi: rt-wrapper: Add missing include (CVE-2023-21102)

    cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

    atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mpls: Fix warning during failed attribute validation (CVE-2023-52906)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (CVE-2023-53032)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (CVE-2023-53033)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
177979	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-2272)	Nessus	Huawei Local Security Checks	high
177959	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-2296)	Nessus	Huawei Local Security Checks	high
176860	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2023-2072)	Nessus	Huawei Local Security Checks	high
176821	EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2023-2124)	Nessus	Huawei Local Security Checks	high
172079	Debian dla-3349 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	high
171216	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-026)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-0240

high

Tenable Plugins

high

high

high

high

high

high