In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6716-1 advisory.

    Wenqing Liu discovered that the f2fs file system implementation in the Linux kernel did not properly     validate inode types while performing garbage collection. An attacker could use this to construct a     malicious f2fs image that, when mounted and operated on, could cause a denial of service (system crash).
    (CVE-2021-44879)

    It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the Linux kernel did not properly     handle certain error conditions during device registration. A local attacker could possibly use this to     cause a denial of service (system crash). (CVE-2023-22995)

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    Bien Pham discovered that the netfiler subsystem in the Linux kernel contained a race condition, leading     to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2023-4244)

    It was discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-51779)

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the Rose X.25 protocol implementation in the Linux     kernel, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-51782)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some     situations. A local attacker could use this to possibly expose sensitive information (kernel memory).
    (CVE-2024-0340)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6702-2 advisory.

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6702-1 advisory.

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6347-1 advisory.

    William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly     handle network packet retransmission in certain situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2022-4269)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly check     buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker     could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

    Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu     memory management structure. A local attacker could use this to expose sensitive information (kernel     memory) or in conjunction with another kernel vulnerability. (CVE-2023-0597)

    It was discovered that a race condition existed in the btrfs file system implementation in the Linux     kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

    It was discovered that the APM X-Gene SoC hardware monitoring driver in the Linux kernel contained a race     condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1855)

    It was discovered that the ST NCI NFC driver did not properly handle device removal events. A physically     proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-1990)

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the XFS file system implementation in the Linux kernel did not properly perform     metadata validation when mounting certain images. An attacker could use this to specially craft a file     system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124)

    Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF     verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations,     leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

    It was discovered that the SLIMpro I2C device driver in the Linux kernel did not properly validate user-     supplied data in some situations, leading to an out-of-bounds write vulnerability. A privileged attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-2194)

    It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A     privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-2235)

    Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle     locking during table_clear() operations. A local attacker could use this to cause a denial of service     (kernel deadlock). (CVE-2023-2269)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    It was discovered that a race condition existed in the TLS subsystem in the Linux kernel, leading to a     use-after-free or a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-28466)

    It was discovered that the DA9150 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-30772)

    It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a     race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly validate     pointers in some situations, leading to a null pointer dereference vulnerability. A remote attacker could     use this to cause a denial of service (system crash). (CVE-2023-32248)

    It was discovered that the kernel->user space relay implementation in the Linux kernel did not properly     perform certain buffer calculations, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash) or expose sensitive information (kernel     memory). (CVE-2023-3268)

    It was discovered that the Qualcomm EMAC ethernet driver in the Linux kernel did not properly handle     device removal, leading to a user-after free vulnerability. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33203)

    It was discovered that the BQ24190 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33288)

    It was discovered that the video4linux driver for Philips based TV cards in the Linux kernel contained a     race condition during device removal, leading to a use-after-free vulnerability. A physically proximate     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-35823)

    It was discovered that the SDMC DM1105 PCI device driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35824)

    It was discovered that the Renesas USB controller driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35828)

    It was discovered that the Rockchip Video Decoder IP driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35829)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6332-1 advisory.

    Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state     after speculative execution of various instructions. A local unprivileged user could use this to obtain to     sensitive information. (CVE-2022-40982)

    William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly     handle network packet retransmission in certain situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2022-4269)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly check     buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker     could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

    Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu     memory management structure. A local attacker could use this to expose sensitive information (kernel     memory) or in conjunction with another kernel vulnerability. (CVE-2023-0597)

    It was discovered that a race condition existed in the btrfs file system implementation in the Linux     kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

    It was discovered that the APM X-Gene SoC hardware monitoring driver in the Linux kernel contained a race     condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1855)

    It was discovered that the ST NCI NFC driver did not properly handle device removal events. A physically     proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-1990)

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain     vector register instructions. A local attacker could use this to expose sensitive information.
    (CVE-2023-20593)

    It was discovered that the XFS file system implementation in the Linux kernel did not properly perform     metadata validation when mounting certain images. An attacker could use this to specially craft a file     system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124)

    Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle     locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

    Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF     verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations,     leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

    It was discovered that the SLIMpro I2C device driver in the Linux kernel did not properly validate user-     supplied data in some situations, leading to an out-of-bounds write vulnerability. A privileged attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-2194)

    It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A     privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-2235)

    Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle     locking during table_clear() operations. A local attacker could use this to cause a denial of service     (kernel deadlock). (CVE-2023-2269)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    It was discovered that a race condition existed in the TLS subsystem in the Linux kernel, leading to a     use-after-free or a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-28466)

    It was discovered that the DA9150 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-30772)

    It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a     race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly validate     pointers in some situations, leading to a null pointer dereference vulnerability. A remote attacker could     use this to cause a denial of service (system crash). (CVE-2023-32248)

    It was discovered that the kernel->user space relay implementation in the Linux kernel did not properly     perform certain buffer calculations, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash) or expose sensitive information (kernel     memory). (CVE-2023-3268)

    It was discovered that the Qualcomm EMAC ethernet driver in the Linux kernel did not properly handle     device removal, leading to a user-after free vulnerability. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33203)

    It was discovered that the BQ24190 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33288)

    It was discovered that the video4linux driver for Philips based TV cards in the Linux kernel contained a     race condition during device removal, leading to a use-after-free vulnerability. A physically proximate     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-35823)

    It was discovered that the SDMC DM1105 PCI device driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35824)

    It was discovered that the Renesas USB controller driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35828)

    It was discovered that the Rockchip Video Decoder IP driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35829)

    It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel     did not properly perform reference counting in some situations, leading to a use-after-free vulnerability.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-3609)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

    It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

    It was discovered that the network packet classifier with netfilter/firewall marks implementation in the     Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-3776)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules     flush in certain circumstances. A local attacker could possibly use this to cause a denial of service     (system crash) or execute arbitrary code. (CVE-2023-3777)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule     additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element     removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain     deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of     service (system crash) or execute arbitrary code. (CVE-2023-4015)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6311-1 advisory.

    William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly     handle network packet retransmission in certain situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2022-4269)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly check     buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker     could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

    Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu     memory management structure. A local attacker could use this to expose sensitive information (kernel     memory) or in conjunction with another kernel vulnerability. (CVE-2023-0597)

    It was discovered that a race condition existed in the btrfs file system implementation in the Linux     kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

    It was discovered that the APM X-Gene SoC hardware monitoring driver in the Linux kernel contained a race     condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1855)

    It was discovered that the ST NCI NFC driver did not properly handle device removal events. A physically     proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-1990)

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the XFS file system implementation in the Linux kernel did not properly perform     metadata validation when mounting certain images. An attacker could use this to specially craft a file     system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124)

    Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF     verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations,     leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

    It was discovered that the SLIMpro I2C device driver in the Linux kernel did not properly validate user-     supplied data in some situations, leading to an out-of-bounds write vulnerability. A privileged attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-2194)

    It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A     privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-2235)

    Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle     locking during table_clear() operations. A local attacker could use this to cause a denial of service     (kernel deadlock). (CVE-2023-2269)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    It was discovered that a race condition existed in the TLS subsystem in the Linux kernel, leading to a     use-after-free or a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-28466)

    It was discovered that the DA9150 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-30772)

    It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a     race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly validate     pointers in some situations, leading to a null pointer dereference vulnerability. A remote attacker could     use this to cause a denial of service (system crash). (CVE-2023-32248)

    It was discovered that the kernel->user space relay implementation in the Linux kernel did not properly     perform certain buffer calculations, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash) or expose sensitive information (kernel     memory). (CVE-2023-3268)

    It was discovered that the Qualcomm EMAC ethernet driver in the Linux kernel did not properly handle     device removal, leading to a user-after free vulnerability. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33203)

    It was discovered that the BQ24190 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33288)

    It was discovered that the video4linux driver for Philips based TV cards in the Linux kernel contained a     race condition during device removal, leading to a use-after-free vulnerability. A physically proximate     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-35823)

    It was discovered that the SDMC DM1105 PCI device driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35824)

    It was discovered that the Renesas USB controller driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35828)

    It was discovered that the Rockchip Video Decoder IP driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35829)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6300-1 advisory.

    William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly     handle network packet retransmission in certain situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2022-4269)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly check     buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker     could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

    Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu     memory management structure. A local attacker could use this to expose sensitive information (kernel     memory) or in conjunction with another kernel vulnerability. (CVE-2023-0597)

    It was discovered that a race condition existed in the btrfs file system implementation in the Linux     kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

    It was discovered that the APM X-Gene SoC hardware monitoring driver in the Linux kernel contained a race     condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1855)

    It was discovered that the ST NCI NFC driver did not properly handle device removal events. A physically     proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-1990)

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the XFS file system implementation in the Linux kernel did not properly perform     metadata validation when mounting certain images. An attacker could use this to specially craft a file     system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124)

    Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF     verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations,     leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

    It was discovered that the SLIMpro I2C device driver in the Linux kernel did not properly validate user-     supplied data in some situations, leading to an out-of-bounds write vulnerability. A privileged attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-2194)

    It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A     privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-2235)

    Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle     locking during table_clear() operations. A local attacker could use this to cause a denial of service     (kernel deadlock). (CVE-2023-2269)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    It was discovered that a race condition existed in the TLS subsystem in the Linux kernel, leading to a     use-after-free or a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-28466)

    It was discovered that the DA9150 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-30772)

    It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a     race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly validate     pointers in some situations, leading to a null pointer dereference vulnerability. A remote attacker could     use this to cause a denial of service (system crash). (CVE-2023-32248)

    It was discovered that the kernel->user space relay implementation in the Linux kernel did not properly     perform certain buffer calculations, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash) or expose sensitive information (kernel     memory). (CVE-2023-3268)

    It was discovered that the Qualcomm EMAC ethernet driver in the Linux kernel did not properly handle     device removal, leading to a user-after free vulnerability. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33203)

    It was discovered that the BQ24190 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33288)

    It was discovered that the video4linux driver for Philips based TV cards in the Linux kernel contained a     race condition during device removal, leading to a use-after-free vulnerability. A physically proximate     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-35823)

    It was discovered that the SDMC DM1105 PCI device driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35824)

    It was discovered that the Renesas USB controller driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35828)

    It was discovered that the Rockchip Video Decoder IP driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35829)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2871-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
    - CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
    - CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
    - CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an     attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
    - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
    - CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause     system crashes (bsc#1207168).
    - CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
    - CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the     io_uring subcomponent (bsc#1207521).
    - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
    - CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
    - CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
    - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
    - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption     (bsc#1208600).
    - CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set     when plugging/disconnecting a malicious USB device (bsc#1208604).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
    - CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash     the system (bsc#1209039).
    - CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
    - CVE-2023-1583: Fixed a NULL pointer dereference in io_file_bitmap_get in io_uring/filetable.c     (bsc#1209637).
    - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
    - CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming     CPU from suspend-to-RAM (bsc#1209779).
    - CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul     in fs/nfsd/nfs4proc.c (bsc#1209788).
    - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could     use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-1838: Fixed an use-after-free flaw in virtio network subcomponent. This flaw could allow a     local attacker to crash the system and lead to a kernel information leak problem. (bsc#1210203).
    - CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
    - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
    - CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
    - CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands,     compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
    - CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-     wrapper.S (bsc#1212155).
    - CVE-2023-21106: Fixed possible memory corruption due to double free in adreno_set_param of adreno_gpu.c     (bsc#1211654).
    - CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).
    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
    - CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c     in RDMA (bsc#1210629).
    - CVE-2023-2235: Fixed a use-after-free vulnerability in the Performance Events system that could have     been exploited to achieve local privilege escalation (bsc#1210986).
    - CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting     in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
    - CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
    - CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
    - CVE-2023-23001: Fixed misinterpretation of regulator_get return value in drivers/scsi/ufs/ufs-mediatek.c     (bsc#1208829).
    - CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
    - CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#1208845).
    - CVE-2023-2430: Fixed a missing lock on overflow for IOPOLL (bsc#1211014).
    - CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
    - CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
    - CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
    - CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some     Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable     escalation of privilege via local access (bsc#1211263).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/uetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28866: Fixed an out-of-bounds access in net/bluetooth/hci_sync.c because amp_init1[] and     amp_init2[] are supposed to have an intentionally invalid element, but did not (bsc#1209780).
    - CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or     Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
    - CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks     for CR0 and CR4 (bsc#1210294).
    - CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove     (bsc#1210329).
    - CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
    - CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
    - CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c     (bsc#1212051).
    - CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed     local attackers to crash the system at device disconnect (bsc#1212129).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940).
    - CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
    - CVE-2023-3212: Fixed a NULL pointer dereference flaw in the gfs2 file system (bsc#1212265).
    - CVE-2023-3220: Fixed a NULL pointer dereference flaw in dpu_crtc_atomic_check in     drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() (bsc#1212556).
    - CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests     (bsc#1211043).
    - CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c     (bsc#1211590).
    - CVE-2023-3357: Fixed a NULL pointer dereference flaw in the AMD Sensor Fusion Hub driver (bsc#1212605).
    - CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver     (bsc#1212606).
    - CVE-2023-3389: Fixed a use-after-free vulnerability in the io_uring subsystem (bsc#1212838).
    - CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the     vmwgfx driver (bsc#1211593).
    - CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the     vmwgfx driver (bsc#1211595).
    - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via     TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
    - CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
    - CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in     drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
    - CVE-2023-35829: Fixed a use-after-free flaw in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c     (bsc#1212495).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2809-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-     SSP A-MSDU frames to inject arbitrary network packets (bsc#1185861).
    - CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks     (bsc#1206992).
    - CVE-2022-3523: Fixed a use after free related to device private page handling (bsc#1204363).
    - CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
    - CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
    - CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
    - CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an     attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
    - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
    - CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with     capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount     into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system     (bsc#1209615).
    - CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause     system crashes (bsc#1207168).
    - CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
    - CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the     io_uring subcomponent (bsc#1207521).
    - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
    - CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
    - CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
    - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
    - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption     (bsc#1208600).
    - CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
    - CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set     when plugging/disconnecting a malicious USB device (bsc#1208604).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
    - CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash     the system (bsc#1209039).
    - CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
    - CVE-2023-1583: Fixed a NULL pointer dereference in io_file_bitmap_get in io_uring/filetable.c     (bsc#1209637).
    - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
    - CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming     CPU from suspend-to-RAM (bsc#1209779, bsc#1198400).
    - CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul     in fs/nfsd/nfs4proc.c (bsc#1209788).
    - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could     use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
    - CVE-2023-1838: Fixed an use-after-free flaw in virtio network subcomponent. This flaw could allow a     local attacker to crash the system and lead to a kernel information leak problem. (bsc#1210203).
    - CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
    - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
    - CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
    - CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands,     compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
    - CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-     wrapper.S (bsc#1212155).
    - CVE-2023-21106: Fixed possible memory corruption due to double free in adreno_set_param of adreno_gpu.c     (bsc#1211654).
    - CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).
    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
    - CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c     in RDMA (bsc#1210629).
    - CVE-2023-2235: Fixed a use-after-free vulnerability in the Performance Events system that could have     been exploited to achieve local privilege escalation (bsc#1210986).
    - CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting     in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
    - CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
    - CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
    - CVE-2023-23001: Fixed misinterpretation of regulator_get return value in drivers/scsi/ufs/ufs-mediatek.c     (bsc#1208829).
    - CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
    - CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#1208845).
    - CVE-2023-23454: Fixed a type confusion bug in the CBQ network scheduler which could lead to a use-after-     free (bsc#1207036).
    - CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type     confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid     classification results) (bsc#1207125).
    - CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
    - CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
    - CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
    - CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some     Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable     escalation of privilege via local access (bsc#1211263).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/uetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28866: Fixed an out-of-bounds access in net/bluetooth/hci_sync.c because amp_init1[] and     amp_init2[] are supposed to have an intentionally invalid element, but did not (bsc#1209780).
    - CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or     Spectre-BHB, for the new hw AmpereOne (bsc#1211855, bsc#1205153).
    - CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks     for CR0 and CR4 (bsc#1210294).
    - CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove     (bsc#1210329).
    - CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
    - CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed     local attackers to crash the system at device disconnect (bsc#1212129).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940).
    - CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
    - CVE-2023-3220: Fixed a NULL pointer dereference flaw in dpu_crtc_atomic_check in     drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() (bsc#1212556).
    - CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests     (bsc#1211043).
    - CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c     (bsc#1211590).
    - CVE-2023-3357: Fixed a NULL pointer dereference flaw in the AMD Sensor Fusion Hub driver (bsc#1212605).
    - CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver     (bsc#1212606).
    - CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the     vmwgfx driver (bsc#1211593).
    - CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the     vmwgfx driver (bsc#1211595).
    - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via     TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
    - CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
    - CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in     drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
    - CVE-2023-35829: Fixed a use-after-free flaw in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c     (bsc#1212495).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 5.15.118 / 5.15.118_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-172-02 advisory.

    New kernel packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the kernel-generic security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3404 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3404-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 3, 2023                                   https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.178-3~deb10u1     CVE ID         : CVE-2022-2196 CVE-2022-3424 CVE-2022-3707 CVE-2022-4129                      CVE-2022-4379 CVE-2023-0045 CVE-2023-0458 CVE-2023-0459                      CVE-2023-0461 CVE-2023-1073 CVE-2023-1074 CVE-2023-1076                      CVE-2023-1077 CVE-2023-1078 CVE-2023-1079 CVE-2023-1118                      CVE-2023-1281 CVE-2023-1513 CVE-2023-1611 CVE-2023-1670                      CVE-2023-1829 CVE-2023-1855 CVE-2023-1859 CVE-2023-1872                      CVE-2023-1989 CVE-2023-1990 CVE-2023-1998 CVE-2023-2162                      CVE-2023-2194 CVE-2023-22998 CVE-2023-23004 CVE-2023-23559                      CVE-2023-25012 CVE-2023-26545 CVE-2023-28328 CVE-2023-28466                      CVE-2023-30456     Debian Bug     : 989705 993612 1022126 1031753

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service, or information     leak.

    CVE-2022-2196

        A regression was discovered the KVM implementation for Intel CPUs,         affecting Spectre v2 mitigation for nested virtualisation.  When         KVM was used as the L0 hypervisor, an L2 guest could exploit this         to leak sensitive information from its L1 hypervisor.

    CVE-2022-3424

        Zheng Wang and Zhuorao Yang reported a flaw in the SGI GRU driver         which could lead to a use-after-free.  On systems where this driver         is used, a local user can explit this for denial of service (crash         or memory corruption) or possibly for privilege escalation.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-3707

        Zheng Wang reported a flaw in the i915 graphics driver's         virtualisation (GVT-g) support that could lead to a double-free.
        On systems where this feature is used, a guest can exploit this         for denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2022-4129

        Haowei Yan reported a race condition in the L2TP protocol         implementation which could lead to a null pointer dereference.  A         local user could exploit this for denial of service (crash).

    CVE-2022-4379

        Xingyuan Mo reported a flaw in the NFSv4.2 inter server to         server copy implementation which could lead to a use-after-free.

        This feature is not enabled in Debian's official kernel         configurations.

    CVE-2023-0045

        Rodrigo Branco and Rafael Correa De Ysasi reported that when a         user-space task told the kernel to enable Spectre v2 mitigation         for it, the mitigation was not enabled until the task was next         rescheduled.  This might be exploitable by a local or remote         attacker to leak sensitive information from such an application.

    CVE-2023-0458

        Jordy Zimmer and Alexandra Sandulescu found that getrlimit() and         related system calls were vulnerable to speculative execution         attacks such as Spectre v1.  A local user could explot this to         leak sensitive information from the kernel.

    CVE-2023-0459

        Jordy Zimmer and Alexandra Sandulescu found a regression in         Spectre v1 mitigation in the user-copy functions for the amd64         (64-bit PC) architecture.  Where the CPUs do not implement SMAP or         it is disabled, a local user could exploit this to leak sensitive         information from the kernel.  Other architectures may also be         affected.

    CVE-2023-0461

        slipper reported a flaw in the kernel's support for ULPs (Upper         Layer Protocols) on top of TCP that can lead to a double-free when         using kernel TLS sockets.  A local user can exploit this for         denial of service (crash or memory corruption) or possibly for         privilege escalation.

        Kernel TLS is not enabled in Debian's official kernel         configurations.

    CVE-2023-1073

        Pietro Borrello reported a type confusion flaw in the HID (Human         Interface Device) subsystem.  An attacker able to insert and         remove USB devices might be able to use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1074

        Pietro Borrello reported a type confusion flaw in the SCTP         protocol implementation which can lead to a memory leak.  A local         user could exploit this to cause a denial of service (resource         exhaustion).

    CVE-2023-1076

        Pietro Borrello reported a type confusion flaw in the TUN/TAP         network driver, which results in all TUN/TAP sockets being marked         as belonging to user ID 0 (root).  This may allow local users to         evade local firewall rules based on user ID.

    CVE-2023-1077

        Pietro Borrello reported a type confusion flaw in the task         scheduler.  A local user might be able to exploit this to cause a         denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2023-1078

        Pietro Borrello reported a type confusion flaw in the RDS protocol         implementation.  A local user could exploit this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-1079

        Pietro Borrello reported a race condition in the hid-asus HID         driver which could lead to a use-after-free.  An attacker able to         insert and remove USB devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1118

        Duoming Zhou reported a race condition in the ene_ir remote         control driver that can lead to a use-after-free if the driver         is unbound.  It is not clear what the security impact of this is.

    CVE-2023-1281, CVE-2023-1829

        valis reported two flaws in the cls_tcindex network traffic         classifier which could lead to a use-after-free.  A local user can         exploit these for privilege escalation.  This update removes         cls_tcindex entirely.

    CVE-2023-1513

        Xingyuan Mo reported an information leak in the KVM implementation         for the i386 (32-bit PC) architecture.  A local user could exploit         this to leak sensitive information from the kernel.

    CVE-2023-1611

        butt3rflyh4ck reported a race condition in the btrfs filesystem         driver which can lead to a use-after-free.  A local user could         exploit this to cause a denial of service (crash or memory         corruption) or possibly for privilege escalation.

    CVE-2023-1670

        Zheng Wang reported a race condition in the xirc2ps_cs network         driver which can lead to a use-after-free.  An attacker able to         insert and remove PCMCIA devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1855

        Zheng Wang reported a race condition in the xgene-hwmon hardware         monitoring driver that may lead to a use-after-free.  It is not         clear what the security impact of this is.

    CVE-2023-1859

        Zheng Wang reported a race condition in the 9pnet_xen transport         for the 9P filesystem on Xen, which can lead to a use-after-free.
        On systems where this feature is used, a backend driver in another         domain can use this to cause a denial of service (crash or memory         corruption) or possibly to run arbitrary code in the vulnerable         domain.

    CVE-2023-1872

        Bing-Jhong Billy Jheng reported a race condition in the io_uring         subsystem that can lead to a use-after-free.  A local user could         exploit this to cause a denial of service (crash or memory         corruption) or possibly for privilege escalation.

    CVE-2023-1989

        Zheng Wang reported a race condition in the btsdio Bluetooth         adapter driver that can lead to a use-after-free.  An attacker         able to insert and remove SDIO devices can use this to cause a         denial of service (crash or memory corruption) or possibly to run         arbitrary code in the kernel.

    CVE-2023-1990

        Zheng Wang reported a race condition in the st-nci NFC adapter         driver that can lead to a use-after-free.  It is not clear what         the security impact of this is.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2023-1998

        Jos Oliveira and Rodrigo Branco reported a regression in Spectre         v2 mitigation for user-space on x86 CPUs supporting IBRS but not         eIBRS.  This might be exploitable by a local or remote attacker to         leak sensitive information from a user-space application.

    CVE-2023-2162

        Mike Christie reported a race condition in the iSCSI TCP transport         that can lead to a use-after-free.  On systems where this feature         is used, a local user might be able to use this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-2194

        Wei Chen reported a potential heap buffer overflow in the         i2c-xgene-slimpro IC adapter driver.  A local user with         permission to access such a device can use this to cause a denial         of service (crash or memory corruption) and probably for privilege         escalation.

    CVE-2023-22998

        Miaoqian Lin reported an incorrect error check in the virtio-gpu         GPU driver.  A local user with access to such a device might be         able to use this to cause a denial of service (crash).

    CVE-2023-23004

        Miaoqian Lin reported an incorrect error check in the mali-dp GPU         driver.  A local user with access to such a device might be able         to use this to cause a denial of service (crash).

    CVE-2023-23559

        Szymon Heidrich reported incorrect bounds checks in the rndis_wlan         Wi-Fi driver which may lead to a heap buffer overflow or overread.
        An attacker able to insert and remove USB devices can use this to         cause a denial of service (crash or memory corruption) or         information leak, or possibly to run arbitrary code in the kernel.

    CVE-2023-25012

        Pietro Borrello reported a race condition in the hid-bigbenff HID         driver which could lead to a use-after-free.  An attacker able to         insert and remove USB devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-26545

        Lianhui Tang reported a flaw in the MPLS protocol implementation         that could lead to a double-free.  A local user might be able to         exploit this to cause a denial of service (crash or memory         corruption) or possibl for privilege escalation.

    CVE-2023-28328

        Wei Chen reported a flaw in the az6927 DVB driver that can lead to         a null pointer dereference.  A local user permitted to access an         IC adapter device that this driver creates can use this to cause         a denial of service (crash).

    CVE-2023-28466

        Hangyu Hua reported a race condition in the kernel TLS socket         implementation which can lead to a use-after-free or null         pointer dereference.  A local user can exploit this for         denial of service (crash or memory corruption) or possibly for         privilege escalation.

        This feature is not enabled in Debian's official kernel         configurations.

    CVE-2023-30456

        Reima ISHII reported a flaw in the KVM implementation for Intel         CPUs affecting nested virtualisation.  When KVM was used as the L0         hypervisor, and EPT and/or unrestricted guest mode was disabled,         it did not prevent an L2 guest from being configured with an         architecturally invalid protection/paging mode.  A malicious guest         could exploit this to cause a denial of service (crash).

    For Debian 10 buster, these problems have been fixed in version     5.10.178-3~deb10u1.  This update additionally fixes Debian bugs     #989705, #993612, #1022126, and #1031753; and includes many more bug     fixes from stable updates 5.10.163-5.10.178 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1811-1 advisory.

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

  - A double-free flaw was found in the Linux kernel's TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-4744)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - A remote denial of service vulnerability was found in the Linux kernel's TIPC kernel module. The while     loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue.
    Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system     to instantly spike to 100%, causing a denial of service condition. (CVE-2023-1390)

  - A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak. (CVE-2023-1513)

  - A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.
    This issue may allow a local attacker with user privilege to cause a denial of service. (CVE-2023-1582)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a     crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

  - A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact     in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows     a local user to crash or potentially cause a denial of service. (CVE-2023-28327)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

  - hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation. (CVE-2023-28464)

  - do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

  - An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer     overflow. (CVE-2023-28772)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1800-1 advisory.

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

  - A double-free flaw was found in the Linux kernel's TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-4744)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - A remote denial of service vulnerability was found in the Linux kernel's TIPC kernel module. The while     loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue.
    Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system     to instantly spike to 100%, causing a denial of service condition. (CVE-2023-1390)

  - A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak. (CVE-2023-1513)

  - A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.
    This issue may allow a local attacker with user privilege to cause a denial of service. (CVE-2023-1582)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a     crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

  - A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact     in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows     a local user to crash or potentially cause a denial of service. (CVE-2023-28327)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

  - hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation. (CVE-2023-28464)

  - do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

  - An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer     overflow. (CVE-2023-28772)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1710-1 advisory.

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020. (CVE-2022-3523)

  - An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS). (CVE-2022-36280)

  - A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c     in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a     local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-38096)

  - The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The     ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL     MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the     TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to     the prctl syscall. The patch that added the support for the conditional mitigation via prctl     (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit     a664ec9158eeddd75121d39c9a0758016097fa96 (CVE-2023-0045)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was     found in the way user can guess location of exception stack(s) or other important data. A local user could     use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in     drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

  - In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the     drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually     an error pointer). (CVE-2023-22998)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an     integer overflow in an addition. (CVE-2023-23559)

  - The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a     crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

  - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1609-1 advisory.

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020. (CVE-2022-3523)

  - A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c     in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a     local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-38096)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was     found in the way user can guess location of exception stack(s) or other important data. A local user could     use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in     drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

  - In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the     drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually     an error pointer). (CVE-2023-22998)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an     integer overflow in an addition. (CVE-2023-23559)

  - The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a     crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

  - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1608-1 advisory.

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020. (CVE-2022-3523)

  - An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS). (CVE-2022-36280)

  - A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c     in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a     local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-38096)

  - The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The     ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL     MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the     TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to     the prctl syscall. The patch that added the support for the conditional mitigation via prctl     (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit     a664ec9158eeddd75121d39c9a0758016097fa96 (CVE-2023-0045)

  - A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(),     allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected     versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4. (CVE-2023-0122)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was     found in the way user can guess location of exception stack(s) or other important data. A local user could     use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in     drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

  - In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the     drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually     an error pointer). (CVE-2023-22998)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23001)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

  - atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

  - In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an     integer overflow in an addition. (CVE-2023-23559)

  - The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a     crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

  - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-23004 advisory.

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0749-1 advisory.

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020. (CVE-2022-3523)

  - A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c     in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a     local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-38096)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was     found in the way user can guess location of exception stack(s) or other important data. A local user could     use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in     drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

  - In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the     drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually     an error pointer). (CVE-2023-22998)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an     integer overflow in an addition. (CVE-2023-23559)

  - The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a     crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

  - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
236642	Alibaba Cloud Linux 3 : 0042: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0042)	Nessus	Alibaba Cloud Linux Local Security Checks	high
235961	Alibaba Cloud Linux 3 : 0079: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0079)	Nessus	Alibaba Cloud Linux Local Security Checks	high
227429	Linux Distros Unpatched Vulnerability : CVE-2023-23004	Nessus	Misc.	medium
192562	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6716-1)	Nessus	Ubuntu Local Security Checks	high
192319	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6702-2)	Nessus	Ubuntu Local Security Checks	high
192292	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6702-1)	Nessus	Ubuntu Local Security Checks	high
180557	Ubuntu 20.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-6347-1)	Nessus	Ubuntu Local Security Checks	critical
180445	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6332-1)	Nessus	Ubuntu Local Security Checks	high
180226	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6311-1)	Nessus	Ubuntu Local Security Checks	critical
179936	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6300-1)	Nessus	Ubuntu Local Security Checks	critical
178457	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2871-1)	Nessus	SuSE Local Security Checks	high
178179	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2809-1)	Nessus	SuSE Local Security Checks	high
177495	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2023-172-02)	Nessus	Slackware Local Security Checks	high
175925	Debian dla-3404 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	high
174146	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:1811-1)	Nessus	SuSE Local Security Checks	high
174049	SUSE SLES15 Security Update : kernel (SUSE-SU-2023:1800-1)	Nessus	SuSE Local Security Checks	high
173767	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:1710-1)	Nessus	SuSE Local Security Checks	high
173632	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:1609-1)	Nessus	SuSE Local Security Checks	high
173627	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:1608-1)	Nessus	SuSE Local Security Checks	high
173466	CBL Mariner 2.0 Security Update: kernel (CVE-2023-23004)	Nessus	MarinerOS Local Security Checks	medium
172654	SUSE SLES15 Security Update : kernel (SUSE-SU-2023:0749-1)	Nessus	SuSE Local Security Checks	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-23004

medium

Tenable Plugins

high

high

medium

high

high

high

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

medium

high

high