Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0195 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-31346:
    Failure to initialize     memory in SEV Firmware may allow a privileged attacker to access stale data     from other guests.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:4262 advisory.

    * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from     other guests. (CVE-2023-31346)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5883 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * kernel: Reserved fields in guest message responses may not be zero initialized (AMD-     SN-3007,CVE-2023-31346)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5640 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4774 advisory.

    * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4774 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4733 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4741 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4409 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4262 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * kernel: Reserved fields in guest message responses may not be zero initialized (CVE-2023-31346)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236180	Alibaba Cloud Linux 3 : 0195: linux-firmware (ALINUX3-SA-2024:0195)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
235523	RockyLinux 8 : linux-firmware (RLSA-2024:4262)	Nessus	Rocky Linux Local Security Checks	medium
226418	Linux Distros Unpatched Vulnerability : CVE-2023-31346	Nessus	Misc.	medium
206229	RHEL 8 : linux-firmware (RHSA-2024:5883)	Nessus	Red Hat Local Security Checks	medium
205880	RHEL 9 : linux-firmware (RHSA-2024:5640)	Nessus	Red Hat Local Security Checks	medium
204720	AlmaLinux 9 : linux-firmware (ALSA-2024:4774)	Nessus	Alma Linux Local Security Checks	medium
203687	RHEL 9 : linux-firmware (RHSA-2024:4774)	Nessus	Red Hat Local Security Checks	medium
203685	RHEL 8 : linux-firmware (RHSA-2024:4733)	Nessus	Red Hat Local Security Checks	medium
203683	RHEL 8 : linux-firmware (RHSA-2024:4741)	Nessus	Red Hat Local Security Checks	medium
202010	RHEL 8 : linux-firmware (RHSA-2024:4409)	Nessus	Red Hat Local Security Checks	medium
201280	RHEL 8 : linux-firmware (RHSA-2024:4262)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2023-31346

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium