A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6626-3 advisory.

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation     of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-     service condition on the system. (CVE-2023-32252)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the     lack of proper locking when performing operations on an object. An attacker can leverage this     vulnerability to execute code in the context of the kernel. (CVE-2023-32257)

  - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is     being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt     in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual     device on the other side. As this action will cause console messages to be issued on the other side quite     often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not     affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the     issue (on Arm32 a waiting writer doesn't block further readers to get the lock). (CVE-2023-34324)

  - An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in     drivers/net/ethernet/renesas/ravb_main.c. (CVE-2023-35827)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-     component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when     the LAN78XX USB device detaches. (CVE-2023-6039)

  - A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

  - A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

  - A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6628-2 advisory.

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation     of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-     service condition on the system. (CVE-2023-32252)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the     lack of proper locking when performing operations on an object. An attacker can leverage this     vulnerability to execute code in the context of the kernel. (CVE-2023-32257)

  - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is     being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt     in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual     device on the other side. As this action will cause console messages to be issued on the other side quite     often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not     affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the     issue (on Arm32 a waiting writer doesn't block further readers to get the lock). (CVE-2023-34324)

  - An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in     drivers/net/ethernet/renesas/ravb_main.c. (CVE-2023-35827)

  - An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access. (CVE-2023-6040)

  - A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

  - A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-     component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when     the LAN78XX USB device detaches. (CVE-2023-6039)

  - A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set     walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-     after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system. (CVE-2024-0193)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6626-2 advisory.

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation     of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-     service condition on the system. (CVE-2023-32252)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the     lack of proper locking when performing operations on an object. An attacker can leverage this     vulnerability to execute code in the context of the kernel. (CVE-2023-32257)

  - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is     being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt     in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual     device on the other side. As this action will cause console messages to be issued on the other side quite     often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not     affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the     issue (on Arm32 a waiting writer doesn't block further readers to get the lock). (CVE-2023-34324)

  - An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in     drivers/net/ethernet/renesas/ravb_main.c. (CVE-2023-35827)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-     component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when     the LAN78XX USB device detaches. (CVE-2023-6039)

  - A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

  - A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

  - A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6628-1 advisory.

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation     of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-     service condition on the system. (CVE-2023-32252)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the     lack of proper locking when performing operations on an object. An attacker can leverage this     vulnerability to execute code in the context of the kernel. (CVE-2023-32257)

  - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is     being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt     in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual     device on the other side. As this action will cause console messages to be issued on the other side quite     often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not     affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the     issue (on Arm32 a waiting writer doesn't block further readers to get the lock). (CVE-2023-34324)

  - An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in     drivers/net/ethernet/renesas/ravb_main.c. (CVE-2023-35827)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-     component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when     the LAN78XX USB device detaches. (CVE-2023-6039)

  - An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access. (CVE-2023-6040)

  - A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set     walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-     after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

  - A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system. (CVE-2024-0193)

  - A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6626-1 advisory.

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation     of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-     service condition on the system. (CVE-2023-32252)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the     lack of proper locking when performing operations on an object. An attacker can leverage this     vulnerability to execute code in the context of the kernel. (CVE-2023-32257)

  - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is     being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt     in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual     device on the other side. As this action will cause console messages to be issued on the other side quite     often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not     affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the     issue (on Arm32 a waiting writer doesn't block further readers to get the lock). (CVE-2023-34324)

  - An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in     drivers/net/ethernet/renesas/ravb_main.c. (CVE-2023-35827)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-     component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when     the LAN78XX USB device detaches. (CVE-2023-6039)

  - A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

  - A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

  - A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6173-1 advisory.

  - A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur     when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading     to a denial of service. (CVE-2023-1380)

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6338-2 advisory.

  - In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation. (CVE-2023-21255)

  - There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel.
    This flaw allows a local privileged user to cause a denial of service problem. (CVE-2023-2898)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of     resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition     on the system. (CVE-2023-32247)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation     of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-     service condition on the system. (CVE-2023-32252)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the     lack of proper locking when performing operations on an object. An attacker can leverage this     vulnerability to execute code in the context of the kernel. (CVE-2023-32257)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of     proper locking when performing operations on an object. An attacker can leverage this vulnerability to     execute code in the context of the kernel. (CVE-2023-32258)

  - An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in     smb2_find_context_vals when create_context's name_len is larger than the tag length. (CVE-2023-38426)

  - An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly     check the UserName value because it does not consider the address of security buffer, leading to an out-     of-bounds read. (CVE-2023-38428)

  - An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one     error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access.
    (CVE-2023-38429)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6344-1 advisory.

  - In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation. (CVE-2023-21255)

  - There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel.
    This flaw allows a local privileged user to cause a denial of service problem. (CVE-2023-2898)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of     resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition     on the system. (CVE-2023-32247)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation     of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-     service condition on the system. (CVE-2023-32252)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the     lack of proper locking when performing operations on an object. An attacker can leverage this     vulnerability to execute code in the context of the kernel. (CVE-2023-32257)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of     proper locking when performing operations on an object. An attacker can leverage this vulnerability to     execute code in the context of the kernel. (CVE-2023-32258)

  - An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in     smb2_find_context_vals when create_context's name_len is larger than the tag length. (CVE-2023-38426)

  - An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly     check the UserName value because it does not consider the address of security buffer, leading to an out-     of-bounds read. (CVE-2023-38428)

  - An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one     error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access.
    (CVE-2023-38429)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6338-1 advisory.

  - In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation. (CVE-2023-21255)

  - There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel.
    This flaw allows a local privileged user to cause a denial of service problem. (CVE-2023-2898)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of     resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition     on the system. (CVE-2023-32247)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this vulnerability to execute     code in the context of the kernel. (CVE-2023-32250)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation     of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-     service condition on the system. (CVE-2023-32252)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the     lack of proper locking when performing operations on an object. An attacker can leverage this     vulnerability to execute code in the context of the kernel. (CVE-2023-32257)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of     proper locking when performing operations on an object. An attacker can leverage this vulnerability to     execute code in the context of the kernel. (CVE-2023-32258)

  - An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in     smb2_find_context_vals when create_context's name_len is larger than the tag length. (CVE-2023-38426)

  - An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly     check the UserName value because it does not consider the address of security buffer, leading to an out-     of-bounds read. (CVE-2023-38428)

  - An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one     error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access.
    (CVE-2023-38429)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5448 advisory.

  - An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

  - distros-[DirtyVMA] Privilege escalation via non-RCU-protected VMA traversal [fedora-all] (CVE-2023-3269)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
190610	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6626-3)	Nessus	Ubuntu Local Security Checks	high
190560	Ubuntu 20.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6628-2)	Nessus	Ubuntu Local Security Checks	high
190518	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6626-2)	Nessus	Ubuntu Local Security Checks	high
190369	Ubuntu 22.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6628-1)	Nessus	Ubuntu Local Security Checks	high
190122	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6626-1)	Nessus	Ubuntu Local Security Checks	high
183565	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6173-1)	Nessus	Ubuntu Local Security Checks	high
181189	Ubuntu 22.04 LTS / 23.04 : Linux kernel vulnerabilities (USN-6338-2)	Nessus	Ubuntu Local Security Checks	critical
180558	Ubuntu 23.04 : Linux kernel (Azure) vulnerabilities (USN-6344-1)	Nessus	Ubuntu Local Security Checks	critical
180511	Ubuntu 22.04 LTS / 23.04 : Linux kernel vulnerabilities (USN-6338-1)	Nessus	Ubuntu Local Security Checks	critical
178003	Debian DSA-5448-1 : linux - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2023-32250

high

Tenable Plugins

high

high

high

high

high

high

critical

critical

critical

high