An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).

The version of AOS installed on the remote host is prior to 6.5.5.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.5.5.7 advisory.

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability     to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall     slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the     ability for this to be called at too high of a frequency and saturate the machine. (CVE-2024-26602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0461 advisory.

  - kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

  - kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c (CVE-2022-36402)

  - kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

  - kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

  - kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

  - kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

  - kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

  - kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

  - kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

  - kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

  - kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

  - kernel: vmwgfx: reference count issue leads to use-after-free in surface handling (CVE-2023-5633)

  - kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

  - kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

  - kernel: SEV-ES local priv escalation (CVE-2023-46813)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1249 advisory.

  - kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c     (CVE-2022-42896)

  - kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

  - kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

  - kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1249 advisory.

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability     to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall     slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the     ability for this to be called at too high of a frequency and saturate the machine. (CVE-2024-26602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1332 advisory.

  - kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c     (CVE-2022-42896)

  - kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

  - kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

  - kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1306 advisory.

  - kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

  - kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

  - kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

  - kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

  - kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

  - kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

  - kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

  - kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

  - kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

  - kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

  - kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

  - kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

  - kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

  - kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

  - kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1269 advisory.

  - kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

  - kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

  - kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

  - kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

  - kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

  - kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

  - kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

  - kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

  - kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

  - kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

  - kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1268 advisory.

  - kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

  - kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

  - kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

  - kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

  - kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

  - kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

  - kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

  - kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

  - kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

  - kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

  - kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1250 advisory.

  - kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

  - kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

  - kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

  - kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

  - kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

  - kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

  - kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

  - kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

  - kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

  - kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

  - kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

  - kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

  - kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

  - kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

  - kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

  - kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1249 advisory.

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability     to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall     slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the     ability for this to be called at too high of a frequency and saturate the machine. (CVE-2024-26602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0461 advisory.

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-     after-free flaw in the way memory objects were handled when they were being used to store a surface. When     running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially     use this flaw to escalate their privileges. (CVE-2023-5633)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked     whether the chain is bound and the chain's owner rule can also release the objects in certain     circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.
    (CVE-2023-3777)

  - A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in     drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsystem in the Linux kernel. This     issue could be exploited to trigger a denial of service. (CVE-2023-6679)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before     6.4.10. There is a use-after-free because the children of an sk are mishandled. (CVE-2023-40283)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability. (CVE-2022-3545)

  - A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege. (CVE-2023-2176)

  - An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in     how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows     a local user to crash or potentially escalate their privileges on the system. (CVE-2023-3812)

  - A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause     a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation. (CVE-2023-5178)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate     expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but     later used. We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

  - A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU     component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local     attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-36402)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0563 advisory.

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

  - kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

  - kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

  - kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

  - kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

  - kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0562 advisory.

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

  - kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

  - kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

  - kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

  - kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

  - kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12094 advisory.

  - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before     6.4.10. There is a use-after-free because the children of an sk are mishandled. (CVE-2023-40283)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate     expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but     later used. We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

  - An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in     how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows     a local user to crash or potentially escalate their privileges on the system. (CVE-2023-3812)

  - A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to     cause a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation problem. (CVE-2023-5178)

  - A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability. (CVE-2022-3545)

  - A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege. (CVE-2023-2176)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked     whether the chain is bound and the chain's owner rule can also release the objects in certain     circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.
    (CVE-2023-3777)

  - A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7539 advisory.

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: use-after-free due to race condition occurring in dvb_register_device() (CVE-2022-45884)

  - kernel: use-after-free due to race condition occurring in dvb_net.c (CVE-2022-45886)

  - kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c (CVE-2022-45919)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

  - kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

  - kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages     getting invalid opcode BUG in include/linux/swapops.h (CVE-2023-4732)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

  - kernel: mm/slab_common: slab_caches list corruption after kmem_cache_destroy() (CVE-2023-52562)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0439 advisory.

  - kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

  - kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

  - kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

  - kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

  - kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

  - kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

  - kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

  - kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

  - kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

  - kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

  - kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

  - kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

  - hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

  - kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

  - kernel: SEV-ES local priv escalation (CVE-2023-46813)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0448 advisory.

  - kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

  - kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

  - kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

  - kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

  - kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

  - kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

  - kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

  - kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

  - kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

  - kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

  - kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

  - kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

  - hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

  - kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

  - kernel: SEV-ES local priv escalation (CVE-2023-46813)

  - kernel: mm/slab_common: slab_caches list corruption after kmem_cache_destroy() (CVE-2023-52562)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0412 advisory.

  - kernel: swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

  - kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM     (CVE-2022-1016)

  - kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

  - kernel: race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

  - kernel: race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

  - kernel: data races around sk->sk_prot (CVE-2022-3567)

  - kernel: USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

  - kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

  - kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

  - kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)

  - kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

  - kernel: memory corruption in usbmon driver (CVE-2022-43750)

  - kernel: NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

  - kernel: NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

  - kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

  - kernel: hid: Use After Free in asus_remove() (CVE-2023-1079)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

  - kernel: denial of service in tipc_conn_close (CVE-2023-1382)

  - kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

  - kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

  - kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

  - kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

  - kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

  - kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)

  - kernel: ext4: use-after-free in ext4_xattr_set_entry() (CVE-2023-2513)

  - kernel: fbcon: shift-out-of-bounds in fbcon_set_font() (CVE-2023-3161)

  - kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

  - kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

  - kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

  - kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() (CVE-2023-3772)

  - kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

  - kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

  - kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

  - kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

  - kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages     getting invalid opcode BUG in include/linux/swapops.h (CVE-2023-4732)

  - kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

  - kernel: slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

  - kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

  - kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

  - kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() (CVE-2023-33203)

  - kernel: saa7134: race condition leading to use-after-free in saa7134_finidev() (CVE-2023-35823)

  - kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c() (CVE-2023-35824)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

  - kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

  - kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c     (CVE-2024-0562)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3376-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3302-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.
    We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c     in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service     threat. (CVE-2023-2430)

  - A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service problem. (CVE-2023-2985)

  - A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

  - ** REJECT ** Duplicate of CVE-2023-3390. (CVE-2023-3117)

  - Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local     privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a     hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59     (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for     5.15 stable). (CVE-2023-3389)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in     how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows     a local user to crash or potentially escalate their privileges on the system. (CVE-2023-3812)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3311-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of hyperv-daemons / kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-38409 advisory.

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196948	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.5.5.7)	Nessus	Misc.	high
194405	RHEL 9 : kernel (RHSA-2024:0461)	Nessus	Red Hat Local Security Checks	critical
192963	RHEL 7 : kernel (RHSA-2024:1249)	Nessus	Red Hat Local Security Checks	high
192390	Oracle Linux 7 : kernel (ELSA-2024-1249)	Nessus	Oracle Linux Local Security Checks	high
192132	RHEL 7 : kernel-rt (RHSA-2024:1332)	Nessus	Red Hat Local Security Checks	high
192035	RHEL 9 : kernel-rt (RHSA-2024:1306)	Nessus	Red Hat Local Security Checks	high
191911	RHEL 8 : kernel-rt (RHSA-2024:1269)	Nessus	Red Hat Local Security Checks	critical
191910	RHEL 8 : kernel (RHSA-2024:1268)	Nessus	Red Hat Local Security Checks	critical
191901	RHEL 9 : kernel (RHSA-2024:1250)	Nessus	Red Hat Local Security Checks	high
191898	CentOS 7 : kernel (RHSA-2024:1249)	Nessus	CentOS Local Security Checks	high
191728	Oracle Linux 9 : kernel (ELSA-2024-0461)	Nessus	Oracle Linux Local Security Checks	critical
189802	RHEL 8 : kernel-rt (RHSA-2024:0563)	Nessus	Red Hat Local Security Checks	high
189791	RHEL 8 : kernel (RHSA-2024:0562)	Nessus	Red Hat Local Security Checks	high
189666	Oracle Linux 9 : kernel (ELSA-2024-12094)	Nessus	Oracle Linux Local Security Checks	critical
189642	RHEL 8 : kernel (RHSA-2023:7539)	Nessus	Red Hat Local Security Checks	high
189572	RHEL 9 : kernel-rt (RHSA-2024:0439)	Nessus	Red Hat Local Security Checks	high
189552	RHEL 9 : kernel (RHSA-2024:0448)	Nessus	Red Hat Local Security Checks	high
189549	RHEL 8 : kernel (RHSA-2024:0412)	Nessus	Red Hat Local Security Checks	critical
180041	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3376-1)	Nessus	SuSE Local Security Checks	high
179825	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3302-1)	Nessus	SuSE Local Security Checks	high
179822	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3311-1)	Nessus	SuSE Local Security Checks	high
179701	CBL Mariner 2.0 Security Update: hyperv-daemons / kernel (CVE-2023-38409)	Nessus	MarinerOS Local Security Checks	medium

Detections

Analytics

CVE-2023-38409

medium

Tenable Plugins

high

critical

high

high

high

high

critical

critical

high

high

critical

high

high

critical

high

high

high

critical

high

high

high

medium