A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel     due to a double decrement of the reference count. This issue may allow a local attacker with user     privilege to crash the system or may lead to leaked internal kernel information. (CVE-2023-4389)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4072-2 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-4563: Fixed an use-after-free flaw in the nftables sub-component. This vulnerability could     allow a local attacker to crash the system or lead to a kernel information leak problem. (bsc#1214727)
    - CVE-2023-39194: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215861)
    - CVE-2023-39193: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215860)
    - CVE-2023-39192: Fixed a flaw in the u32_match_it function which could allow a local attackers to     disclose sensitive information. (bsc#1215858)
    - CVE-2023-42754: Fixed a null pointer dereference in ipv4_link_failure which could lead an authenticated     attacker to trigger a DoS. (bsc#1215467)
    - CVE-2023-5345: fixed an use-after-free vulnerability in the fs/smb/client component which could be     exploited to achieve local privilege escalation. (bsc#1215899)
    - CVE-2023-4155: Fixed a flaw in KVM AMD Secure Encrypted Virtualization (SEV). An attacker can trigger a     stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations     without stack guard pages. (bsc#1214022)
    - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order     to leak internal kernel information or crash the system (bsc#1214351).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the     local network or with a high bandwidth connection can increase the CPU usage of the server that accepts     IPV6 connections up to 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system (bsc#1210643).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4095-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the     local network or with a high bandwidth connection can increase the CPU usage of the server that accepts     IPV6 connections up to 95% (bsc#1212703).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges on the system.
    (bsc#1215150)
    - CVE-2023-4389: Fixed a a double decrement of the reference count flaw in the btrfs filesystem a double     decrement of the reference count, which may have allowed a local attacker with user privilege to crash the     system or may lead to leaked internal kernel information. (bsc#1214351)
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the sch_qfq component which could be exploited to     achieve local privilege escalation. (bsc#1215275)
    - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
    - CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the af_unix component which could be exploited to     achieve local privilege escalation. (bsc#1215117)
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2020-36766: Fixed an issue in drivers/media/cec/core/cec-api.c which could leaks one byte of kernel     memory on specific hardware to unprivileged users. (bsc#1215299)
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs. This flaw could allow a local     attacker to crash the system due to a race problem, possibly leading to a kernel information leak.
    (bsc#1210169)
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system or potentially cause a denial of service. (bsc#1210643)
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4093-1 advisory.

    The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
    - CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
    - CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
    - CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service     (bsc#1215467).
    - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order     to leak internal kernel information or crash the system (bsc#1214351).
    - CVE-2023-5345: fixed an use-after-free vulnerability in the fs/smb/client component which could be     exploited to achieve local privilege escalation. (bsc#1215899)
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the     local network or with a high bandwidth connection can increase the CPU usage of the server that accepts     IPV6 connections up to 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2023-4155: Fixed a flaw in KVM AMD Secure Encrypted Virtualization (SEV). An attacker can trigger a     stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations     without stack guard pages. (bsc#1214022)
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system (bsc#1210643).
    - CVE-2023-4563: Fixed an use-after-free flaw in the nftables sub-component. This vulnerability could     allow a local attacker to crash the system or lead to a kernel information leak problem. (bsc#1214727)
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4072-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-4563: Fixed an use-after-free flaw in the nftables sub-component. This vulnerability could     allow a local attacker to crash the system or lead to a kernel information leak problem. (bsc#1214727)
    - CVE-2023-39194: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215861)
    - CVE-2023-39193: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215860)
    - CVE-2023-39192: Fixed a flaw in the u32_match_it function which could allow a local attackers to     disclose sensitive information. (bsc#1215858)
    - CVE-2023-42754: Fixed a null pointer dereference in ipv4_link_failure which could lead an authenticated     attacker to trigger a DoS. (bsc#1215467)
    - CVE-2023-5345: fixed an use-after-free vulnerability in the fs/smb/client component which could be     exploited to achieve local privilege escalation. (bsc#1215899)
    - CVE-2023-4155: Fixed a flaw in KVM AMD Secure Encrypted Virtualization (SEV). An attacker can trigger a     stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations     without stack guard pages. (bsc#1214022)
    - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order     to leak internal kernel information or crash the system (bsc#1214351).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the     local network or with a high bandwidth connection can increase the CPU usage of the server that accepts     IPV6 connections up to 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system (bsc#1210643).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4071-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-39194: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215861)
    - CVE-2023-39193: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215860)
    - CVE-2023-39192: Fixed a flaw in the u32_match_it function which could allow a local attackers to     disclose sensitive information. (bsc#1215858)
    - CVE-2023-42754: Fixed a null pointer dereference in ipv4_link_failure which could lead an authenticated     attacker to trigger a DoS. (bsc#1215467)
    - CVE-2023-5345: fixed an use-after-free vulnerability in the fs/smb/client component which could be     exploited to achieve local privilege escalation. (bsc#1215899)
    - CVE-2023-4155: Fixed a flaw in KVM AMD Secure Encrypted Virtualization (SEV). An attacker can trigger a     stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations     without stack guard pages. (bsc#1214022)
    - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order     to leak internal kernel information or crash the system (bsc#1214351).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the     local network or with a high bandwidth connection can increase the CPU usage of the server that accepts     IPV6 connections up to 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system (bsc#1210643).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4057-1 advisory.

    The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-4563: Fixed an use-after-free flaw in the nftables sub-component. This vulnerability could     allow a local attacker to crash the system or lead to a kernel information leak problem. (bsc#1214727)
    - CVE-2023-39194: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215861)
    - CVE-2023-39193: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215860)
    - CVE-2023-39192: Fixed a flaw in the u32_match_it function which could allow a local attackers to     disclose sensitive information. (bsc#1215858)
    - CVE-2023-42754: Fixed a null pointer dereference in ipv4_link_failure which could lead an authenticated     attacker to trigger a DoS. (bsc#1215467)
    - CVE-2023-5345: fixed an use-after-free vulnerability in the fs/smb/client component which could be     exploited to achieve local privilege escalation. (bsc#1215899)
    - CVE-2023-4155: Fixed a flaw in KVM AMD Secure Encrypted Virtualization (SEV). An attacker can trigger a     stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations     without stack guard pages. (bsc#1214022)
    - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order     to leak internal kernel information or crash the system (bsc#1214351).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the     local network or with a high bandwidth connection can increase the CPU usage of the server that accepts     IPV6 connections up to 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-37453: Fixed oversight in SuperSpeed initialization  (bsc#1213123).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system (bsc#1210643).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4058-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
    - CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
    - CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
    - CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service     (bsc#1215467).
    - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order     to leak internal kernel information or crash the system (bsc#1214351).
    - CVE-2023-5345: fixed an use-after-free vulnerability in the fs/smb/client component which could be     exploited to achieve local privilege escalation (bsc#1215899).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited     by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-37453: Fixed oversight in SuperSpeed initialization  (bsc#1213123).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2023-4155: Fixed a flaw in KVM AMD Secure Encrypted Virtualization (SEV). An attacker can trigger a     stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations     without stack guard pages (bsc#1214022).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system (bsc#1210643).
    - CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4030-1 advisory.

    The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order     to leak internal kernel information or crash the system (bsc#1214351).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited     by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2020-36766: Fixed a potential information leak in in the CEC driver (bsc#1215299).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system (bsc#1210643).
    - CVE-2023-4881: Fixed an out-of-bounds write flaw in the netfilter subsystem that could lead to     information disclosure or denial of service (bsc#1215221).
    - CVE-2023-40283: Fixed a use-after-free issue in the Bluetooth subsystem (bsc#1214233).
    - CVE-2023-1192: Fixed a use-after-free in the CIFS subsystem (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4035-1 advisory.

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

  - A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

  - A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using     SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke     the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can     trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel     configurations without stack guard pages (`CONFIG_VMAP_STACK`). (CVE-2023-4155)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system. (CVE-2023-42754)

  - A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel     due to a double decrement of the reference count. This issue may allow a local attacker with user     privilege to crash the system or may lead to leaked internal kernel information. (CVE-2023-4389)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve     local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed     but the field was not set to NULL which could lead to double free. We recommend upgrading past commit     e6e43b8aa7cd3c3af686caf0c2e11819a886d705. (CVE-2023-5345)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
252965	Photon OS 4.0: Linux PHSA-2025-4.0-0844	Nessus	PhotonOS Local Security Checks	high
226435	Linux Distros Unpatched Vulnerability : CVE-2023-4389	Nessus	Misc.	high
184801	openSUSE 15 Security Update : kernel (SUSE-SU-2023:4072-2)	Nessus	SuSE Local Security Checks	high
183287	SUSE SLES15 Security Update : kernel (SUSE-SU-2023:4095-1)	Nessus	SuSE Local Security Checks	high
183278	SUSE SLES15 Security Update : kernel (SUSE-SU-2023:4093-1)	Nessus	SuSE Local Security Checks	high
183076	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2023:4072-1)	Nessus	SuSE Local Security Checks	high
183072	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:4071-1)	Nessus	SuSE Local Security Checks	high
183010	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:4057-1)	Nessus	SuSE Local Security Checks	high
183008	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:4058-1)	Nessus	SuSE Local Security Checks	high
182903	SUSE SLES15 Security Update : kernel (SUSE-SU-2023:4030-1)	Nessus	SuSE Local Security Checks	high
182896	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:4035-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-4389

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high