In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mpls: Fix warning during failed attribute validation The 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a validation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid combination according to the comment above 'struct nla_policy': " Meaning of `validate' field, use via NLA_POLICY_VALIDATE_FN: NLA_BINARY Validation function called for the attribute. All other Unused - but note that it's a union " This can trigger the warning [1] in nla_get_range_unsigned() when validation of the attribute fails. Despite being of 'NLA_U32' type, the associated 'min'/'max' fields in the policy are negative as they are aliased by the 'validate' field. Fix by changing the attribute type to 'NLA_BINARY' which is consistent with the above comment and all other users of NLA_POLICY_VALIDATE_FN(). As a result, move the length validation to the validation function. No regressions in MPLS tests: # ./tdc.py -f tc-tests/actions/mpls.json [...] # echo $? 0 [1] WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118 nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 Modules linked in: CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP: 0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 [...] Call Trace: <TASK> __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310 netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411 netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline] netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506 netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x197/0x230 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987031 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mpls: Fix warning during failed attribute validation

    The 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a     validation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid     combination according to the comment above 'struct nla_policy':

        Meaning of `validate' field, use via NLA_POLICY_VALIDATE_FN:
       NLA_BINARY           Validation function called for the attribute.
       All other            Unused - but note that it's a union     

    This can trigger the warning [1] in nla_get_range_unsigned() when     validation of the attribute fails. Despite being of 'NLA_U32' type, the     associated 'min'/'max' fields in the policy are negative as they are     aliased by the 'validate' field.

    Fix by changing the attribute type to 'NLA_BINARY' which is consistent     with the above comment and all other users of NLA_POLICY_VALIDATE_FN().
    As a result, move the length validation to the validation function.

    No regressions in MPLS tests:

     # ./tdc.py -f tc-tests/actions/mpls.json      [...]      # echo $?      0

    [1]     WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118     nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117     Modules linked in:
    CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014     RIP: 0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117     [...]     Call Trace:
     <TASK>
     __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310      netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411      netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline]      netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506      netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546      rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109      netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]      netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345      netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921      sock_sendmsg_nosec net/socket.c:714 [inline]      sock_sendmsg net/socket.c:734 [inline]
     ____sys_sendmsg+0x38f/0x500 net/socket.c:2482
     ___sys_sendmsg net/socket.c:2536 [inline]
     __sys_sendmsg+0x197/0x230 net/socket.c:2565
     __do_sys_sendmsg net/socket.c:2574 [inline]
     __se_sys_sendmsg net/socket.c:2572 [inline]
     __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572      do_syscall_x64 arch/x86/entry/common.c:50 [inline]      do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80      entry_SYSCALL_64_after_hwframe+0x63/0xcd

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mpls: Fix warning     during failed attribute validation The 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a     validation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid combination according to the comment above     'struct nla_policy':  Meaning of `validate' field, use via NLA_POLICY_VALIDATE_FN: NLA_BINARY Validation     function called for the attribute. All other Unused - but note that it's a union  This can trigger the     warning [1] in nla_get_range_unsigned() when validation of the attribute fails. Despite being of 'NLA_U32'     type, the associated 'min'/'max' fields in the policy are negative as they are aliased by the 'validate'     field. Fix by changing the attribute type to 'NLA_BINARY' which is consistent with the above comment and     all other users of NLA_POLICY_VALIDATE_FN(). As a result, move the length validation to the validation     function. No regressions in MPLS tests: # ./tdc.py -f tc-tests/actions/mpls.json [...] # echo $? 0 [1]     WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118 nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 Modules     linked in: CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3 Hardware name: QEMU Standard PC     (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP:
    0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 [...] Call Trace: <TASK>
    __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310     netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411 netlink_ack_tlv_fill     net/netlink/af_netlink.c:2454 [inline] netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506     netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x18/0x20     net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]     netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x739/0x860     net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734     [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline]
    __sys_sendmsg+0x197/0x230 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg     net/socket.c:2572 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2023-52906)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3483-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
    - CVE-2024-36936: Touch soft lockup during memory accept (bsc#1225773).
    - CVE-2022-48706: Do proper cleanup if IFCVF init fails (bsc#1225524).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch     (bsc#1226798)
    - CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).
    - CVE-2024-44939: Fix null ptr deref in dtInsertEntry (bsc#1229820).
    - CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
    - CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2024-43904: Add null checks for 'stream' and 'plane' before dereferencing (bsc#1229768)
    - CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
    - CVE-2024-43884: Add error handling to pair_device() (bsc#1229739)
    - CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2023-52906: Fix warning during failed attribute validation (bsc#1229527).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
    - CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
    - CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
    - CVE-2022-48906: Correctly set DATA_FIN timeout when number of retransmits is large (bsc#1229605)
    - CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).
    - CVE-2023-52899: Add exception protection processing for vd in axi_chan_handle_err function     (bsc#1229569).
    - CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
    - CVE-2024-43873: Always initialize seqpacket_allow (bsc#1229488)
    - CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
    - CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2021-47106: Fix use-after-free in nft_set_catchall_destroy() (bsc#1220962)
    - CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool (bsc#1225428).
    - CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
    - CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
    - CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
    - CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
    - CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
    - CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
    - CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
    - CVE-2024-27016: Validate pppoe header (bsc#1223807).
    - CVE-2024-35945: Prevent nullptr exceptions on ISR (bsc#1224639).
    - CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
    - CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
    - CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
    - CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
    - CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
    - CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727 CVE-2024-42157 git-fixes).
    - CVE-2024-26677: Blacklist e7870cf13d20 (' Fix delayed ACKs to not set the reference serial number')     (bsc#1222387)
    - CVE-2024-36009: Blacklist 467324bcfe1a ('ax25: Fix netdev refcount issue') (bsc#1224542)
    - CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
    - CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42308: Update DRM patch reference (bsc#1229411)
    - CVE-2024-42301: Fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42318: Do not lose track of restrictions on cred_transfer (bsc#1229351).
    - CVE-2024-26669: Fix chain template offload (bsc#1222350).
    - CVE-2023-52889: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).
    - CVE-2022-48645: Move enetc_set_psfp() out of the common enetc_set_features() (bsc#1223508).
    - CVE-2024-41007: Use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).
    - CVE-2024-36933: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
    - CVE-2024-42295: Handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
    - CVE-2024-42319: Move devm_mbox_controller_register() after devm_pm_runtime_enable() (bsc#1229350).
    - CVE-2024-43860: Skip over memory region when node value is NULL (bsc#1229319).
    - CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-43849: Protect locator_addr with the main mutex (bsc#1229307).
    - CVE-2024-43841: Do not use strlen() in const context (bsc#1229304).
    - CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2024-41088: Fix infinite loop when xmit fails (bsc#1228469).
    - CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-41080: Fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).
    - CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-26735: Fix possible use-after-free and null-ptr-deref (bsc#1222372).
    - CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).
    - CVE-2024-42247: Avoid unaligned 64-bit memory accesses (bsc#1228988).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2023-52498: Fix possible deadlocks in core system-wide PM code (bsc#1221269).
    - CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2022-48808: Fix panic when DSA master device unbinds on shutdown (bsc#1227958).
    - CVE-2024-42095: Fix Errata i2310 with RX FIFO level check (bsc#1228446).
    - CVE-2024-40978: Fix crash while reading debugfs attribute (bsc#1227929).
    - CVE-2024-42107: Do not process extts if PTP is disabled (bsc#1228494).
    - CVE-2024-42139: Fix improper extts handling (bsc#1228503).
    - CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42142: E-switch, Create ingress ACL when needed (bsc#1228491).
    - CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
    - CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local     privilege escalation (bsc#1213580).
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2024-40995: Fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
    - CVE-2024-38602: Merge repeat codes in ax25_dev_device_down() (git-fixes CVE-2024-38602 bsc#1226613).
    - CVE-2024-38554: Fix reference count leak issue of net_device (bsc#1226742).
    - CVE-2024-36929: Reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
    - CVE-2024-41009: Fix overrunning reservations in ringbuf (bsc#1228020).
    - CVE-2024-27024: Fix WARNING in rds_conn_connect_if_down (bsc#1223777).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3209-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
    - CVE-2024-36936: Touch soft lockup during memory accept (bsc#1225773).
    - CVE-2022-48706: Do proper cleanup if IFCVF init fails (bsc#1225524).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).
    - CVE-2024-44939: Fix null ptr deref in dtInsertEntry (bsc#1229820).
    - CVE-2024-41087: Fix double free on error (bsc#1228466).
    - CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2024-43904: Add null checks for 'stream' and 'plane' before dereferencing (bsc#1229768)
    - CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
    - CVE-2024-43884: Add error handling to pair_device() (bsc#1229739)
    - CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2023-52906: Fix warning during failed attribute validation (bsc#1229527).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2024-26812: struct virqfd kABI workaround (bsc#1222808).
    - CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
    - CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
    - CVE-2022-48906: Correctly set DATA_FIN timeout when number of retransmits is large (bsc#1229605)
    - CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).
    - CVE-2023-52899: Add exception protection processing for vd in axi_chan_handle_err function     (bsc#1229569).
    - CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
    - CVE-2024-43873: Always initialize seqpacket_allow (bsc#1229488)
    - CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
    - CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2021-47106: Fix use-after-free in nft_set_catchall_destroy() (bsc#1220962)
    - CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool (bsc#1225428).
    - CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
    - CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
    - CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
    - CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
    - CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290).
    - CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
    - CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
    - CVE-2024-27016: Validate pppoe header (bsc#1223807).
    - CVE-2024-35945: Prevent nullptr exceptions on ISR (bsc#1224639).
    - CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
    - CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
    - CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
    - CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
    - CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
    - CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727).
    - CVE-2024-26677: Blacklist e7870cf13d20 (' Fix delayed ACKs to not set the reference serial number')     (bsc#1222387)
    - CVE-2024-36009: Blacklist 467324bcfe1a ('ax25: Fix netdev refcount issue') (bsc#1224542)
    - CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
    - CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42301: Fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42318: Do not lose track of restrictions on cred_transfer (bsc#1229351).
    - CVE-2024-26669: Fix chain template offload (bsc#1222350).
    - CVE-2023-52889: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).
    - CVE-2022-48645: Move enetc_set_psfp() out of the common enetc_set_features() (bsc#1223508).
    - CVE-2024-41007: Use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).
    - CVE-2024-36933: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
    - CVE-2024-42295: Handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
    - CVE-2024-42319: Move devm_mbox_controller_register() after devm_pm_runtime_enable() (bsc#1229350).
    - CVE-2024-43860: Skip over memory region when node value is NULL (bsc#1229319).
    - CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-43849: Protect locator_addr with the main mutex (bsc#1229307).
    - CVE-2024-43841: Do not use strlen() in const context (bsc#1229304).
    - CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2024-41088: Fix infinite loop when xmit fails (bsc#1228469).
    - CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-41080: Fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).
    - CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-26735: Fix possible use-after-free and null-ptr-deref (bsc#1222372).
    - CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).
    - CVE-2024-42247: Avoid unaligned 64-bit memory accesses (bsc#1228988).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2023-52498: Fix possible deadlocks in core system-wide PM code (bsc#1221269).
    - CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2022-48808: Fix panic when DSA master device unbinds on shutdown (bsc#1227958).
    - CVE-2024-42095: Fix Errata i2310 with RX FIFO level check (bsc#1228446).
    - CVE-2024-40978: Fix crash while reading debugfs attribute (bsc#1227929).
    - CVE-2024-42107: Do not process extts if PTP is disabled (bsc#1228494).
    - CVE-2024-42139: Fix improper extts handling (bsc#1228503).
    - CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42142: E-switch, Create ingress ACL when needed (bsc#1228491).
    - CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
    - CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local     privilege escalation (bsc#1213580).
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2024-40995: Fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
    - CVE-2024-38602: Merge repeat codes in ax25_dev_device_down() (bsc#1226613).
    - CVE-2024-38554: Fix reference count leak issue of net_device (bsc#1226742).
    - CVE-2024-36929: Reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
    - CVE-2024-41009: Fix overrunning reservations in ringbuf (bsc#1228020).
    - CVE-2024-27024: Fix WARNING in rds_conn_connect_if_down (bsc#1223777).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3190-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
    - CVE-2024-36936: Touch soft lockup during memory accept (bsc#1225773).
    - CVE-2022-48706: Do proper cleanup if IFCVF init fails (bsc#1225524).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).
    - CVE-2024-44939: fix null ptr deref in dtInsertEntry (bsc#1229820).
    - CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
    - CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2024-43904: Add null checks for 'stream' and 'plane' before dereferencing (bsc#1229768)
    - CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
    - CVE-2024-43884: Add error handling to pair_device() (bsc#1229739)
    - CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2023-52906: Fix warning during failed attribute validation (bsc#1229527).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
    - CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
    - CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
    - CVE-2022-48906: Correctly set DATA_FIN timeout when number of retransmits is large (bsc#1229605)
    - CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).
    - CVE-2023-52899: Add exception protection processing for vd in axi_chan_handle_err function     (bsc#1229569).
    - CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
    - CVE-2024-43873: Always initialize seqpacket_allow (bsc#1229488)
    - CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
    - CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2021-47106: Fix use-after-free in nft_set_catchall_destroy() (bsc#1220962)
    - CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool (bsc#1225428).
    - CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
    - CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
    - CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
    - CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
    - CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
    - CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
    - CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
    - CVE-2024-27016: Validate pppoe header (bsc#1223807).
    - CVE-2024-35945: Prevent nullptr exceptions on ISR (bsc#1224639).
    - CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
    - CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
    - CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
    - CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
    - CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
    - CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727 CVE-2024-42157 git-fixes).
    - CVE-2024-26677: Blacklist e7870cf13d20 ('rxrpc: Fix delayed ACKs to not set the reference serial     number') (bsc#1222387)
    - CVE-2024-36009: Blacklist 467324bcfe1a ('ax25: Fix netdev refcount issue') (bsc#1224542)
    - CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
    - CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42301: Fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42318: Do not lose track of restrictions on cred_transfer (bsc#1229351).
    - CVE-2024-26669: Fix chain template offload (bsc#1222350).
    - CVE-2023-52889: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).
    - CVE-2022-48645: Move enetc_set_psfp() out of the common enetc_set_features() (bsc#1223508).
    - CVE-2024-41007: Use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).
    - CVE-2024-36933: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
    - CVE-2024-42295: Handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
    - CVE-2024-42319: Move devm_mbox_controller_register() after devm_pm_runtime_enable() (bsc#1229350).
    - CVE-2024-43860: Skip over memory region when node value is NULL (bsc#1229319).
    - CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-43849: Protect locator_addr with the main mutex (bsc#1229307).
    - CVE-2024-43841: Do not use strlen() in const context (bsc#1229304).
    - CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2024-41088: Fix infinite loop when xmit fails (bsc#1228469).
    - CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-41080: Fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).
    - CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-26735: Fix possible use-after-free and null-ptr-deref (bsc#1222372).
    - CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).
    - CVE-2024-42247: Avoid unaligned 64-bit memory accesses (bsc#1228988).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2023-52498: Fix possible deadlocks in core system-wide PM code (bsc#1221269).
    - CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2022-48808: Fix panic when DSA master device unbinds on shutdown (bsc#1227958).
    - CVE-2024-42095: Fix Errata i2310 with RX FIFO level check (bsc#1228446).
    - CVE-2024-40978: Fix crash while reading debugfs attribute (bsc#1227929).
    - CVE-2024-42107: Do not process extts if PTP is disabled (bsc#1228494).
    - CVE-2024-42139: Fix improper extts handling (bsc#1228503).
    - CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42142: E-switch, Create ingress ACL when needed (bsc#1228491).
    - CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
    - CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local     privilege escalation (bsc#1213580).
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2024-40995: Fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
    - CVE-2024-38602: Merge repeat codes in ax25_dev_device_down() (git-fixes CVE-2024-38602 bsc#1226613).
    - CVE-2024-38554: Fix reference count leak issue of net_device (bsc#1226742).
    - CVE-2024-36929: Reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
    - CVE-2024-41009: Fix overrunning reservations in ringbuf (bsc#1228020).
    - CVE-2024-27024: Fix WARNING in rds_conn_connect_if_down (bsc#1223777).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.231-137.341. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-042 advisory.

    A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

    In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: fix NULL-deref in init error path (CVE-2022-48879)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbe: fix pci device refcount leak (CVE-2022-48896)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: Fix GEM handle creation UAF (CVE-2022-48899)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix preallocation discarding at indirect extent boundary (CVE-2022-48946)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Initialize mailbox message for VF reset (CVE-2022-48949)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/amd: fix potential integer overflow on shift of a int (CVE-2022-49748)

    In the Linux kernel, the following vulnerability has been resolved:

    dmaengine: Fix double increment of client_count in dma_chan_get() (CVE-2022-49753)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (CVE-2022-50242)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: core: fix use_count leakage when handling boot-on (CVE-2022-50250)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix return value check of mmc_add_host() (CVE-2022-50251)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Do not free q_vector unless new one was allocated (CVE-2022-50252)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: make sure skb->len != 0 when redirecting to a tunneling device (CVE-2022-50253)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: fix race in sock_map_free() (CVE-2022-50259)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50275)

    In the Linux kernel, the following vulnerability has been resolved:

    power: supply: fix null pointer dereferencing in power_supply_get_battery_info (CVE-2022-50276)

    In the Linux kernel, the following vulnerability has been resolved:

    PNP: fix name memory leak in pnp_alloc_dev() (CVE-2022-50278)

    In the Linux kernel, the following vulnerability has been resolved:

    pnode: terminate at peers of source (CVE-2022-50280)

    In the Linux kernel, the following vulnerability has been resolved:

    chardev: fix error handling in cdev_device_add() (CVE-2022-50282)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (CVE-2022-50286)

    In the Linux kernel, the following vulnerability has been resolved:

    qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (CVE-2022-50288)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() (CVE-2022-50318)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: fix shift-out-of-bounds in dbDiscardAG (CVE-2022-50333)

    In the Linux kernel, the following vulnerability has been resolved:

    hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (CVE-2022-50334)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix oops during encryption (CVE-2022-50341)

    In the Linux kernel, the following vulnerability has been resolved:

    rapidio: fix possible name leaks when rio_add_device() fails (CVE-2022-50343)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: init quota for 'old.inode' in 'ext4_rename' (CVE-2022-50346)

    In the Linux kernel, the following vulnerability has been resolved:

    misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (CVE-2022-50349)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Account for tail adjustment during pull operations (CVE-2022-50365)

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix a crash in mempool_free (CVE-2022-50381)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50389)

    In the Linux kernel, the following vulnerability has been resolved:

    integrity: Fix memory leakage in keyring allocation error path (CVE-2022-50395)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: fix memory leak in tcindex_set_parms (CVE-2022-50396)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (CVE-2022-50401)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (CVE-2022-50402)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock (CVE-2022-50405)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix error code path in acpi_ds_call_control_method() (CVE-2022-50411)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (CVE-2022-50414)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (CVE-2022-50423)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (CVE-2022-50430)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: fix possible memleak when register 'hctx' failed (CVE-2022-50434)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix resolving backrefs for inline extent followed by prealloc (CVE-2022-50456)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: vpe-mt: fix possible memory leak while module exiting (CVE-2022-50462)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: Init completion before kobject_init_and_add() (CVE-2022-50473)

    In the Linux kernel, the following vulnerability has been resolved:

    macintosh: fix possible memory leak in macio_add_one_device() (CVE-2022-50474)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (CVE-2022-50478)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (CVE-2022-50485)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: Fix UAF in destroy() (CVE-2022-50496)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: fix shift-out-of-bounds in check_special_flags (CVE-2022-50497)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: lpddr2_nvm: Fix possible null-ptr-deref (CVE-2022-50503)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/fonts: fix undefined behavior in bit shift for get_default_font (CVE-2022-50511)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (CVE-2022-50520)

    In the Linux kernel, the following vulnerability has been resolved:

    mcb: mcb-parse: fix error handing in chameleon_parse_gdd() (CVE-2022-50522)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() (CVE-2022-50532)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Use last transaction's pmd->root when commit failed (CVE-2022-50534)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data (CVE-2022-50536)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata (CVE-2022-50549)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix UAF in run_timer_softirq() (CVE-2022-50563)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: Fix device name leak when register device failed in add_mtd_device() (CVE-2022-50566)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: fix shift-out-of-bounds in dbAllocAG (CVE-2022-50567)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() (CVE-2022-50575)

    In the Linux kernel, the following vulnerability has been resolved:

    class: fix possible memory leak in __class_register() (CVE-2022-50578)

    In the Linux kernel, the following vulnerability has been resolved:

    hfs: fix OOB Read in __hfs_brec_find (CVE-2022-50581)

    The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the     kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a     syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

    There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

    When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket.
    The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is     created from the listener, the context is inherited and vulnerable.

    The setsockopt TCP_ULP operation does not require any privilege.

    We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

    A memory corruption flaw was found in the Linux kernel's human interface device (HID) subsystem in how a     user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2023-1073)

    cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

    atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix race between quota rescan and disable leading to NULL pointer deref (CVE-2023-52896)

    In the Linux kernel, the following vulnerability has been resolved:

    xhci: Fix null pointer dereference when host dies (CVE-2023-52898)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix general protection fault in nilfs_btree_insert() (CVE-2023-52900)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Check endpoint is valid before dereferencing it (CVE-2023-52901)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mpls: Fix warning during failed attribute validation (CVE-2023-52906)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Skip task with pid=1 in send_signal_common() (CVE-2023-52992)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (CVE-2023-52993)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: prevent potential spectre v1 gadget in fib_metrics_match() (CVE-2023-52996)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() (CVE-2023-52997)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix UaF in netns ops registration error path (CVE-2023-52999)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: prevent potential spectre v1 gadgets (CVE-2023-53000)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix oops due to uncleared server->smbd_conn in reconnect (CVE-2023-53006)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Make sure trace_printk() can output as soon as it can be used (CVE-2023-53007)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: betop: check shape of output reports (CVE-2023-53015)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: validate parameter addr in mdiobus_get_phy() (CVE-2023-53019)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_taprio: fix possible use-after-free (CVE-2023-53021)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (CVE-2023-53024)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix ib block iterator counter overflow (CVE-2023-53026)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (CVE-2023-53032)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.90-54.138. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-013 advisory.

    In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

    A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A     local user could use this flaw to crash the system. (CVE-2022-4842)

    In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An     unhandled page fault may occur. (CVE-2022-48424)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: fix NULL-deref in init error path (CVE-2022-48879)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/core: Fix use-after-free bug in dup_user_cpus_ptr() (CVE-2022-48892)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Validate BOOT record_size (CVE-2022-50262)

    In the Linux kernel, the following vulnerability has been resolved:

    pnode: terminate at peers of source (CVE-2022-50280)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (CVE-2022-50286)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix extent map use-after-free when handling missing device in read_one_chunk (CVE-2022-50300)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix potential out of bound read in ext4_fc_replay_scan() (CVE-2022-50306)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq (CVE-2022-50329)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add null pointer check to attr_load_runs_vcn (CVE-2022-50336)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix oops during encryption (CVE-2022-50341)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: init quota for 'old.inode' in 'ext4_rename' (CVE-2022-50346)

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix a crash in mempool_free (CVE-2022-50381)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: fix multipath crash caused by flush request when blktrace is enabled (CVE-2022-50388)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50389)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: fix memory leak in tcindex_set_parms (CVE-2022-50396)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix off-by-one errors in fast-commit block filling (CVE-2022-50428)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't set up encryption key during jbd2 transaction (CVE-2022-50436)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Validate buffer length while parsing index (CVE-2022-50442)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix memory leak on ntfs_fill_super() error path (CVE-2022-50451)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix resolving backrefs for inline extent followed by prealloc (CVE-2022-50456)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix leaking uninitialized memory in fast-commit journal (CVE-2022-50465)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: Init completion before kobject_init_and_add() (CVE-2022-50473)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (CVE-2022-50485)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: Fix UAF in destroy() (CVE-2022-50496)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Validate data run offset (CVE-2022-50507)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Use last transaction's pmd->root when commit failed (CVE-2022-50534)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix uninititialized value in 'ext4_evict_inode' (CVE-2022-50546)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata (CVE-2022-50549)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: acpi: Call acpi_put_table() to fix memory leak (CVE-2022-50562)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix UAF in run_timer_softirq() (CVE-2022-50563)

    The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the     kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a     syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

    A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could     allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to     the root user via arbitrary code execution. (CVE-2023-0179)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

    There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

    When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket.
    The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is     created from the listener, the context is inherited and vulnerable.

    The setsockopt TCP_ULP operation does not require any privilege.

    We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

    cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

    atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

    In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a     difference between NTFS sector size and media sector size. (CVE-2023-26544)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix race between quota rescan and disable leading to NULL pointer deref (CVE-2023-52896)

    In the Linux kernel, the following vulnerability has been resolved:

    xhci: Fix null pointer dereference when host dies (CVE-2023-52898)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Check endpoint is valid before dereferencing it (CVE-2023-52901)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: lock overflowing for IOPOLL (CVE-2023-52903)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mpls: Fix warning during failed attribute validation (CVE-2023-52906)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/iova: Fix alloc iova overflows issue (CVE-2023-52910)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (CVE-2023-53032)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (CVE-2023-53033)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: don't hold ni_lock when calling truncate_setsize() (CVE-2023-53163)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Rework long task execution when adding/deleting entries (CVE-2023-53549)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.165-143.735. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-026 advisory.

    In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: fix NULL-deref in init error path (CVE-2022-48879)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbe: fix pci device refcount leak (CVE-2022-48896)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: Fix GEM handle creation UAF (CVE-2022-48899)

    In the Linux kernel, the following vulnerability has been resolved:

    rtc: cmos: Fix event handler registration ordering issue (CVE-2022-48953)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() (CVE-2022-50242)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: core: fix use_count leakage when handling boot-on (CVE-2022-50250)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix return value check of mmc_add_host() (CVE-2022-50251)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Do not free q_vector unless new one was allocated (CVE-2022-50252)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: make sure skb->len != 0 when redirecting to a tunneling device (CVE-2022-50253)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: fix race in sock_map_free() (CVE-2022-50259)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50275)

    In the Linux kernel, the following vulnerability has been resolved:

    power: supply: fix null pointer dereferencing in power_supply_get_battery_info (CVE-2022-50276)

    In the Linux kernel, the following vulnerability has been resolved:

    PNP: fix name memory leak in pnp_alloc_dev() (CVE-2022-50278)

    In the Linux kernel, the following vulnerability has been resolved:

    pnode: terminate at peers of source (CVE-2022-50280)

    In the Linux kernel, the following vulnerability has been resolved:

    chardev: fix error handling in cdev_device_add() (CVE-2022-50282)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (CVE-2022-50286)

    In the Linux kernel, the following vulnerability has been resolved:

    qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (CVE-2022-50288)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() (CVE-2022-50318)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: fix shift-out-of-bounds in dbDiscardAG (CVE-2022-50333)

    In the Linux kernel, the following vulnerability has been resolved:

    hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (CVE-2022-50334)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix oops during encryption (CVE-2022-50341)

    In the Linux kernel, the following vulnerability has been resolved:

    rapidio: fix possible name leaks when rio_add_device() fails (CVE-2022-50343)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: init quota for 'old.inode' in 'ext4_rename' (CVE-2022-50346)

    In the Linux kernel, the following vulnerability has been resolved:

    misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (CVE-2022-50349)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Account for tail adjustment during pull operations (CVE-2022-50365)

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix a crash in mempool_free (CVE-2022-50381)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: Always leave BHs disabled when running ->parallel() (CVE-2022-50382)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix an Oops in nfs_d_automount() (CVE-2022-50385)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: fix multipath crash caused by flush request when blktrace is enabled (CVE-2022-50388)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (CVE-2022-50389)

    In the Linux kernel, the following vulnerability has been resolved:

    integrity: Fix memory leakage in keyring allocation error path (CVE-2022-50395)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: fix memory leak in tcindex_set_parms (CVE-2022-50396)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (CVE-2022-50401)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (CVE-2022-50402)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock (CVE-2022-50405)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix error code path in acpi_ds_call_control_method() (CVE-2022-50411)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (CVE-2022-50414)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (CVE-2022-50423)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (CVE-2022-50430)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: fix possible memleak when register 'hctx' failed (CVE-2022-50434)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't set up encryption key during jbd2 transaction (CVE-2022-50436)

    In the Linux kernel, the following vulnerability has been resolved:

    gpiolib: cdev: fix NULL-pointer dereferences (CVE-2022-50453)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix resolving backrefs for inline extent followed by prealloc (CVE-2022-50456)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: vpe-mt: fix possible memory leak while module exiting (CVE-2022-50462)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix leaking uninitialized memory in fast-commit journal (CVE-2022-50465)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: Init completion before kobject_init_and_add() (CVE-2022-50473)

    In the Linux kernel, the following vulnerability has been resolved:

    macintosh: fix possible memory leak in macio_add_one_device() (CVE-2022-50474)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (CVE-2022-50478)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (CVE-2022-50485)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: Fix UAF in destroy() (CVE-2022-50496)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: fix shift-out-of-bounds in check_special_flags (CVE-2022-50497)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: lpddr2_nvm: Fix possible null-ptr-deref (CVE-2022-50503)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Fix pci device refcount leak in ppr_notifier() (CVE-2022-50505)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/fonts: fix undefined behavior in bit shift for get_default_font (CVE-2022-50511)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (CVE-2022-50520)

    In the Linux kernel, the following vulnerability has been resolved:

    mcb: mcb-parse: fix error handing in chameleon_parse_gdd() (CVE-2022-50522)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() (CVE-2022-50532)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Use last transaction's pmd->root when commit failed (CVE-2022-50534)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data (CVE-2022-50536)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata (CVE-2022-50549)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: acpi: Call acpi_put_table() to fix memory leak (CVE-2022-50562)

    In the Linux kernel, the following vulnerability has been resolved:

    dm thin: Fix UAF in run_timer_softirq() (CVE-2022-50563)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: Fix device name leak when register device failed in add_mtd_device() (CVE-2022-50566)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: fix shift-out-of-bounds in dbAllocAG (CVE-2022-50567)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() (CVE-2022-50575)

    In the Linux kernel, the following vulnerability has been resolved:

    class: fix possible memory leak in __class_register() (CVE-2022-50578)

    In the Linux kernel, the following vulnerability has been resolved:

    hfs: fix OOB Read in __hfs_brec_find (CVE-2022-50581)

    The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the     kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a     syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

    A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could     allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to     the root user via arbitrary code execution. (CVE-2023-0179)

    There is a logic error in io_uring's implementation which can be used to trigger a use-after-free     vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the     last io_grab_identity call cannot return false is not true, and in this case the function will use the     init_cred or the previous linked requests identity to do operations instead of using the current identity.
    This can lead to reference counting issues causing use-after-free. We recommend upgrading past version     5.10.161. (CVE-2023-0240)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

    There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

    When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket.
    The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is     created from the listener, the context is inherited and vulnerable.

    The setsockopt TCP_ULP operation does not require any privilege.

    We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

    efi: rt-wrapper: Add missing include (CVE-2023-21102)

    cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

    atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix race between quota rescan and disable leading to NULL pointer deref (CVE-2023-52896)

    In the Linux kernel, the following vulnerability has been resolved:

    xhci: Fix null pointer dereference when host dies (CVE-2023-52898)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix general protection fault in nilfs_btree_insert() (CVE-2023-52900)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Check endpoint is valid before dereferencing it (CVE-2023-52901)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: lock overflowing for IOPOLL (CVE-2023-52903)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mpls: Fix warning during failed attribute validation (CVE-2023-52906)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (CVE-2023-53032)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (CVE-2023-53033)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Rework long task execution when adding/deleting entries (CVE-2023-53549)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
268990	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987031)	Nessus	Unity Linux Local Security Checks	high
227356	Linux Distros Unpatched Vulnerability : CVE-2023-52906	Nessus	Misc.	high
207884	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:3483-1)	Nessus	SuSE Local Security Checks	high
207050	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:3209-1)	Nessus	SuSE Local Security Checks	high
206957	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:3190-1)	Nessus	SuSE Local Security Checks	high
171848	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-042 (ALASKERNEL-5.4-2023-042)	Nessus	Amazon Linux Local Security Checks	high
171227	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-013 (ALASKERNEL-5.15-2023-013)	Nessus	Amazon Linux Local Security Checks	high
171216	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-026 (ALASKERNEL-5.10-2023-026)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-52906

high

Tenable Plugins

high

high

high

high

high

high

high

high