In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [1] in net_tx_action() which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute. qdisc_create() has to destroy the just initialized taprio qdisc, and taprio_destroy() is called. However, the hrtimer used by taprio had already fired, therefore advance_sched() called __netif_schedule(). Then net_tx_action was trying to use a destroyed qdisc. We can not undo the __netif_schedule(), so we must wait until one cpu serviced the qdisc before we can proceed. Many thanks to Alexander Potapenko for his help. [1] BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline] BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] BUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] do_raw_spin_trylock include/linux/spinlock.h:191 [inline] __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 spin_trylock include/linux/spinlock.h:359 [inline] qdisc_run_begin include/net/sch_generic.h:187 [inline] qdisc_run+0xee/0x540 include/net/pkt_sched.h:125 net_tx_action+0x77c/0x9a0 net/core/dev.c:5086 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934 smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164 kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 Uninit was created at: slab_post_alloc_hook mm/slab.h:732 [inline] slab_alloc_node mm/slub.c:3258 [inline] __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970 kmalloc_reserve net/core/skbuff.c:358 [inline] __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430 alloc_skb include/linux/skbuff.h:1257 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436 netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507 rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:6108 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536 __sys_sendmsg net/socket.c:2565 [inline] __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible     use-after-free syzbot reported a nasty crash [1] in net_tx_action() which made little sense until we got a     repro. This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute. qdisc_create() has     to destroy the just initialized taprio qdisc, and taprio_destroy() is called. However, the hrtimer used by     taprio had already fired, therefore advance_sched() called __netif_schedule(). Then net_tx_action was     trying to use a destroyed qdisc. We can not undo the __netif_schedule(), so we must wait until one cpu     serviced the qdisc before we can proceed. Many thanks to Alexander Potapenko for his help. [1] BUG: KMSAN:
    uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] BUG: KMSAN: uninit-value     in do_raw_spin_trylock include/linux/spinlock.h:191 [inline] BUG: KMSAN: uninit-value in
    __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] BUG: KMSAN: uninit-value in
    _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 queued_spin_trylock include/asm-     generic/qspinlock.h:94 [inline] do_raw_spin_trylock include/linux/spinlock.h:191 [inline]
    __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] _raw_spin_trylock+0x92/0xa0     kernel/locking/spinlock.c:138 spin_trylock include/linux/spinlock.h:359 [inline] qdisc_run_begin     include/net/sch_generic.h:187 [inline] qdisc_run+0xee/0x540 include/net/pkt_sched.h:125     net_tx_action+0x77c/0x9a0 net/core/dev.c:5086 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571     run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934 smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164     kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 Uninit was created at:
    slab_post_alloc_hook mm/slab.h:732 [inline] slab_alloc_node mm/slub.c:3258 [inline]
    __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970 kmalloc_reserve net/core/skbuff.c:358 [inline]
    __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430 alloc_skb include/linux/skbuff.h:1257 [inline] nlmsg_new     include/net/netlink.h:953 [inline] netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436     netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507 rtnetlink_rcv+0x30/0x40     net/core/rtnetlink.c:6108 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]     netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440     net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734     [inline] ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536
    __sys_sendmsg net/socket.c:2565 [inline] __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg     net/socket.c:2572 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted     6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0 Hardware name: Google Google Compute Engine/Google Compute     Engine, BIOS Google 07/22/2022 (CVE-2023-53021)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.10.167-147.601. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-089 advisory.

    A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/amd: fix potential integer overflow on shift of a int (CVE-2022-49748)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: designware: use casting of u64 in clock multiplication to avoid overflow (CVE-2022-49749)

    In the Linux kernel, the following vulnerability has been resolved:

    dmaengine: Fix double increment of client_count in dma_chan_get() (CVE-2022-49753)

    A memory corruption flaw was found in the Linux kernel's human interface device (HID) subsystem in how a     user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2023-1073)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix NULL pointer in skb_segment_list (CVE-2023-52991)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Skip task with pid=1 in send_signal_common() (CVE-2023-52992)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (CVE-2023-52993)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: prevent potential spectre v1 gadget in fib_metrics_match() (CVE-2023-52996)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() (CVE-2023-52997)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix UaF in netns ops registration error path (CVE-2023-52999)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: prevent potential spectre v1 gadgets (CVE-2023-53000)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix oops due to uncleared server->smbd_conn in reconnect (CVE-2023-53006)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Make sure trace_printk() can output as soon as it can be used (CVE-2023-53007)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: betop: check shape of output reports (CVE-2023-53015)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: validate parameter addr in mdiobus_get_phy() (CVE-2023-53019)

    In the Linux kernel, the following vulnerability has been resolved:

    l2tp: close all race conditions in l2tp_tunnel_register() (CVE-2023-53020)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_taprio: fix possible use-after-free (CVE-2023-53021)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (CVE-2023-53024)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix ib block iterator counter overflow (CVE-2023-53026)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.93-55.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-037 advisory.

    A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: governor: Use kobject release() method to free dbs_data (CVE-2022-49513)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: Use buf flexible array for memcpy() destination (CVE-2022-49743)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/amd: fix potential integer overflow on shift of a int (CVE-2022-49748)

    In the Linux kernel, the following vulnerability has been resolved:

    device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() (CVE-2022-49752)

    In the Linux kernel, the following vulnerability has been resolved:

    dmaengine: Fix double increment of client_count in dma_chan_get() (CVE-2022-49753)

    A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with     capabilities was found in the Linux kernel's OverlayFS subsystem in how a user copies a capable file from     a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges     on the system. (CVE-2023-0386)

    A memory corruption flaw was found in the Linux kernel's human interface device (HID) subsystem in how a     user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2023-1073)

    A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the     Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel     information leak problem. (CVE-2023-1652)

    In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c,     related to __list_del_entry_valid. (CVE-2023-26605)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing a font->width and     font->height greater than 32 to the fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs, leading to undefined behavior and possible denial of service. (CVE-2023-3161)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal     kernel information. (CVE-2023-3567)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Skip invalid kfunc call in backtrack_insn (CVE-2023-52928)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix potential bit_17 double-free (CVE-2023-52930)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swapfile: add cond_resched() in get_swap_pages() (CVE-2023-52932)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() (CVE-2023-52936)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (CVE-2023-52973)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: fix potential NULL deref in efi_mem_reserve_persistent (CVE-2023-52976)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix flow memory leak in ovs_flow_cmd_new (CVE-2023-52977)

    In the Linux kernel, the following vulnerability has been resolved:

    squashfs: harden sanity check in squashfs_read_xattr_id_table (CVE-2023-52979)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: fix uaf for bfqq in bic_set_bfqq() (CVE-2023-52983)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener (CVE-2023-52986)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix NULL pointer in skb_segment_list (CVE-2023-52991)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Skip task with pid=1 in send_signal_common() (CVE-2023-52992)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (CVE-2023-52993)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: prevent potential spectre v1 gadget in fib_metrics_match() (CVE-2023-52996)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() (CVE-2023-52997)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix UaF in netns ops registration error path (CVE-2023-52999)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: prevent potential spectre v1 gadgets (CVE-2023-53000)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix oops due to uncleared server->smbd_conn in reconnect (CVE-2023-53006)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Make sure trace_printk() can output as soon as it can be used (CVE-2023-53007)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: validate parameter addr in mdiobus_get_phy() (CVE-2023-53019)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_taprio: fix possible use-after-free (CVE-2023-53021)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (CVE-2023-53024)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: fix use-after-free in nfsd4_ssc_setup_dul() (CVE-2023-53025)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix ib block iterator counter overflow (CVE-2023-53026)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7077 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206,     CVE-2023-4207, CVE-2023-4208)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)

    * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)

    * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951,     CVE-2023-33952)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)

    * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)

    * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)

    * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)

    * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)

    * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)

    * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: hid: Use After Free in asus_remove (CVE-2023-1079)

    * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)

    * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

    * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)

    * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

    * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)

    * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)

    * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)

    * kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)

    * Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: Denial of service issue in az6027 driver (CVE-2023-28328)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)

    * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)

    * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)

    * kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)

    * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free bug in r592_remove (CVE-2023-3141)

    * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2458 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * lockdown bypass using IMA (CVE-2022-21505)

    * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * denial of service in tipc_conn_close (CVE-2023-1382)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.231-137.341. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-042 advisory.

    A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

    In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix preallocation discarding at indirect extent boundary (CVE-2022-48946)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Initialize mailbox message for VF reset (CVE-2022-48949)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/amd: fix potential integer overflow on shift of a int (CVE-2022-49748)

    In the Linux kernel, the following vulnerability has been resolved:

    dmaengine: Fix double increment of client_count in dma_chan_get() (CVE-2022-49753)

    The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the     kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a     syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

    There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

    When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket.
    The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is     created from the listener, the context is inherited and vulnerable.

    The setsockopt TCP_ULP operation does not require any privilege.

    We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

    A memory corruption flaw was found in the Linux kernel's human interface device (HID) subsystem in how a     user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2023-1073)

    cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

    atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mpls: Fix warning during failed attribute validation (CVE-2023-52906)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Skip task with pid=1 in send_signal_common() (CVE-2023-52992)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (CVE-2023-52993)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: prevent potential spectre v1 gadget in fib_metrics_match() (CVE-2023-52996)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() (CVE-2023-52997)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix UaF in netns ops registration error path (CVE-2023-52999)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: prevent potential spectre v1 gadgets (CVE-2023-53000)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix oops due to uncleared server->smbd_conn in reconnect (CVE-2023-53006)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Make sure trace_printk() can output as soon as it can be used (CVE-2023-53007)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: betop: check shape of output reports (CVE-2023-53015)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mdio: validate parameter addr in mdiobus_get_phy() (CVE-2023-53019)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_taprio: fix possible use-after-free (CVE-2023-53021)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (CVE-2023-53024)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix ib block iterator counter overflow (CVE-2023-53026)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (CVE-2023-53032)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
245859	Linux Distros Unpatched Vulnerability : CVE-2023-53021	Nessus	Misc.	high
234965	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-089)	Nessus	Amazon Linux Local Security Checks	medium
190056	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-037)	Nessus	Amazon Linux Local Security Checks	high
185679	RHEL 8 : kernel (RHSA-2023:7077)	Nessus	Red Hat Local Security Checks	high
175477	RHEL 9 : kernel (RHSA-2023:2458)	Nessus	Red Hat Local Security Checks	high
171848	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-042)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-53021

high

Tenable Plugins

high

medium

high

high

high

high