In the Linux kernel, the following vulnerability has been resolved: ext4: Fix function prototype mismatch for ext4_feat_ktype With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. ext4_feat_ktype was setting the "release" handler to "kfree", which doesn't have a matching function prototype. Add a simple wrapper with the correct prototype. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Note that this code is only reached when ext4 is a loadable module and it is being unloaded: CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698) ... RIP: 0010:kobject_put+0xbb/0x1b0 ... Call Trace: <TASK> ext4_exit_sysfs+0x14/0x60 [ext4] cleanup_module+0x67/0xedb [ext4]

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: ext4: Fix function prototype mismatch     for ext4_feat_ktype With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call     targets are validated against the expected function pointer prototype to make sure the call target is     valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which     manifests as either a kernel panic or thread getting killed. ext4_feat_ktype was setting the release     handler to kfree, which doesn't have a matching function prototype. Add a simple wrapper with the     correct prototype. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is     more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Note     that this code is only reached when ext4 is a loadable module and it is being unloaded: CFI failure at     kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698) ... RIP:
    0010:kobject_put+0xbb/0x1b0 ... Call Trace: <TASK> ext4_exit_sysfs+0x14/0x60 [ext4]     cleanup_module+0x67/0xedb [ext4] (CVE-2023-53224)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.102-61.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-015 advisory.

    A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

    It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return     Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is     dynamically partitioned between non-idle threads.  This allows an attacker to control speculative     execution on the adjacent thread. (CVE-2022-27672)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_tproxy: restrict to prerouting hook (CVE-2022-50001)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0458)

    Due to a type confusion during initializations, the tun and tap sockets in the Linux Kernel have their     socket UID hardcoded to 0, i.e. root. While it will be often correct, as TUN/TAP devices require     CAP_NET_ADMIN, it may not always be the case. The socket UID may be used for network filtering and     routing, thus TUN/TAP sockets may be incorrectly managed, potentially bypassing network filters based on     UID. (CVE-2023-1076)

    kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

    The upstream bug report describes this issue as follows:

    A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

    A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local     privilege escalation.

    The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free     vulnerability due a race condition with fixed files getting unregistered.

    We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8. (CVE-2023-1872)

    When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation()     determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch     targetinjection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for     performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection     against which STIBP protects. (CVE-2023-1998)

    In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

    A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service. (CVE-2023-2985)

    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix mremap after fork null-deref (CVE-2023-52646)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() (CVE-2023-52702)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Fix use-after-free in ep_remove_wait_queue() (CVE-2023-52707)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (CVE-2023-52735)

    In the Linux kernel, the following vulnerability has been resolved:

    Fix page corruption caused by racy check in __free_pages (CVE-2023-52739)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix use-after-free in rdata->read_into_pages() (CVE-2023-52741)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() (CVE-2023-52746)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: prevent underflow of locked_vm via exec() (CVE-2023-53171)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: uhci: fix memory leak with using debugfs_lookup() (CVE-2023-53197)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (CVE-2023-53200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: domains: fix memory leak with using debugfs_lookup() (CVE-2023-53202)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix function prototype mismatch for ext4_feat_ktype (CVE-2023-53224)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: Fix kmemleak in watchdog_cdev_register (CVE-2023-53234)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (CVE-2023-53250)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (CVE-2023-53259)

    In the Linux kernel, the following vulnerability has been resolved:

    misc: vmw_balloon: fix memory leak with using debugfs_lookup() (CVE-2023-53279)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files (CVE-2023-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (CVE-2023-53307)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: fix memory leak with using debugfs_lookup() (CVE-2023-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: dd: fix memory leak with using debugfs_lookup() (CVE-2023-53390)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/blktrace: fix memory leak with using debugfs_lookup() (CVE-2023-53408)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: component: fix memory leak with using debugfs_lookup() (CVE-2023-53409)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: EM: fix memory leak with using debugfs_lookup() (CVE-2023-53411)

    In the Linux kernel, the following vulnerability has been resolved:

    objtool: Fix memory leak in create_static_call_sections() (CVE-2023-53423)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix warning and UAF when destroy the MR list (CVE-2023-53427)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (CVE-2023-53477)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Fix error unwind in iommu_group_alloc() (CVE-2023-53482)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not bother merging very long extents (CVE-2023-53506)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (CVE-2023-53590)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix resource leak in device_add() (CVE-2023-53594)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip: Fix refcount leak in platform_irqchip_probe (CVE-2023-53610)

    kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.235-144.344. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-043 advisory.

    A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

    It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return     Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is     dynamically partitioned between non-idle threads.  This allows an attacker to control speculative     execution on the adjacent thread. (CVE-2022-27672)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_tproxy: restrict to prerouting hook (CVE-2022-50001)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0458)

    Due to a type confusion during initializations, the tun and tap sockets in the Linux Kernel have their     socket UID hardcoded to 0, i.e. root. While it will be often correct, as TUN/TAP devices require     CAP_NET_ADMIN, it may not always be the case. The socket UID may be used for network filtering and     routing, thus TUN/TAP sockets may be incorrectly managed, potentially bypassing network filters based on     UID. (CVE-2023-1076)

    kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

    The upstream bug report describes this issue as follows:

    A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

    When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation()     determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch     targetinjection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for     performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection     against which STIBP protects. (CVE-2023-1998)

    A use-after-free flaw was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in the SCSI     sub-component in the Linux Kernel. This issue could allow an attacker to leak kernel internal information.
    (CVE-2023-2162)

    In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

    A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service. (CVE-2023-2985)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing a font->width and     font->height greater than 32 to the fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs, leading to undefined behavior and possible denial of service. (CVE-2023-3161)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal     kernel information. (CVE-2023-3567)

    An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix mremap after fork null-deref (CVE-2023-52646)

    In the Linux kernel, the following vulnerability has been resolved:

    net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (CVE-2023-52703)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix underflow in second superblock position calculations (CVE-2023-52705)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Fix use-after-free in ep_remove_wait_queue() (CVE-2023-52707)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: mmc_spi: fix error handling in mmc_spi_probe() (CVE-2023-52708)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)

    In the Linux kernel, the following vulnerability has been resolved:

    net: USB: Fix wrong-direction WARNING in plusb.c (CVE-2023-52742)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/IPoIB: Fix legacy IPoIB due to wrong number of queues (CVE-2023-52745)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swapfile: add cond_resched() in get_swap_pages() (CVE-2023-52932)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (CVE-2023-52973)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (CVE-2023-52974)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: fix potential NULL deref in efi_mem_reserve_persistent (CVE-2023-52976)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix flow memory leak in ovs_flow_cmd_new (CVE-2023-52977)

    In the Linux kernel, the following vulnerability has been resolved:

    squashfs: harden sanity check in squashfs_read_xattr_id_table (CVE-2023-52979)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix function prototype mismatch for ext4_feat_ktype (CVE-2023-53224)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: Fix kmemleak in watchdog_cdev_register (CVE-2023-53234)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/drivers/hisi: Drop second sensor hi3660 (CVE-2023-53242)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ensure that VID header offset + VID header size <= alloc, size (CVE-2023-53265)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (CVE-2023-53271)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files (CVE-2023-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (CVE-2023-53307)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix warning and UAF when destroy the MR list (CVE-2023-53427)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Don't attach if enclosure has no components (CVE-2023-53431)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: free iio for atombios when driver shutdown (CVE-2023-53453)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (CVE-2023-53477)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (CVE-2023-53481)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not bother merging very long extents (CVE-2023-53506)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (CVE-2023-53521)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (CVE-2023-53590)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses (CVE-2023-53675)

    kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.173-154.642. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-028 advisory.

    A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

    It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return     Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is     dynamically partitioned between non-idle threads.  This allows an attacker to control speculative     execution on the adjacent thread. (CVE-2022-27672)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_tproxy: restrict to prerouting hook (CVE-2022-50001)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0458)

    Due to a type confusion during initializations, the tun and tap sockets in the Linux Kernel have their     socket UID hardcoded to 0, i.e. root. While it will be often correct, as TUN/TAP devices require     CAP_NET_ADMIN, it may not always be the case. The socket UID may be used for network filtering and     routing, thus TUN/TAP sockets may be incorrectly managed, potentially bypassing network filters based on     UID. (CVE-2023-1076)

    kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

    The upstream bug report describes this issue as follows:

    A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

    A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local     privilege escalation.

    The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free     vulnerability due a race condition with fixed files getting unregistered.

    We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8. (CVE-2023-1872)

    When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation()     determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch     targetinjection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for     performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection     against which STIBP protects. (CVE-2023-1998)

    A use-after-free flaw was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in the SCSI     sub-component in the Linux Kernel. This issue could allow an attacker to leak kernel internal information.
    (CVE-2023-2162)

    In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the     drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually     an error pointer). (CVE-2023-22998)

    In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

    A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service. (CVE-2023-2985)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing a font->width and     font->height greater than 32 to the fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs, leading to undefined behavior and possible denial of service. (CVE-2023-3161)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal     kernel information. (CVE-2023-3567)

    An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix mremap after fork null-deref (CVE-2023-52646)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() (CVE-2023-52702)

    In the Linux kernel, the following vulnerability has been resolved:

    net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (CVE-2023-52703)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix underflow in second superblock position calculations (CVE-2023-52705)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: mmc_spi: fix error handling in mmc_spi_probe() (CVE-2023-52708)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)

    In the Linux kernel, the following vulnerability has been resolved:

    Fix page corruption caused by racy check in __free_pages (CVE-2023-52739)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix use-after-free in rdata->read_into_pages() (CVE-2023-52741)

    In the Linux kernel, the following vulnerability has been resolved:

    net: USB: Fix wrong-direction WARNING in plusb.c (CVE-2023-52742)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/IPoIB: Fix legacy IPoIB due to wrong number of queues (CVE-2023-52745)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() (CVE-2023-52746)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix potential bit_17 double-free (CVE-2023-52930)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swapfile: add cond_resched() in get_swap_pages() (CVE-2023-52932)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (CVE-2023-52973)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (CVE-2023-52974)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: fix potential NULL deref in efi_mem_reserve_persistent (CVE-2023-52976)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix flow memory leak in ovs_flow_cmd_new (CVE-2023-52977)

    In the Linux kernel, the following vulnerability has been resolved:

    squashfs: harden sanity check in squashfs_read_xattr_id_table (CVE-2023-52979)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener (CVE-2023-52986)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: prevent underflow of locked_vm via exec() (CVE-2023-53171)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix function prototype mismatch for ext4_feat_ktype (CVE-2023-53224)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: Fix kmemleak in watchdog_cdev_register (CVE-2023-53234)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/drivers/hisi: Drop second sensor hi3660 (CVE-2023-53242)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ensure that VID header offset + VID header size <= alloc, size (CVE-2023-53265)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (CVE-2023-53271)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files (CVE-2023-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (CVE-2023-53307)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: EM: fix memory leak with using debugfs_lookup() (CVE-2023-53411)

    In the Linux kernel, the following vulnerability has been resolved:

    objtool: Fix memory leak in create_static_call_sections() (CVE-2023-53423)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix warning and UAF when destroy the MR list (CVE-2023-53427)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Don't attach if enclosure has no components (CVE-2023-53431)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: free iio for atombios when driver shutdown (CVE-2023-53453)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (CVE-2023-53477)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (CVE-2023-53481)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not bother merging very long extents (CVE-2023-53506)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix a memory leak (CVE-2023-53512)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (CVE-2023-53521)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (CVE-2023-53590)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip: Fix refcount leak in platform_irqchip_probe (CVE-2023-53610)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses (CVE-2023-53675)

    kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-127 advisory.

    A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0458)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

    In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix mremap after fork null-deref (CVE-2023-52646)

    In the Linux kernel, the following vulnerability has been resolved:

    net: use a bounce buffer for copying skb->mark (CVE-2023-52701)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() (CVE-2023-52702)

    In the Linux kernel, the following vulnerability has been resolved:

    freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL (CVE-2023-52704)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Fix use-after-free in ep_remove_wait_queue() (CVE-2023-52707)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix invalid page access after closing deferred I/O devices (CVE-2023-52731)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: blocklist the kclient when receiving corrupted snap trace (CVE-2023-52732)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (CVE-2023-52735)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: lock the inode in shared mode before starting fiemap (CVE-2023-52737)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix function prototype mismatch for ext4_feat_ktype (CVE-2023-53224)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
265017	Linux Distros Unpatched Vulnerability : CVE-2023-53224	Nessus	Misc.	high
173235	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-015 (ALASKERNEL-5.15-2023-015)	Nessus	Amazon Linux Local Security Checks	high
173230	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-043 (ALASKERNEL-5.4-2023-043)	Nessus	Amazon Linux Local Security Checks	high
173228	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-028 (ALASKERNEL-5.10-2023-028)	Nessus	Amazon Linux Local Security Checks	high
173158	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-127)	Nessus	Amazon Linux Local Security Checks	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-53224

high

Tenable Plugins

high

high

high

high

high

high