In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes. To fix the incorrect behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE.

suse_linux SUSE-SU-2025:03600-1: SUSE openSUSE 15 : Security update for the Linux Kernel (Important) (SUSE-SU-2025:03600-1)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such     like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and     bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as     LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would     continue to the neighbor subsystem, causing use-after-free bug and kernel crashes. To fix the incorrect     behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the     other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus     convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE. (CVE-2023-53338)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.4.257-170.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-053 advisory.

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has     a fence use-after-free. (CVE-2023-51042)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix integer overflow in radeon_cs_parser_init (CVE-2023-53309)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Fix null-ptr-deref Read in txBegin (CVE-2023-53457)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (CVE-2023-53485)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.196-185.743. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-040 advisory.

    An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds     and crash in read_descriptors in drivers/usb/core/sysfs.c. (CVE-2023-37453)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to     cause a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (CVE-2023-52886)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.133-86.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-027 advisory.

    An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds     and crash in read_descriptors in drivers/usb/core/sysfs.c. (CVE-2023-37453)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: exthdr: fix 4-byte stack OOB write

    If priv->len is a multiple of 4, then dst[len / 4] can write pastthe destination array which leads to     stack corruption.

    This construct is necessary to clean the remainder of the registerin case ->len is NOT a multiple of the     register size, so make itconditional just like nft_payload.c does.

    The bug was added in 4.1 cycle and then copied/inherited whentcp/sctp and ip option support was added.

    Bug reported by Zero Day Initiative project (ZDI-CAN-21950,ZDI-CAN-21951, ZDI-CAN-21961). (CVE-2023-52628)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (CVE-2023-52886)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: Fix xsk_diag use-after-free error during socket cleanup (CVE-2023-53426)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-356 advisory.

    An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds     and crash in read_descriptors in drivers/usb/core/sysfs.c. (CVE-2023-37453)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    An integer overflow in kmalloc_reserve() in the Linux kernel may allow a local user to crash the system,     or in some cases obtain code execution in kernel space. (CVE-2023-42752)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: exthdr: fix 4-byte stack OOB write

    If priv->len is a multiple of 4, then dst[len / 4] can write pastthe destination array which leads to     stack corruption.

    This construct is necessary to clean the remainder of the registerin case ->len is NOT a multiple of the     register size, so make itconditional just like nft_payload.c does.

    The bug was added in 4.1 cycle and then copied/inherited whentcp/sctp and ip option support was added.

    Bug reported by Zero Day Initiative project (ZDI-CAN-21950,ZDI-CAN-21951, ZDI-CAN-21961). (CVE-2023-52628)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (CVE-2023-52886)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state (CVE-2023-53208)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() (CVE-2023-53210)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: Fix xsk_diag use-after-free error during socket cleanup (CVE-2023-53426)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE: Always save CS register on AMD Zen IF Poison errors (CVE-2023-53438)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: fix poll request timeout handling (CVE-2023-53531)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
265614	Linux Distros Unpatched Vulnerability : CVE-2023-53338	Nessus	Misc.	high
182660	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-053 (ALASKERNEL-5.4-2023-053)	Nessus	Amazon Linux Local Security Checks	high
182656	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-040 (ALASKERNEL-5.10-2023-040)	Nessus	Amazon Linux Local Security Checks	high
182654	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-027 (ALASKERNEL-5.15-2023-027)	Nessus	Amazon Linux Local Security Checks	high
182458	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-356)	Nessus	Amazon Linux Local Security Checks	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-53338

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

high