In the Linux kernel, the following vulnerability has been resolved: rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed Registering a kprobe on __rcu_irq_enter_check_tick() can cause kernel stack overflow as shown below. This issue can be reproduced by enabling CONFIG_NO_HZ_FULL and booting the kernel with argument "nohz_full=", and then giving the following commands at the shell prompt: # cd /sys/kernel/tracing/ # echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events # echo 1 > events/kprobes/enable This commit therefore adds __rcu_irq_enter_check_tick() to the kprobes blacklist using NOKPROBE_SYMBOL(). Insufficient stack space to handle exception! ESR: 0x00000000f2000004 -- BRK (AArch64) FAR: 0x0000ffffccf3e510 Task stack: [0xffff80000ad30000..0xffff80000ad38000] IRQ stack: [0xffff800008050000..0xffff800008058000] Overflow stack: [0xffff089c36f9f310..0xffff089c36fa0310] CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19 Hardware name: linux,dummy-virt (DT) pstate: 400003c5 (nZcv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __rcu_irq_enter_check_tick+0x0/0x1b8 lr : ct_nmi_enter+0x11c/0x138 sp : ffff80000ad30080 x29: ffff80000ad30080 x28: ffff089c82e20000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff089c02a8d100 x24: 0000000000000000 x23: 00000000400003c5 x22: 0000ffffccf3e510 x21: ffff089c36fae148 x20: ffff80000ad30120 x19: ffffa8da8fcce148 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffa8da8e44ea6c x14: ffffa8da8e44e968 x13: ffffa8da8e03136c x12: 1fffe113804d6809 x11: ffff6113804d6809 x10: 0000000000000a60 x9 : dfff800000000000 x8 : ffff089c026b404f x7 : 00009eec7fb297f7 x6 : 0000000000000001 x5 : ffff80000ad30120 x4 : dfff800000000000 x3 : ffffa8da8e3016f4 x2 : 0000000000000003 x1 : 0000000000000000 x0 : 0000000000000000 Kernel panic - not syncing: kernel stack overflow CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0xf8/0x108 show_stack+0x20/0x30 dump_stack_lvl+0x68/0x84 dump_stack+0x1c/0x38 panic+0x214/0x404 add_taint+0x0/0xf8 panic_bad_stack+0x144/0x160 handle_bad_stack+0x38/0x58 __bad_stack+0x78/0x7c __rcu_irq_enter_check_tick+0x0/0x1b8 arm64_enter_el1_dbg.isra.0+0x14/0x20 el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8 arm64_enter_el1_dbg.isra.0+0x14/0x20 el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8 arm64_enter_el1_dbg.isra.0+0x14/0x20 el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8 [...] el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8 arm64_enter_el1_dbg.isra.0+0x14/0x20 el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8 arm64_enter_el1_dbg.isra.0+0x14/0x20 el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8 el1_interrupt+0x28/0x60 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x64/0x68 __ftrace_set_clr_event_nolock+0x98/0x198 __ftrace_set_clr_event+0x58/0x80 system_enable_write+0x144/0x178 vfs_write+0x174/0x738 ksys_write+0xd0/0x188 __arm64_sys_write+0x4c/0x60 invoke_syscall+0x64/0x180 el0_svc_common.constprop.0+0x84/0x160 do_el0_svc+0x48/0xe8 el0_svc+0x34/0xd0 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x190/0x194 SMP: stopping secondary CPUs Kernel Offset: 0x28da86000000 from 0xffff800008000000 PHYS_OFFSET: 0xfffff76600000000 CPU features: 0x00000,01a00100,0000421b Memory Limit: none

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: rcu: Avoid stack overflow due to
    __rcu_irq_enter_check_tick() being kprobe-ed Registering a kprobe on __rcu_irq_enter_check_tick() can     cause kernel stack overflow as shown below. This issue can be reproduced by enabling CONFIG_NO_HZ_FULL and     booting the kernel with argument nohz_full=, and then giving the following commands at the shell prompt:
    # cd /sys/kernel/tracing/ # echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events # echo 1 >     events/kprobes/enable This commit therefore adds __rcu_irq_enter_check_tick() to the kprobes blacklist     using NOKPROBE_SYMBOL(). Insufficient stack space to handle exception! ESR: 0x00000000f2000004 -- BRK     (AArch64) FAR: 0x0000ffffccf3e510 Task stack: [0xffff80000ad30000..0xffff80000ad38000] IRQ stack:
    [0xffff800008050000..0xffff800008058000] Overflow stack: [0xffff089c36f9f310..0xffff089c36fa0310] CPU: 5     PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19 Hardware name: linux,dummy-virt (DT)     pstate: 400003c5 (nZcv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __rcu_irq_enter_check_tick+0x0/0x1b8     lr : ct_nmi_enter+0x11c/0x138 sp : ffff80000ad30080 x29: ffff80000ad30080 x28: ffff089c82e20000 x27:
    0000000000000000 x26: 0000000000000000 x25: ffff089c02a8d100 x24: 0000000000000000 x23: 00000000400003c5     x22: 0000ffffccf3e510 x21: ffff089c36fae148 x20: ffff80000ad30120 x19: ffffa8da8fcce148 x18:
    0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffa8da8e44ea6c x14: ffffa8da8e44e968     x13: ffffa8da8e03136c x12: 1fffe113804d6809 x11: ffff6113804d6809 x10: 0000000000000a60 x9 :
    dfff800000000000 x8 : ffff089c026b404f x7 : 00009eec7fb297f7 x6 : 0000000000000001 x5 : ffff80000ad30120     x4 : dfff800000000000 x3 : ffffa8da8e3016f4 x2 : 0000000000000003 x1 : 0000000000000000 x0 :
    0000000000000000 Kernel panic - not syncing: kernel stack overflow CPU: 5 PID: 190 Comm: bash Not tainted     6.2.0-rc2-00320-g1f5abbd77e2c #19 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace+0xf8/0x108 show_stack+0x20/0x30 dump_stack_lvl+0x68/0x84 dump_stack+0x1c/0x38     panic+0x214/0x404 add_taint+0x0/0xf8 panic_bad_stack+0x144/0x160 handle_bad_stack+0x38/0x58
    __bad_stack+0x78/0x7c __rcu_irq_enter_check_tick+0x0/0x1b8 arm64_enter_el1_dbg.isra.0+0x14/0x20     el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68
    __rcu_irq_enter_check_tick+0x0/0x1b8 arm64_enter_el1_dbg.isra.0+0x14/0x20 el1_dbg+0x2c/0x90     el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8     arm64_enter_el1_dbg.isra.0+0x14/0x20 el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8     el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8 [...] el1_dbg+0x2c/0x90     el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8     arm64_enter_el1_dbg.isra.0+0x14/0x20 el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8     el1h_64_sync+0x64/0x68 __rcu_irq_enter_check_tick+0x0/0x1b8 arm64_enter_el1_dbg.isra.0+0x14/0x20     el1_dbg+0x2c/0x90 el1h_64_sync_handler+0xcc/0xe8 el1h_64_sync+0x64/0x68
    __rcu_irq_enter_check_tick+0x0/0x1b8 el1_interrupt+0x28/0x60 el1h_64_irq_handler+0x18/0x28     el1h_64_irq+0x64/0x68 __ftrace_set_clr_event_nolock+0x98/0x198 __ftrace_set_clr_event+0x58/0x80     system_enable_write+0x144/0x178 vfs_write+0x174/0x738 ksys_write+0xd0/0x188 __arm64_sys_write+0x4c/0x60     invoke_syscall+0x64/0x180 el0_svc_common.constprop.0+0x84/0x160 do_el0_svc+0x48/0xe8 el0_svc+0x34/0xd0     el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x190/0x194 SMP: stopping secondary CPUs Kernel Offset:
    0x28da86000000 from 0xffff800008000000 PHYS_OFFSET: 0xfffff76600000000 CPU features:
    0x00000,01a00100,0000421b Memory Limit: none (CVE-2023-53655)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.117-72.142. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-021 advisory.

    In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT     flags before replaying logs. (CVE-2022-48425)

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of alloc->vma in race with munmap() (CVE-2022-50240)

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of alloc->vma in race with munmap() (CVE-2022-50338)

    There is a potential deadlock in the eBPF subsystem in the Linux kernel.

    The default sysctl configuration kernel.unprivileged_bpf_disabled on Amazon Linux does not allow     unprivileged users to use eBPF. (CVE-2023-0160)

    A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue     results from the improper handling of user-supplied data, which can lead to an assertion failure. This     flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.
    (CVE-2023-2156)

    A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation.

    The out-of-bounds write is caused by missing skb->cb  initialization in the ipvlan network driver. The     vulnerability is reachable if CONFIG_IPVLAN is enabled.

    We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

    A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code     can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It     can lead to null pointer dereference when gfs2_trans_begin being called and then fail     ingfs2_evict_inode(). (CVE-2023-3212)

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. (CVE-2023-34256)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal     kernel information. (CVE-2023-3567)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Reinit port->pm on port specific driver unbind (CVE-2023-53176)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Avoid undefined behavior: applying zero offset to null pointer (CVE-2023-53182)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add length check in indx_get_root (CVE-2023-53194)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix i_disksize exceeding i_size problem in paritally written case (CVE-2023-53270)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() (CVE-2023-53294)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in mb_find_extent (CVE-2023-53317)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access (CVE-2023-53419)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add vlan_get_protocol_and_depth() helper (CVE-2023-53433)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: improve error handling from ext4_dirhash() (CVE-2023-53473)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Use an u64 for bank_map (CVE-2023-53474)

    In the Linux kernel, the following vulnerability has been resolved:

    lib: cpu_rmap: Avoid use after free on rmap->obj array entries (CVE-2023-53484)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance the attribute size check (CVE-2023-53486)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (CVE-2023-53489)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: Fix error unwinding of XDP initialization (CVE-2023-53499)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: allow ext4_get_group_info() to fail (CVE-2023-53503)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-crypto: make blk_crypto_evict_key() more robust (CVE-2023-53536)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix null deref on element insertion (CVE-2023-53566)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Make intel_get_crtc_new_encoder() less oopsy (CVE-2023-53571)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: Always check queue mode setting from configfs (CVE-2023-53576)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix multiple LUN_RESET handling (CVE-2023-53586)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Sync IRQ works before buffer destruction (CVE-2023-53587)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix deadlock in tc route query code (CVE-2023-53591)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (CVE-2023-53604)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_fq: fix integer overflow of credit (CVE-2023-53624)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed (CVE-2023-53655)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (CVE-2023-53692)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix out-of-bounds access in ipv6_find_tlv() (CVE-2023-53705)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix NULL dereference in ni_write_inode (CVE-2023-53732)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (CVE-2023-53747)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: fix a crash with invalid table line (CVE-2023-53786)

    In the Linux kernel, the following vulnerability has been resolved:

    ethtool: Fix uninitialized number of lanes (CVE-2023-53798)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: release crypto keyslot before reporting I/O complete (CVE-2023-53810)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix null-ptr-deref in raid10_sync_request (CVE-2023-53832)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: annotate accesses to nlk->cb_running (CVE-2023-53853)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() (CVE-2023-53988)

    In the Linux kernel, the following vulnerability has been resolved:

    SMB3: Add missing locks to protect deferred close file list (CVE-2023-53990)

    In the Linux kernel, the following vulnerability has been resolved:

    udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). (CVE-2023-54004)

    In the Linux kernel, the following vulnerability has been resolved:

    vmci_host: fix a race condition in vmci_host_poll() causing GPF (CVE-2023-54007)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix stack overflow when LRO is disabled for virtual interfaces (CVE-2023-54012)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device (CVE-2023-54015)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: set goal start correctly in ext4_mb_normalize_request (CVE-2023-54021)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps (CVE-2023-54033)

    In the Linux kernel, the following vulnerability has been resolved:

    spmi: Add a check for remove callback when removing a SPMI driver (CVE-2023-54044)

    In the Linux kernel, the following vulnerability has been resolved:

    kheaders: Use array declaration instead of char (CVE-2023-54056)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix invalid free tracking in ext4_xattr_move_to_block() (CVE-2023-54062)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix OOB read in indx_insert_into_buffer (CVE-2023-54063)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix memory leak if ntfs_read_mft failed (CVE-2023-54077)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Add preempt_count_{sub,add} into btf id deny list (CVE-2023-54086)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (CVE-2023-54114)

    In the Linux kernel, the following vulnerability has been resolved:

    inotify: Avoid reporting event with invalid wd (CVE-2023-54119)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak for 'conf->bio_split' (CVE-2023-54123)

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of alloc->vma in race with munmap() (CVE-2023-54157)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: don't free qgroup space unless specified (CVE-2023-54158)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_sdei: Fix sleep from invalid context BUG (CVE-2023-54160)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: remove block_cb from driver_list before freeing (CVE-2023-54193)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode' (CVE-2023-54196)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: always release netdev hooks from notifier (CVE-2023-54200)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (CVE-2023-54218)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data races around sk->sk_shutdown. (CVE-2023-54226)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: EC: Fix oops when removing custom query handlers (CVE-2023-54244)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add check for kmemdup (CVE-2023-54248)

    In the Linux kernel, the following vulnerability has been resolved:

    debugobjects: Don't wake up kswapd from fill_pool() (CVE-2023-54268)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: double free xprt_ctxt while still in use (CVE-2023-54269)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix a possible null-pointer dereference in ni_clear() (CVE-2023-54272)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak of md thread (CVE-2023-54294)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix deadlock when converting an inline directory in nojournal mode (CVE-2023-54311)

    A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.184-174.730. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-034 advisory.

    A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking     configuration (redirecting egress packets to ingress using TC action mirred) a local unprivileged user     could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a     retransmission, resulting in a denial of service condition. (CVE-2022-4269)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (CVE-2022-50067)

    There is a potential deadlock in the eBPF subsystem in the Linux kernel.

    The default sysctl configuration kernel.unprivileged_bpf_disabled on Amazon Linux does not allow     unprivileged users to use eBPF. (CVE-2023-0160)

    A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue     results from the improper handling of user-supplied data, which can lead to an assertion failure. This     flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.
    (CVE-2023-2156)

    A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation.

    The out-of-bounds write is caused by missing skb->cb  initialization in the ipvlan network driver. The     vulnerability is reachable if CONFIG_IPVLAN is enabled.

    We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

    A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

    A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

    A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code     can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It     can lead to null pointer dereference when gfs2_trans_begin being called and then fail     ingfs2_evict_inode(). (CVE-2023-3212)

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. (CVE-2023-34256)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal     kernel information. (CVE-2023-3567)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Reinit port->pm on port specific driver unbind (CVE-2023-53176)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Avoid undefined behavior: applying zero offset to null pointer (CVE-2023-53182)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in mb_find_extent (CVE-2023-53317)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: do not write dirty data after degenerating to read-only (CVE-2023-53337)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access (CVE-2023-53419)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add vlan_get_protocol_and_depth() helper (CVE-2023-53433)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Use an u64 for bank_map (CVE-2023-53474)

    In the Linux kernel, the following vulnerability has been resolved:

    lib: cpu_rmap: Avoid use after free on rmap->obj array entries (CVE-2023-53484)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (CVE-2023-53489)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: allow ext4_get_group_info() to fail (CVE-2023-53503)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: do not update mtu if msg_max is too small in mtu negotiation (CVE-2023-53517)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-crypto: make blk_crypto_evict_key() more robust (CVE-2023-53536)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix null deref on element insertion (CVE-2023-53566)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: qup: Don't skip cleanup in remove's error path (CVE-2023-53567)

    In the Linux kernel, the following vulnerability has been resolved:

    ext2: Check block size validity during mount (CVE-2023-53569)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: Always check queue mode setting from configfs (CVE-2023-53576)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix multiple LUN_RESET handling (CVE-2023-53586)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Sync IRQ works before buffer destruction (CVE-2023-53587)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (CVE-2023-53604)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_fq: fix integer overflow of credit (CVE-2023-53624)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed (CVE-2023-53655)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (CVE-2023-53683)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (CVE-2023-53692)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix out-of-bounds access in ipv6_find_tlv() (CVE-2023-53705)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: arc_uart: fix of_iomap leak in `arc_serial_probe` (CVE-2023-53719)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (CVE-2023-53747)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() (CVE-2023-53754)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: usbtmc: Fix direction for 0-length ioctl control messages (CVE-2023-53761)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: fix a crash with invalid table line (CVE-2023-53786)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (CVE-2023-53804)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: release crypto keyslot before reporting I/O complete (CVE-2023-53810)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix null-ptr-deref in raid10_sync_request (CVE-2023-53832)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix infinite loop in nilfs_mdt_get_block() (CVE-2023-53845)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: annotate accesses to nlk->cb_running (CVE-2023-53853)

    In the Linux kernel, the following vulnerability has been resolved:

    udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). (CVE-2023-54004)

    In the Linux kernel, the following vulnerability has been resolved:

    vmci_host: fix a race condition in vmci_host_poll() causing GPF (CVE-2023-54007)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix stack overflow when LRO is disabled for virtual interfaces (CVE-2023-54012)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device (CVE-2023-54015)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: set goal start correctly in ext4_mb_normalize_request (CVE-2023-54021)

    In the Linux kernel, the following vulnerability has been resolved:

    spmi: Add a check for remove callback when removing a SPMI driver (CVE-2023-54044)

    In the Linux kernel, the following vulnerability has been resolved:

    kheaders: Use array declaration instead of char (CVE-2023-54056)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix invalid free tracking in ext4_xattr_move_to_block() (CVE-2023-54062)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qedi: Fix use after free bug in qedi_remove() (CVE-2023-54100)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow (CVE-2023-54102)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (CVE-2023-54114)

    In the Linux kernel, the following vulnerability has been resolved:

    inotify: Avoid reporting event with invalid wd (CVE-2023-54119)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak for 'conf->bio_split' (CVE-2023-54123)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: don't free qgroup space unless specified (CVE-2023-54158)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_sdei: Fix sleep from invalid context BUG (CVE-2023-54160)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (CVE-2023-54168)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsit: Free cmds before session free (CVE-2023-54184)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: remove block_cb from driver_list before freeing (CVE-2023-54193)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: sisusbvga: Add endpoint checks (CVE-2023-54213)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (CVE-2023-54218)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data races around sk->sk_shutdown. (CVE-2023-54226)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: EC: Fix oops when removing custom query handlers (CVE-2023-54244)

    In the Linux kernel, the following vulnerability has been resolved:

    debugobjects: Don't wake up kswapd from fill_pool() (CVE-2023-54268)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/srpt: Add a check for valid 'mad_agent' pointer (CVE-2023-54274)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak of md thread (CVE-2023-54294)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix deadlock when converting an inline directory in nojournal mode (CVE-2023-54311)

    A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-184 advisory.

    There is a potential deadlock in the eBPF subsystem in the Linux kernel.

    The default sysctl configuration kernel.unprivileged_bpf_disabled on Amazon Linux does not allow     unprivileged users to use eBPF. (CVE-2023-0160)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. (CVE-2023-34256)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix i_disksize exceeding i_size problem in paritally written case (CVE-2023-53270)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() (CVE-2023-53294)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix WARNING in mb_find_extent (CVE-2023-53317)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: improve error handling from ext4_dirhash() (CVE-2023-53473)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE/AMD: Use an u64 for bank_map (CVE-2023-53474)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (CVE-2023-53489)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-crypto: make blk_crypto_evict_key() more robust (CVE-2023-53536)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Make intel_get_crtc_new_encoder() less oopsy (CVE-2023-53571)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Fix multiple LUN_RESET handling (CVE-2023-53586)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Sync IRQ works before buffer destruction (CVE-2023-53587)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (CVE-2023-53604)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_fq: fix integer overflow of credit (CVE-2023-53624)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: fix wrong ct->timeout value (CVE-2023-53635)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: fix clear_user_rep_good() exception handling annotation (CVE-2023-53642)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed (CVE-2023-53655)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix skb_copy_ubufs() vs BIG TCP (CVE-2023-53669)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (CVE-2023-53692)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: fix clear_user_rep_good() exception handling annotation (CVE-2023-53749)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (CVE-2023-53751)

    In the Linux kernel, the following vulnerability has been resolved:

    virt/coco/sev-guest: Double-buffer messages (CVE-2023-53769)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: fix a crash with invalid table line (CVE-2023-53786)

    In the Linux kernel, the following vulnerability has been resolved:

    ethtool: Fix uninitialized number of lanes (CVE-2023-53798)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: release crypto keyslot before reporting I/O complete (CVE-2023-53810)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix null-ptr-deref in raid10_sync_request (CVE-2023-53832)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix potential use-after-free bug when trimming caps (CVE-2023-53867)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() (CVE-2023-53988)

    In the Linux kernel, the following vulnerability has been resolved:

    SMB3: Add missing locks to protect deferred close file list (CVE-2023-53990)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix assertion of exclop condition when starting balance (CVE-2023-54002)

    In the Linux kernel, the following vulnerability has been resolved:

    vmci_host: fix a race condition in vmci_host_poll() causing GPF (CVE-2023-54007)

    In the Linux kernel, the following vulnerability has been resolved:

    spmi: Add a check for remove callback when removing a SPMI driver (CVE-2023-54044)

    In the Linux kernel, the following vulnerability has been resolved:

    kheaders: Use array declaration instead of char (CVE-2023-54056)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix invalid free tracking in ext4_xattr_move_to_block() (CVE-2023-54062)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix OOB read in indx_insert_into_buffer (CVE-2023-54063)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site (CVE-2023-54073)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix memory leak if ntfs_read_mft failed (CVE-2023-54077)

    In the Linux kernel, the following vulnerability has been resolved:

    inotify: Avoid reporting event with invalid wd (CVE-2023-54119)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak for 'conf->bio_split' (CVE-2023-54123)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: don't free qgroup space unless specified (CVE-2023-54158)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: remove block_cb from driver_list before freeing (CVE-2023-54193)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Add check for kmemdup (CVE-2023-54248)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix memleak of md thread (CVE-2023-54294)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix deadlock when converting an inline directory in nojournal mode (CVE-2023-54311)

    A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
302981	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-1637)	Nessus	Huawei Local Security Checks	high
302971	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-1629)	Nessus	Huawei Local Security Checks	high
297598	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1212)	Nessus	Huawei Local Security Checks	high
297592	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1224)	Nessus	Huawei Local Security Checks	high
270183	Linux Distros Unpatched Vulnerability : CVE-2023-53655	Nessus	Misc.	high
177781	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-021 (ALASKERNEL-5.15-2023-021)	Nessus	Amazon Linux Local Security Checks	high
177770	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-034 (ALASKERNEL-5.10-2023-034)	Nessus	Amazon Linux Local Security Checks	high
176925	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-184)	Nessus	Amazon Linux Local Security Checks	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-53655

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high