In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of mpi_cmp_ui()

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0962-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
    - CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
    - CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
    - CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
    - CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
    - CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64()     paths
    - CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
    - CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
    - CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
    - CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
    - CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction     (bsc#1256683).
    - CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
    - CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
    - CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
    - CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer     (bsc#1256708).
    - CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
    - CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
    - CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
    - CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
    - CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
    - CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type     (bsc#1257687).
    - CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
    - CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
    - CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
    - CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
    - CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set     (bsc#1257246).
    - CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
    - CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
    - CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
    - CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
    - CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
    - CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
    - CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
    - CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec     (bsc#1257735).
    - CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
    - CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
    - CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
    - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
    - CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
    - CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
    - CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
    - CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
    - CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
    - CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
    - CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
    - CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
    - CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
    - CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).
    - CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag     (bsc#1257775).
    - CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).
    - CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other     (bsc#1257761).
    - CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()     (bsc#1258181).
    - CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).
    - CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
    - CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).
    - CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).
    - CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
    - CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).
    - CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
    - CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
    - CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).
    - CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
    - CVE-2026-23171: net: bonding: update the slave array for broadcast mode (bsc#1258349).
    - CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).
    - CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).
    - CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).
    - CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).
    - CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
    - CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).
    - CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
    - CVE-2026-23210: ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1258517).
    - CVE-2026-23213: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (bsc#1258465).
    - CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).
    - CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management
    - CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

    md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

    usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

    partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

    HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

    pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

    libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

    watchdog: Fix kmemleak in watchdog_cdev_register(CVE-2023-53234)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    nbd: Fix hung when signal interrupts nbd_start_device_ioctl()(CVE-2022-50314)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

    net: hns: fix possible memory leak in hnae_ae_register()(CVE-2022-50352)

    md: call __md_stop_writes in md_stop(CVE-2022-49987)

    net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints()(CVE-2022-50191)

    ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails(CVE-2022-50087)

    md-raid10: fix KASAN warning(CVE-2022-50211)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

    nfs: handle failure of nfs_get_lock_context in unlock path(CVE-2025-38023)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

    RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

    i40e: add validation for ring_len param(CVE-2025-39973)

    md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

    Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    RDMA/rxe: Fix error unwind in rxe_create_qp()(CVE-2022-50127)

    __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

    sctp: handle the error returned from sctp_auth_asoc_init_active_key(CVE-2022-50243)

    vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

    smb: client: Fix use-after-free in cifs_fill_dirent(CVE-2025-38051)

    scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

    sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

    pstore/ram: Check start of empty przs during init(CVE-2023-53331)

    clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

    md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

    net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

    cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

    dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

    scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

    block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

    drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

    dm flakey: fix a crash with invalid table line(CVE-2023-53786)

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

    hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    ppp: associate skb with a device at tx(CVE-2022-50655)

    fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

    acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

    udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

    tee: add overflow check in register_shm_helper()(CVE-2022-50080)

    drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

    crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

    scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

    NFSD: Fix crash in nfsd4_read_release()(CVE-2025-40324)

    scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

     media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

    mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()(CVE-2022-50347)

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

    platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()(CVE-2022-50521)

    tipc: fix an information leak in tipc_topsrv_kern_subscr(CVE-2022-50531)

    scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

    dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

    md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts(CVE-2023-53245)

    md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

    clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

    sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

    crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

    drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

    dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

    cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

    net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device(CVE-2023-54015)

    ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

    fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

    scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

    macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse(CVE-2025-68367)

    ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

    crypto: qat - fix DMA transfer direction(CVE-2022-50774)

    scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

    mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

    usb: host: ohci-ppc-of: Fix refcount leak bug(CVE-2022-50033)

    PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

    media: dvb-frontends: fix leak of memory fw(CVE-2022-50664)

    fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

    acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl(CVE-2024-56662)

    scsi: ses: Handle enclosure with just a primary component gracefully(CVE-2023-53431)

    pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

    hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

    usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

    netlink: do not hard code device address lenth in fdb dumps(CVE-2023-53863)

    drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

    ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe(CVE-2025-68241)

    md/raid10: fix null-ptr-deref in raid10_sync_request(CVE-2023-53832)

    iommu/amd: Fix pci device refcount leak in ppr_notifier()(CVE-2022-50505)

    net: read sk-sk_family once in sk_mc_loop()(CVE-2023-53831)

    fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

    bpf: make sure skb-len != 0 when redirecting to a tunneling device(CVE-2022-50253)

    ppp: associate skb with a device at tx(CVE-2022-50655)

    ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

    hwrng: amd - Fix PCI device refcount leak(CVE-2022-50868)

    netlink: annotate accesses to nlk-cb_running(CVE-2023-53853)

    acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

    RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

    udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

    dm flakey: fix a crash with invalid table line(CVE-2023-53786)

    libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

    md: Replace snprintf with scnprintf(CVE-2022-50299)

    mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

    md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

    loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

    scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

    NFS: Fix a race when updating an existing write(CVE-2025-39697)

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

    dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

    usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

    mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

    md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

    net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

    fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

    partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

    HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

    pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

    libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

    watchdog: Fix kmemleak in watchdog_cdev_register(CVE-2023-53234)

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

    PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

    ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

    nbd: Fix hung when signal interrupts nbd_start_device_ioctl()(CVE-2022-50314)

    igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

    net: hns: fix possible memory leak in hnae_ae_register()(CVE-2022-50352)

    md: call __md_stop_writes in md_stop(CVE-2022-49987)

    net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

    regulator: of: Fix refcount leak bug in of_get_regulation_constraints()(CVE-2022-50191)

    ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

    HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

    ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

    md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

    scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

    udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

    igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

    cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

    scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

    ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

    fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails(CVE-2022-50087)

    md-raid10: fix KASAN warning(CVE-2022-50211)

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

    mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

    nfs: handle failure of nfs_get_lock_context in unlock path(CVE-2025-38023)

    udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

    sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

    net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

    RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

    i40e: add validation for ring_len param(CVE-2025-39973)

    md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

    Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

    ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

    af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

    RDMA/rxe: Fix error unwind in rxe_create_qp()(CVE-2022-50127)

    __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

    NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

    scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

    sctp: handle the error returned from sctp_auth_asoc_init_active_key(CVE-2022-50243)

    vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

    smb: client: Fix use-after-free in cifs_fill_dirent(CVE-2025-38051)

    scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

    sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

    pstore/ram: Check start of empty przs during init(CVE-2023-53331)

    clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

    md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

    nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

    cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

    net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

    cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

    dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

    scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

    block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

    drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

    dm flakey: fix a crash with invalid table line(CVE-2023-53786)

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

    hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

    sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

    ppp: associate skb with a device at tx(CVE-2022-50655)

    fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

    acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

    udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

    tee: add overflow check in register_shm_helper()(CVE-2022-50080)

    drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

    crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() During NVMeTCP Authentication a controller can     trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but     zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is     passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of     mpi_cmp_ui() (CVE-2023-53817)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.10.197-186.748. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-041 advisory.

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-     free.

    We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325. (CVE-2023-5197)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (CVE-2023-53616)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: output extra debug info if we failed to find an inline backref (CVE-2023-53672)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (CVE-2023-53676)

    In the Linux kernel, the following vulnerability has been resolved:

    md: raid1: fix potential OOB in raid1_remove_disk() (CVE-2023-53722)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (CVE-2023-53817)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (CVE-2023-54127)

    In the Linux kernel, the following vulnerability has been resolved:

    autofs: fix memory leak of waitqueues in autofs_catatonic_mode (CVE-2023-54134)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: release path before inode lookup during the ino lookup ioctl (CVE-2023-54281)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.257-170.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-053 advisory.

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has     a fence use-after-free. (CVE-2023-51042)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix integer overflow in radeon_cs_parser_init (CVE-2023-53309)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla4xxx: Add length check when parsing nlattrs (CVE-2023-53456)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Fix null-ptr-deref Read in txBegin (CVE-2023-53457)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (CVE-2023-53485)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    PM / devfreq: Fix leak in devfreq_dev_release() (CVE-2023-53518)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi_si: fix a memleak in try_smi_init() (CVE-2023-53611)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (CVE-2023-53616)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix possible data races in gfs2_show_options() (CVE-2023-53622)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: output extra debug info if we failed to find an inline backref (CVE-2023-53672)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (CVE-2023-53676)

    In the Linux kernel, the following vulnerability has been resolved:

    md: raid1: fix potential OOB in raid1_remove_disk() (CVE-2023-53722)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Check for read-only mounted filesystem in txBegin (CVE-2023-53766)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: Fix out of bounds access in DCCP error handler (CVE-2023-53782)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (CVE-2023-53817)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (CVE-2023-53825)

    In the Linux kernel, the following vulnerability has been resolved:

    net: read sk->sk_family once in sk_mc_loop() (CVE-2023-53831)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix one memleak in __inet_del_ifa() (CVE-2023-53995)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-race around unix_tot_inflight. (CVE-2023-54006)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix possible soft lockup in __audit_inode_child() (CVE-2023-54045)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix memory leak in error path of kcm_sendmsg() (CVE-2023-54112)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (CVE-2023-54127)

    In the Linux kernel, the following vulnerability has been resolved:

    autofs: fix memory leak of waitqueues in autofs_catatonic_mode (CVE-2023-54134)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (CVE-2023-54140)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (CVE-2023-54178)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert IB/isert: Fix incorrect release of isert connection (CVE-2023-54219)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    amba: bus: fix refcount leak (CVE-2023-54230)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: typec: bus: verify partner exists in typec_altmode_attention (CVE-2023-54299)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.133-86.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-027 advisory.

    An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds     and crash in read_descriptors in drivers/usb/core/sysfs.c. (CVE-2023-37453)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: exthdr: fix 4-byte stack OOB write

    If priv->len is a multiple of 4, then dst[len / 4] can write pastthe destination array which leads to     stack corruption.

    This construct is necessary to clean the remainder of the registerin case ->len is NOT a multiple of the     register size, so make itconditional just like nft_payload.c does.

    The bug was added in 4.1 cycle and then copied/inherited whentcp/sctp and ip option support was added.

    Bug reported by Zero Day Initiative project (ZDI-CAN-21950,ZDI-CAN-21951, ZDI-CAN-21961). (CVE-2023-52628)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (CVE-2023-52886)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: Fix xsk_diag use-after-free error during socket cleanup (CVE-2023-53426)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    hsr: Fix uninit-value access in fill_frame_info() (CVE-2023-53462)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind (CVE-2023-53501)

    In the Linux kernel, the following vulnerability has been resolved:

    PM / devfreq: Fix leak in devfreq_dev_release() (CVE-2023-53518)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject unhashed sockets in bpf_sk_assign (CVE-2023-53585)

    In the Linux kernel, the following vulnerability has been resolved:

    perf trace: Really free the evsel->priv area (CVE-2023-53649)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: output extra debug info if we failed to find an inline backref (CVE-2023-53672)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a potential data corruption (CVE-2023-53711)

    In the Linux kernel, the following vulnerability has been resolved:

    md: raid1: fix potential OOB in raid1_remove_disk() (CVE-2023-53722)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: csum: Fix OoB access in IP checksum code for negative lengths (CVE-2023-53726)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fq_pie: avoid stalls in fq_pie_timer() (CVE-2023-53727)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: api - Use work queue in crypto_destroy_instance (CVE-2023-53799)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (CVE-2023-53817)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (CVE-2023-53825)

    In the Linux kernel, the following vulnerability has been resolved:

    net: read sk->sk_family once in sk_mc_loop() (CVE-2023-53831)

    In the Linux kernel, the following vulnerability has been resolved:

    of: overlay: Call of_changeset_init() early (CVE-2023-53856)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: correct grp validation in ext4_mb_good_group (CVE-2023-53861)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix one memleak in __inet_del_ifa() (CVE-2023-53995)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-race around unix_tot_inflight. (CVE-2023-54006)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix possible soft lockup in __audit_inode_child() (CVE-2023-54045)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix memory leak in error path of kcm_sendmsg() (CVE-2023-54112)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: dump vmalloc memory info safely (CVE-2023-54113)

    In the Linux kernel, the following vulnerability has been resolved:

    autofs: fix memory leak of waitqueues in autofs_catatonic_mode (CVE-2023-54134)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: fix cap_migration information leak (CVE-2023-54137)

    In the Linux kernel, the following vulnerability has been resolved:

    of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (CVE-2023-54178)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix lockdep splat and potential deadlock after failure running delayed items (CVE-2023-54224)

    In the Linux kernel, the following vulnerability has been resolved:

    amba: bus: fix refcount leak (CVE-2023-54230)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: release path before inode lookup during the ino lookup ioctl (CVE-2023-54281)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: typec: bus: verify partner exists in typec_altmode_attention (CVE-2023-54299)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.326-245.539. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2264 advisory.

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage     collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.

    We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8. (CVE-2023-4244)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix integer overflow in radeon_cs_parser_init (CVE-2023-53309)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla4xxx: Add length check when parsing nlattrs (CVE-2023-53456)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Fix null-ptr-deref Read in txBegin (CVE-2023-53457)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (CVE-2023-53485)

    In the Linux kernel, the following vulnerability has been resolved:

    PM / devfreq: Fix leak in devfreq_dev_release() (CVE-2023-53518)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (CVE-2023-53616)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix possible data races in gfs2_show_options() (CVE-2023-53622)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: output extra debug info if we failed to find an inline backref (CVE-2023-53672)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (CVE-2023-53676)

    In the Linux kernel, the following vulnerability has been resolved:

    md: raid1: fix potential OOB in raid1_remove_disk() (CVE-2023-53722)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Check for read-only mounted filesystem in txBegin (CVE-2023-53766)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: Fix out of bounds access in DCCP error handler (CVE-2023-53782)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (CVE-2023-53817)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (CVE-2023-53825)

    In the Linux kernel, the following vulnerability has been resolved:

    net: read sk->sk_family once in sk_mc_loop() (CVE-2023-53831)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: fix data-race around dp->dccps_mss_cache (CVE-2023-53839)

    In the Linux kernel, the following vulnerability has been resolved:

    usb-storage: alauda: Fix uninit-value in alauda_check_media() (CVE-2023-53847)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-race around unix_tot_inflight. (CVE-2023-54006)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix possible soft lockup in __audit_inode_child() (CVE-2023-54045)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix memory leak in error path of kcm_sendmsg() (CVE-2023-54112)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (CVE-2023-54127)

    In the Linux kernel, the following vulnerability has been resolved:

    autofs: fix memory leak of waitqueues in autofs_catatonic_mode (CVE-2023-54134)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (CVE-2023-54140)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (CVE-2023-54178)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert IB/isert: Fix incorrect release of isert connection (CVE-2023-54219)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    amba: bus: fix refcount leak (CVE-2023-54230)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-356 advisory.

    An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds     and crash in read_descriptors in drivers/usb/core/sysfs.c. (CVE-2023-37453)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    An integer overflow in kmalloc_reserve() in the Linux kernel may allow a local user to crash the system,     or in some cases obtain code execution in kernel space. (CVE-2023-42752)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: exthdr: fix 4-byte stack OOB write

    If priv->len is a multiple of 4, then dst[len / 4] can write pastthe destination array which leads to     stack corruption.

    This construct is necessary to clean the remainder of the registerin case ->len is NOT a multiple of the     register size, so make itconditional just like nft_payload.c does.

    The bug was added in 4.1 cycle and then copied/inherited whentcp/sctp and ip option support was added.

    Bug reported by Zero Day Initiative project (ZDI-CAN-21950,ZDI-CAN-21951, ZDI-CAN-21961). (CVE-2023-52628)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (CVE-2023-52886)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state (CVE-2023-53208)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() (CVE-2023-53210)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: Fix xsk_diag use-after-free error during socket cleanup (CVE-2023-53426)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/MCE: Always save CS register on AMD Zen IF Poison errors (CVE-2023-53438)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla4xxx: Add length check when parsing nlattrs (CVE-2023-53456)

    In the Linux kernel, the following vulnerability has been resolved:

    hsr: Fix uninit-value access in fill_frame_info() (CVE-2023-53462)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind (CVE-2023-53501)

    In the Linux kernel, the following vulnerability has been resolved:

    PM / devfreq: Fix leak in devfreq_dev_release() (CVE-2023-53518)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: check 'jh->b_transaction' before removing it from checkpoint (CVE-2023-53526)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: fix poll request timeout handling (CVE-2023-53531)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CVE-2023-53552)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject unhashed sockets in bpf_sk_assign (CVE-2023-53585)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: Free devm resources when unregistering a device (CVE-2023-53596)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Don't dereference ACPI root object handle (CVE-2023-53647)

    In the Linux kernel, the following vulnerability has been resolved:

    perf trace: Really free the evsel->priv area (CVE-2023-53649)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (CVE-2023-53662)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Check instead of asserting on nested TSC scaling support (CVE-2023-53663)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: output extra debug info if we failed to find an inline backref (CVE-2023-53672)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (CVE-2023-53676)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a potential data corruption (CVE-2023-53711)

    In the Linux kernel, the following vulnerability has been resolved:

    md: raid1: fix potential OOB in raid1_remove_disk() (CVE-2023-53722)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: csum: Fix OoB access in IP checksum code for negative lengths (CVE-2023-53726)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fq_pie: avoid stalls in fq_pie_timer() (CVE-2023-53727)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Free released resource after coalescing (CVE-2023-53743)

    In the Linux kernel, the following vulnerability has been resolved:

    net: deal with integer overflows in kmalloc_reserve() (CVE-2023-53752)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: api - Use work queue in crypto_destroy_instance (CVE-2023-53799)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (CVE-2023-53817)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). (CVE-2023-53825)

    In the Linux kernel, the following vulnerability has been resolved:

    net: read sk->sk_family once in sk_mc_loop() (CVE-2023-53831)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix skb refcnt race after locking changes (CVE-2023-53836)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5-cache: fix a deadlock in r5l_exit_log() (CVE-2023-53848)

    In the Linux kernel, the following vulnerability has been resolved:

    of: overlay: Call of_changeset_init() early (CVE-2023-53856)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: don't attempt to queue IO under RCU protection (CVE-2023-53860)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: correct grp validation in ext4_mb_good_group (CVE-2023-53861)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix one memleak in __inet_del_ifa() (CVE-2023-53995)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/sev: Make enc_dec_hypercall() accept a size instead of npages (CVE-2023-53996)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-race around unix_tot_inflight. (CVE-2023-54006)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix possible soft lockup in __audit_inode_child() (CVE-2023-54045)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: Fix memory leak in error path of kcm_sendmsg() (CVE-2023-54112)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: dump vmalloc memory info safely (CVE-2023-54113)

    In the Linux kernel, the following vulnerability has been resolved:

    s390/dcssblk: fix kernel crash with list_add corruption (CVE-2023-54117)

    In the Linux kernel, the following vulnerability has been resolved:

    autofs: fix memory leak of waitqueues in autofs_catatonic_mode (CVE-2023-54134)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: fix cap_migration information leak (CVE-2023-54137)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: core: Fix target_cmd_counter leak (CVE-2023-54154)

    In the Linux kernel, the following vulnerability has been resolved:

    of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() (CVE-2023-54178)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix issue in verifying allow_ptr_leaks (CVE-2023-54181)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix lockdep splat and potential deadlock after failure running delayed items (CVE-2023-54224)

    In the Linux kernel, the following vulnerability has been resolved:

    amba: bus: fix refcount leak (CVE-2023-54230)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: set page extent mapped after read_folio in relocate_one_page (CVE-2023-54253)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: release path before inode lookup during the ino lookup ioctl (CVE-2023-54281)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (CVE-2023-54296)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: typec: bus: verify partner exists in typec_altmode_attention (CVE-2023-54299)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
303406	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0962-1)	Nessus	SuSE Local Security Checks	critical
302607	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2026-1537)	Nessus	Huawei Local Security Checks	high
302543	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2026-1557)	Nessus	Huawei Local Security Checks	high
302405	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1313)	Nessus	Huawei Local Security Checks	high
302380	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1339)	Nessus	Huawei Local Security Checks	high
301628	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1280)	Nessus	Huawei Local Security Checks	high
301595	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1244)	Nessus	Huawei Local Security Checks	high
278538	Linux Distros Unpatched Vulnerability : CVE-2023-53817	Nessus	Misc.	medium
183265	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-041 (ALASKERNEL-5.10-2023-041)	Nessus	Amazon Linux Local Security Checks	high
182660	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-053 (ALASKERNEL-5.4-2023-053)	Nessus	Amazon Linux Local Security Checks	high
182654	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-027 (ALASKERNEL-5.15-2023-027)	Nessus	Amazon Linux Local Security Checks	high
182628	Amazon Linux 2 : kernel, --advisory ALAS2-2023-2264 (ALAS-2023-2264)	Nessus	Amazon Linux Local Security Checks	high
182458	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-356)	Nessus	Amazon Linux Local Security Checks	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-53817

medium

Tenable Plugins

critical

high

high

high

high

high

high

medium

high

high

high

high

high

high