A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-4 advisory.

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible. (CVE-2023-3006)

  - An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated When modifying the block device while it is mounted by the filesystem access.
    (CVE-2023-34256)

  - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

  - A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition. (CVE-2023-4132)

  - Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really     useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides     a certain initial portion of the to be transferred data, these parts are directly translated into what     Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of     length zero, lead to a de-reference of NULL in core networking code. (CVE-2023-46838)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6704-4 advisory.

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of     resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition     on the system. (CVE-2023-32247)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the     catch-all set element is active in the current generation instead of the next generation before freeing     it, but only flags it inactive in the next generation, making it possible to free the element multiple     times, leading to a double free vulnerability. We recommend upgrading past commit     b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7. (CVE-2024-1085)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6704-3 advisory.

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of     resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition     on the system. (CVE-2023-32247)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the     catch-all set element is active in the current generation instead of the next generation before freeing     it, but only flags it inactive in the next generation, making it possible to free the element multiple     times, leading to a double free vulnerability. We recommend upgrading past commit     b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7. (CVE-2024-1085)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6716-1 advisory.

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in     drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane     transaction and nft_set element garbage collection, it is possible to underflow the reference counter     causing a use-after-free vulnerability. We recommend upgrading past commit     3e91b0ebd994635df2346353322ac51ce84ce6d8. (CVE-2023-4244)

  - bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free     because of a bt_sock_ioctl race condition. (CVE-2023-51779)

  - An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-     free because of a vcc_recvmsg race condition. (CVE-2023-51780)

  - An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-     after-free because of a rose_accept race condition. (CVE-2023-51782)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file. (CVE-2024-0340)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-3 advisory.

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible. (CVE-2023-3006)

  - An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated When modifying the block device while it is mounted by the filesystem access.
    (CVE-2023-34256)

  - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

  - A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition. (CVE-2023-4132)

  - Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really     useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides     a certain initial portion of the to be transferred data, these parts are directly translated into what     Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of     length zero, lead to a de-reference of NULL in core networking code. (CVE-2023-46838)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6700-2 advisory.

  - In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could     lead to local escalation of privilege with System execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References:
    Upstream kernel (CVE-2022-20567)

  - An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated When modifying the block device while it is mounted by the filesystem access.
    (CVE-2023-34256)

  - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6704-2 advisory.

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of     resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition     on the system. (CVE-2023-32247)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the     catch-all set element is active in the current generation instead of the next generation before freeing     it, but only flags it inactive in the next generation, making it possible to free the element multiple     times, leading to a double free vulnerability. We recommend upgrading past commit     b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7. (CVE-2024-1085)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6702-2 advisory.

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-2 advisory.

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible. (CVE-2023-3006)

  - An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated When modifying the block device while it is mounted by the filesystem access.
    (CVE-2023-34256)

  - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

  - A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition. (CVE-2023-4132)

  - Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really     useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides     a certain initial portion of the to be transferred data, these parts are directly translated into what     Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of     length zero, lead to a de-reference of NULL in core networking code. (CVE-2023-46838)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6704-1 advisory.

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of     resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition     on the system. (CVE-2023-32247)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the     catch-all set element is active in the current generation instead of the next generation before freeing     it, but only flags it inactive in the next generation, making it possible to free the element multiple     times, leading to a double free vulnerability. We recommend upgrading past commit     b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7. (CVE-2024-1085)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6705-1 advisory.

  - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in     drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw     exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of     resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition     on the system. (CVE-2023-32247)

  - In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in     net/nfc/nci/spi.c. (CVE-2023-46343)

  - An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

  - bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free     because of a bt_sock_ioctl race condition. (CVE-2023-51779)

  - An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-     after-free because of a rose_accept race condition. (CVE-2023-51782)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file. (CVE-2024-0340)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval()     function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes     are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every     iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local     user to cause a denial of service or potentially break NetFilter functionality. (CVE-2024-0607)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the     catch-all set element is active in the current generation instead of the next generation before freeing     it, but only flags it inactive in the next generation, making it possible to free the element multiple     times, leading to a double free vulnerability. We recommend upgrading past commit     b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7. (CVE-2024-1085)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6702-1 advisory.

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-1 advisory.

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible. (CVE-2023-3006)

  - An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated When modifying the block device while it is mounted by the filesystem access.
    (CVE-2023-34256)

  - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

  - A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition. (CVE-2023-4132)

  - Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really     useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides     a certain initial portion of the to be transferred data, these parts are directly translated into what     Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of     length zero, lead to a de-reference of NULL in core networking code. (CVE-2023-46838)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6699-1 advisory.

  - An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6700-1 advisory.

  - In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could     lead to local escalation of privilege with System execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References:
    Upstream kernel (CVE-2022-20567)

  - An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated When modifying the block device while it is mounted by the filesystem access.
    (CVE-2023-34256)

  - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
197057	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1646-1)	Nessus	SuSE Local Security Checks	high
197055	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1643-1)	Nessus	SuSE Local Security Checks	high
197048	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2024:1648-1)	Nessus	SuSE Local Security Checks	high
195662	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195652	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
193083	Ubuntu 14.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6701-4)	Nessus	Ubuntu Local Security Checks	high
192683	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6704-4)	Nessus	Ubuntu Local Security Checks	high
192564	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-6704-3)	Nessus	Ubuntu Local Security Checks	high
192562	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6716-1)	Nessus	Ubuntu Local Security Checks	high
192561	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-6701-3)	Nessus	Ubuntu Local Security Checks	high
192411	Ubuntu 16.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6700-2)	Nessus	Ubuntu Local Security Checks	high
192398	Ubuntu 22.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-6704-2)	Nessus	Ubuntu Local Security Checks	high
192319	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6702-2)	Nessus	Ubuntu Local Security Checks	high
192318	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (GCP) vulnerabilities (USN-6701-2)	Nessus	Ubuntu Local Security Checks	high
192312	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6704-1)	Nessus	Ubuntu Local Security Checks	high
192311	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6705-1)	Nessus	Ubuntu Local Security Checks	high
192292	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6702-1)	Nessus	Ubuntu Local Security Checks	high
192222	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-6701-1)	Nessus	Ubuntu Local Security Checks	high
192221	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-6699-1)	Nessus	Ubuntu Local Security Checks	high
192220	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-6700-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2024-24855

medium

Tenable Plugins

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high