The version of kernel installed on the remote host is prior to 4.14.294-150.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1636 advisory.

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace. A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. (CVE-2021-4159)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

  - It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old     filter from the hashtable before freeing it if its handle had the value 0. (CVE-2022-2588)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges. (CVE-2022-36123)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free. (CVE-2022-40307)

  - An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw     exists within the processing of seg6 attributes. The issue results from the improper validation of user-     supplied data, which can result in a read past the end of an allocated buffer. This flaw allows a     privileged local user to disclose sensitive information on affected installations of the Linux kernel.
    (CVE-2023-2860)

  - A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-23816)     (CVE-2022-28693)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux AMI : kernel (ALAS-2022-1636)

high Nessus Plugin ID 165986

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.4

Version 1.3

Version 1.6 Feb 7, 2024, 4:20 PM Exploit attributes ("Exploit framework core" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available". "Exploited by malware" set to "True") Plugin Feed: 202402071620
Version 1.5 Feb 6, 2024, 12:33 PM Exploit attributes ("Exploit framework core" changed from "True" to none. "Exploited by malware" changed from "True" to none. "Exploitability ease" changed from "Exploits are available" to "No known exploits are available") CVE (set "CVE" coverage to "CVE-2021-4159,CVE-2021-33655,CVE-2022-1462,CVE-2022-1679,CVE-2022-2153,CVE-2022-2588,CVE-2022-2663,CVE-2022-28693,CVE-2022-29901,CVE-2022-3028,CVE-2022-36123,CVE-2022-36879,CVE-2022-36946,CVE-2022-39188,CVE-2022-40307,CVE-2023-2860") Detection (updated detection logic) Plugin metadata Plugin Feed: 202402061233
Version 1.5 Feb 7, 2024, 2:22 PM Exploit attributes ("Exploited by malware" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202402071422
Version 1.4 Jan 12, 2023, 6:19 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202301121819
Version 1.4 Feb 6, 2024, 10:48 AM Exploit attributes ("Exploited by malware" changed from "True" to none) Detection (updated detection logic) Plugin metadata Exploit attributes ("Exploitability ease" changed from "Exploits are available" to "No known exploits are available") Exploit attributes ("Exploit framework core" changed from "True" to none) CVE (set "CVE" coverage to "CVE-2021-4159,CVE-2021-33655,CVE-2022-1462,CVE-2022-1679,CVE-2022-2153,CVE-2022-2588,CVE-2022-2663,CVE-2022-28693,CVE-2022-29901,CVE-2022-3028,CVE-2022-36123,CVE-2022-36879,CVE-2022-36946,CVE-2022-39188,CVE-2022-40307,CVE-2023-2860") Plugin Feed: 202402061048
Version 1.3 Oct 11, 2022, 2:45 PM Exploit attributes Plugin Feed: 202210111445