The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5728-3 advisory.

  - In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race     condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-237540956References: Upstream kernel (CVE-2022-20422)

  - A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

  - A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function     security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use     this flaw to crash the system or potentially escalate their privileges on the system. (CVE-2022-2978)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue     is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation     leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the     identifier assigned to this vulnerability. (CVE-2022-3635)

  - drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information     from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
    (CVE-2022-40768)

  - mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through     5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and     potentially execute code. (CVE-2022-42719)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS : Linux kernel (GCP) vulnerabilities (USN-5728-3)

high Nessus Plugin ID 168282

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.6 Jan 10, 2024, 8:45 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202401100845
Version 1.5 Jan 9, 2024, 6:56 PM Plugin metadata Detection (updated detection logic) Plugin Feed: 202401091856
Version 1.5 Oct 16, 2023, 7:25 PM CVE (set "CVE" coverage to "CVE-2022-2153,CVE-2022-2978,CVE-2022-3028,CVE-2022-3625,CVE-2022-3635,CVE-2022-20422,CVE-2022-29901,CVE-2022-40768,CVE-2022-41222,CVE-2022-42703,CVE-2022-42719") Detection Plugin metadata Plugin Feed: 202310161925
Version 1.4 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.3 Nov 30, 2022, 4:19 PM Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202211301619
Version 1.2 Nov 30, 2022, 5:52 AM New Plugin Feed: 202211300552