The remote Ubuntu 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5759-1 advisory.

  - libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (4 bytes) in __bpf_object__open (called from     bpf_object__open_mem and bpf-object-fuzzer.c). (CVE-2021-45940)

  - libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (8 bytes) in __bpf_object__open (called from     bpf_object__open_mem and bpf-object-fuzzer.c). (CVE-2021-45941)

  - A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the     function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the     argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The     associated identifier of this vulnerability is VDB-211031. (CVE-2022-3533)

  - A vulnerability classified as critical has been found in Linux Kernel. Affected is the function     btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to     use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability     is VDB-211032. (CVE-2022-3534)

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability. (CVE-2022-3606)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Ubuntu 22.04 LTS / 22.10 : LibBPF vulnerabilities (USN-5759-1)

high Nessus Plugin ID 168391

Version 1.3

Version 1.2

Version 1.3 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x)
Version 1.2 Dec 5, 2022, 1:46 PM New