The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6080-1 advisory.

  - When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the     sibling thread after an SMT mode switch potentially resulting in information disclosure. (CVE-2022-27672)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak. (CVE-2023-1513)

  - In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input     validation. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-257685302References: Upstream kernel (CVE-2023-20938)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-     after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order     for an attacker to exploit this, the system must have netrom routing configured or the attacker must have     the CAP_NET_ADMIN capability. (CVE-2023-32269)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6080-1)

high Nessus Plugin ID 175883

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Jan 10, 2024, 8:45 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202401100845
Version 1.1 Oct 21, 2023, 3:09 AM Detection Exploit attributes ("Exploit available" set to "False") Plugin metadata Plugin Feed: 202310210309
Version 1.0 May 17, 2023, 5:08 AM New Plugin Feed: 202305170508