The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6260-1 advisory.

  - An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for     correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.
    (CVE-2022-48502)

  - On Ubuntu kernels carrying both c914c0e27eb0 and UBUNTU: SAUCE: overlayfs: Skip permission checking for     trusted.overlayfs.* xattrs, an unprivileged user may set privileged extended attributes on the mounted     files, leading them to be set on the upper files without the appropriate security checks. (CVE-2023-2640)

  - A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

  - Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

  - A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

  - Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip     permission checks when calling ovl_do_setxattr on Ubuntu kernels (CVE-2023-32629)

  - A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local     privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a     hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59     (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for     5.15 stable). (CVE-2023-3389)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6260-1)

high Nessus Plugin ID 178946

Version 1.4

Version 1.3

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.4 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin Feed: 202401100845
Version 1.3 Dec 25, 2023, 2:08 PM CVSSv2 score source (changed from "CVE-2023-3389" to "CVE-2023-35001") Plugin Feed: 202312251408
Version 1.3 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin Feed: 202401091856
Version 1.2 Oct 23, 2023, 4:39 PM Exploit attributes ("Exploited by malware" set to "True") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2023-35001" to "CVE-2023-3389") Plugin Feed: 202310231639
Version 1.1 Aug 23, 2023, 4:09 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202308231609
Version 1.0 Jul 27, 2023, 8:18 PM New Plugin Feed: 202307272018