The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5091 advisory.

  - kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)

  - kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

  - kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE     (CVE-2023-3610)

  - kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

  - kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

  - kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free     (CVE-2023-4147)

  - hw: amd: Cross-Process Information Leak (CVE-2023-20593)

  - kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102)

  - kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248)

  - kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 9 : kernel-rt (RHSA-2023:5091)

high Nessus Plugin ID 181283

Version 1.2

Version 1.1

Version 1.0

Version 1.0

Version 1.2 Apr 28, 2024, 2:25 PM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.1 Jan 26, 2024, 11:18 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401262318
Version 1.0 Jan 26, 2024, 9:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401262100
Version 1.0 Sep 12, 2023, 10:01 PM New Plugin Feed: 202309122201