The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5255 advisory.

  - kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)

  - Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

  - kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

  - kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

  - kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

  - kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

  - hw: amd: Cross-Process Information Leak (CVE-2023-20593)

  - kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

  - kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : kernel-rt (RHSA-2023:5255)

high Nessus Plugin ID 181632

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Apr 28, 2024, 2:25 PM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.2 Jan 26, 2024, 9:00 PM CVE (set "CVE" coverage to "CVE-2023-1637,CVE-2023-2002,CVE-2023-3090,CVE-2023-3390,CVE-2023-3776,CVE-2023-4004,CVE-2023-20593,CVE-2023-35001,CVE-2023-35788") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202401262100
Version 1.1 Sep 21, 2023, 2:27 PM CVSS metrics ("CVSSv2 score" changed from 6.7 to 6.8. "CVSSv2 vector" changed from "CVSS2#AV:A/AC:L/Au:S/C:P/I:P/A:C" to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C". "CVSSv3 score" changed from 6.8 to 7.8. "CVSSv3 vector" changed from "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H" to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2023-2002" to "CVE-2023-4004") CVSSv3 score source (set to "CVE-2023-4004") CVSSv3 severity (based on CVE-2023-4004, severity increased from "Medium" to "High") Plugin Feed: 202309211427
Version 1.0 Sep 19, 2023, 10:12 PM New Plugin Feed: 202309192212