The remote Ubuntu 18.04 ESM / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6417-1 advisory.

  - A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and     bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special     privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel     versions prior to 5.16 rc2. (CVE-2021-4001)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue     could allow a remote user to crash the system. (CVE-2023-3338)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 ESM / 20.04 LTS : Linux kernel vulnerabilities (USN-6417-1)

medium Nessus Plugin ID 182578

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.0

Version 1.2 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin Feed: 202401100845
Version 1.1 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin Feed: 202401091856
Version 1.1 Oct 20, 2023, 5:46 PM CVSS metrics ("CVSSv3 score" changed from 4.1 to 5.5. "CVSSv3 vector" changed from "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N" to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N") CVSSv3 score source (set to "CVE-2023-4194") Plugin Feed: 202310201746
Version 1.0 Oct 5, 2023, 10:06 AM New Plugin Feed: 202310051006
Version 1.0 Oct 20, 2023, 3:51 PM CVSS metrics ("CVSSv3 score" changed from 4.1 to 5.5) CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N" to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N") CVSSv3 score source (set to "CVE-2023-4194") Plugin Feed: 202310201551