The version of kernel installed on the remote host is prior to 4.14.276-211.499. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2569 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (CVE-2021-47634)

    A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

    A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

    A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcmu: Fix possible page UAF (CVE-2022-49053)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: potential buffer overflow in handling symlinks (CVE-2022-49058)

    In the Linux kernel, the following vulnerability has been resolved:

    veth: Ensure eth header is in skb's linear part (CVE-2022-49066)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix qgroup reserve overflow the qgroup limit (CVE-2022-49075)

    In the Linux kernel, the following vulnerability has been resolved:

    mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) (CVE-2022-49077)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/mempolicy: fix mpol_new leak in shared_policy_replace (CVE-2022-49080)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: Fix five use after free bugs in get_initial_state (CVE-2022-49085)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_console: eliminate anonymous module_init & module_exit (CVE-2022-49100)

    In the Linux kernel, the following vulnerability has been resolved:

    Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: prevent potential spectre v1 gadget (CVE-2022-49122)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (CVE-2022-49145)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (CVE-2022-49155)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: add sanity check on allocation size (CVE-2022-49166)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't BUG if someone dirty pages without asking ext4 first (CVE-2022-49171)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: core: keep irq flags in device_pm_check_callbacks() (CVE-2022-49175)

    In the Linux kernel, the following vulnerability has been resolved:

    af_netlink: Fix shift out of bounds in group mask calculation (CVE-2022-49197)

    In the Linux kernel, the following vulnerability has been resolved:

    power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init (CVE-2022-49224)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: prevent underflow in nfssvc_decode_writeargs() (CVE-2022-49280)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: fix reference counting for struct tpm_chip (CVE-2022-49287)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : kernel (ALAS-2024-2569)

high Nessus Plugin ID 200382

Version 1.10

Version 1.9

Version 1.8

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.10 May 23, 2025, 2:01 AM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202505230201
Version 1.9 May 21, 2025, 4:51 PM CVE (set "CVE" coverage to "CVE-2021-47634,CVE-2022-1011,CVE-2022-1353,CVE-2022-2977,CVE-2022-41858,CVE-2022-49053,CVE-2022-49058,CVE-2022-49066,CVE-2022-49075,CVE-2022-49077,CVE-2022-49080,CVE-2022-49085,CVE-2022-49100,CVE-2022-49111,CVE-2022-49114,CVE-2022-49122,CVE-2022-49145,CVE-2022-49155,CVE-2022-49166,CVE-2022-49171,CVE-2022-49175,CVE-2022-49197,CVE-2022-49224,CVE-2022-49280,CVE-2022-49287,CVE-2023-1637") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 score source (changed from "CVE-2022-2977" to "CVE-2022-49058") Detection (updated detection logic) Exploit attributes ("Exploitability ease" changed from "Exploits are available" to "No known exploits are available") Plugin metadata Plugin Feed: 202505211651
Version 1.8 Apr 11, 2025, 11:54 AM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202504111154
Version 1.4 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202412120955
Version 1.3 Jun 25, 2024, 9:36 AM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202406250936
Version 1.2 Jun 25, 2024, 3:40 AM CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVE (set "CVE" coverage to "CVE-2022-1011,CVE-2022-1353,CVE-2022-2977,CVE-2022-41858,CVE-2023-1637") CVSS metrics ("CVSSv2 score" set to 4.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSSv2 score source (changed from "CVE-2022-2977" to "CVE-2022-1011") CVSSv3 score source (set to "CVE-2022-2977") Detection (updated detection logic) Exploit attributes ("Exploit available" set to "True") Plugin metadata Plugin Feed: 202406250340
Version 1.1 Jun 12, 2024, 8:05 AM New Plugin Feed: 202406120805