The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the     packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables     rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
    NOTE: cc00bca was reverted in 5.12. (CVE-2020-36694)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2651-1 advisory.

    The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming     CPU from suspend-to-RAM (bsc#1209779).
    - CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
    - CVE-2021-29650: Fixed an issue where the netfilter subsystem allowed attackers to cause a denial of     service (bsc#1184208).
    - CVE-2020-36694: Fixed an use-after-free issue in netfilter in the packet processing context     (bsc#1211596).
    - CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set     when plugging/disconnecting a malicious USB device (bsc#1208604).
    - CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c     (bsc#1211590).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940 bsc#1211260).
    - CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver     (bsc#1210715).
    - CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact that accept() was also     allowed for a successfully connected AF_NETROM socket (bsc#1211186).
    - CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests     (bsc#1211043).
    - CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
    - CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
    - CVE-2023-23586: Fixed a memory information leak in the io_uring subsystem (bsc#1208474).
    - CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2611-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming     CPU from suspend-to-RAM (bsc#1209779).
    - CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
    - CVE-2021-29650: Fixed an issue where the netfilter subsystem allowed attackers to cause a denial of     service (bsc#1184208).
    - CVE-2020-36694: Fixed an use-after-free issue in netfilter in the packet processing context     (bsc#1211596).
    - CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set     when plugging/disconnecting a malicious USB device (bsc#1208604).
    - CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c     (bsc#1211590).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940).
    - CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver     (bsc#1210715).
    - CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact that accept() was also     allowed for a successfully connected AF_NETROM socket (bsc#1211186).
    - CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests     (bsc#1211043).
    - CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
    - CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
    - CVE-2023-23586: Fixed a memory information leak in the io_uring subsystem (bsc#1208474).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information.(CVE-2023-3268)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation.(CVE-2023-35788)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font-width and     font-height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in     drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based     device.(CVE-2023-33203)

    ** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in     crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check     an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated 'When modifying the block device while it is mounted by the filesystem'     access.(CVE-2023-34256)

    An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the     packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables     rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
    NOTE: cc00bca was reverted in 5.12.(CVE-2020-36694)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was the     duplicate of CVE-2023-31436.(CVE-2023-2248)

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a     reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage.(CVE-2023-2483)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information.(CVE-2023-3268)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation.(CVE-2023-35788)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font-width and     font-height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in     drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based     device.(CVE-2023-33203)

    ** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in     crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check     an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated 'When modifying the block device while it is mounted by the filesystem'     access.(CVE-2023-34256)

    An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the     packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables     rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
    NOTE: cc00bca was reverted in 5.12.(CVE-2020-36694)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was the     duplicate of CVE-2023-31436.(CVE-2023-2248)

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a     reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage.(CVE-2023-2483)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1032 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2022-25636:
    net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges     because of a heap out-of-bounds write. This is related to nf_tables_offload.

    CVE-2020-36694:
    An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the     packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables     rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
    NOTE: cc00bca was reverted in 5.12.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in     drivers/media/pci/dm1105/dm1105.c.(CVE-2023-35824)

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

    CVE-2023-3327 kernel: saa7134: race condition leading to use-after-free in     saa7134_finidev()(CVE-2023-3327)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation.(CVE-2023-35788)

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information.(CVE-2023-3268)

    A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux     Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when     queue_event() fails.(CVE-2023-3159)

    A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak.(CVE-2023-3141)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font-width and     font-height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

    ** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in     crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check     an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated 'When modifying the block device while it is mounted by the filesystem'     access.(CVE-2023-34256)

    A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec-tx_ready.(CVE-2023-1075)

    An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the     packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables     rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
    NOTE: cc00bca was reverted in 5.12.(CVE-2020-36694)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(fepriv-sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(fepriv-sem) may block the process.(CVE-2023-31084)

    ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was the     duplicate of CVE-2023-31436.(CVE-2023-2248)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the 'access_ok' check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond     commit74e19ef0ff8061ef55957c3abd71614ef0f42f47(CVE-2023-0459)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    An out-of-bounds memory access flaw was found in the Linux kernels XFS file system in how a user     restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system.(CVE-2023-2124)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication.(CVE-2023-2002)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1578 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362)

    * kernel: memory leak in sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c (CVE-2019-18811)

    * kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver     (CVE-2019-19523)

    * kernel: use-after-free bug caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver     (CVE-2019-19528)

    * kernel: possible out of bounds write in kbd_keycode of keyboard.c (CVE-2020-0431)

    * kernel: DoS by corrupting mountpoint reference counter (CVE-2020-12114)

    * kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c (CVE-2020-12464)

    * kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

    * kernel: Use After Free vulnerability in cgroup BPF component (CVE-2020-14356)

    * kernel: NULL pointer dereference in serial8250_isa_init_ports function in     drivers/tty/serial/8250/8250_core.c (CVE-2020-15437)

    * kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

    * kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

    * kernel: incomplete permission checking for access to rbd devices (CVE-2020-25284)

    * kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c (CVE-2020-25285)

    * kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read     overflow (CVE-2020-25643)

    * kernel: perf_event_parse_addr_filter memory (CVE-2020-25704)

    * kernel: use-after-free in kernel midi subsystem (CVE-2020-27786)

    * kernel: child process is able to access parent mm through hfi dev file handle (CVE-2020-27835)

    * kernel: slab-out-of-bounds read in fbcon (CVE-2020-28974)

    * kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent (CVE-2020-35508)

    * kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations (CVE-2020-36322)

    * kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege     (CVE-2021-0342)

    * kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in     drivers/media/usb/gspca/ov519.c (CVE-2020-11608)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1739 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362)

    * kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver     (CVE-2019-19523)

    * kernel: use-after-free bug caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver     (CVE-2019-19528)

    * kernel: possible out of bounds write in kbd_keycode of keyboard.c (CVE-2020-0431)

    * kernel: DoS by corrupting mountpoint reference counter (CVE-2020-12114)

    * kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c (CVE-2020-12464)

    * kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

    * kernel: Use After Free vulnerability in cgroup BPF component (CVE-2020-14356)

    * kernel: NULL pointer dereference in serial8250_isa_init_ports function in     drivers/tty/serial/8250/8250_core.c (CVE-2020-15437)

    * kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

    * kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

    * kernel: incomplete permission checking for access to rbd devices (CVE-2020-25284)

    * kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c (CVE-2020-25285)

    * kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read     overflow (CVE-2020-25643)

    * kernel: perf_event_parse_addr_filter memory (CVE-2020-25704)

    * kernel: use-after-free in kernel midi subsystem (CVE-2020-27786)

    * kernel: child process is able to access parent mm through hfi dev file handle (CVE-2020-27835)

    * kernel: slab-out-of-bounds read in fbcon (CVE-2020-28974)

    * kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent (CVE-2020-35508)

    * kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege     (CVE-2021-0342)

    * kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in     drivers/media/usb/gspca/ov519.c (CVE-2020-11608)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1025 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2020-36694:
    An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the     packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables     rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
    NOTE: cc00bca was reverted in 5.12.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in     drivers/media/pci/dm1105/dm1105.c.(CVE-2023-35824)

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

    CVE-2023-3327 kernel: saa7134: race condition leading to use-after-free in     saa7134_finidev()(CVE-2023-3327)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation.(CVE-2023-35788)

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information.(CVE-2023-3268)

    A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux     Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when     queue_event() fails.(CVE-2023-3159)

    A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak.(CVE-2023-3141)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font-width and     font-height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

    ** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in     crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check     an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated 'When modifying the block device while it is mounted by the filesystem'     access.(CVE-2023-34256)

    A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec-tx_ready.(CVE-2023-1075)

    An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the     packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables     rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
    NOTE: cc00bca was reverted in 5.12.(CVE-2020-36694)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(fepriv-sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(fepriv-sem) may block the process.(CVE-2023-31084)

    ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was the     duplicate of CVE-2023-31436.(CVE-2023-2248)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the 'access_ok' check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond     commit74e19ef0ff8061ef55957c3abd71614ef0f42f47(CVE-2023-0459)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    An out-of-bounds memory access flaw was found in the Linux kernels XFS file system in how a user     restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system.(CVE-2023-2124)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication.(CVE-2023-2002)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
247509	Linux Distros Unpatched Vulnerability : CVE-2020-36694	Nessus	Misc.	8/10/2025	10/28/2025	medium
177709	SUSE SLES15 Security Update : kernel (SUSE-SU-2023:2651-1)	Nessus	SuSE Local Security Checks	6/28/2023	9/26/2025	high
177546	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2611-1)	Nessus	SuSE Local Security Checks	6/23/2023	9/25/2025	high
179545	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-2614)	Nessus	Huawei Local Security Checks	8/8/2023	9/26/2025	high
188906	EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2023-2957)	Nessus	Huawei Local Security Checks	1/16/2024	9/26/2025	high
239280	TencentOS Server 2: kernel (TSSA-2024:1032)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
179540	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-2584)	Nessus	Huawei Local Security Checks	8/8/2023	9/29/2025	high
149670	RHEL 8 : kernel (RHSA-2021:1578)	Nessus	Red Hat Local Security Checks	5/19/2021	3/6/2025	high
149660	RHEL 8 : kernel-rt (RHSA-2021:1739)	Nessus	Red Hat Local Security Checks	5/19/2021	11/7/2024	high
276220	TencentOS Server 3: kernel (TSSA-2024:1025)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	medium
188959	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2023-2983)	Nessus	Huawei Local Security Checks	1/16/2024	9/29/2025	high

Detections

Analytics

Plugins Search

medium

high

high

high

high

high

high

high

high

medium

high