The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
    (CVE-2021-38578)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1921-1 advisory.

  - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
    (CVE-2021-38578)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1940-1 advisory.

  - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
    (CVE-2021-38578)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
    (CVE-2021-38578)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2165 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    * edk2: integer underflow in SmmEntryPoint function leads to potential SMM privilege escalation     (CVE-2021-38578)

    * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)

    * openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)

    * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2165 advisory.

    - Resolves: bz#2164534       (CVE-2023-0286 edk2: openssl: X.400 address type confusion in X.509 GeneralName [rhel-9])
    - Resolves: bz#2164550       (CVE-2022-4304 edk2: openssl: timing attack in RSA Decryption implementation [rhel-9])
    - Resolves: bz#2164565       (CVE-2023-0215 edk2: openssl: use-after-free following BIO_new_NDEF [rhel-9])
    - Resolves: bz#2164583       (CVE-2022-4450 edk2: openssl: double free after calling PEM_read_bio_ex [rhel-9])
    - Resolves: bz#1989857       (CVE-2021-38578 edk2: integer underflow in SmmEntryPoint function leads to potential SMM privilege     escalation [rhel-9.0])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
223999	Linux Distros Unpatched Vulnerability : CVE-2021-38578	Nessus	Misc.	3/5/2025	11/7/2026	critical
174497	SUSE SLES15 Security Update : ovmf (SUSE-SU-2023:1921-1)	Nessus	SuSE Local Security Checks	4/20/2023	1/16/2024	critical
174684	SUSE SLES15 Security Update : ovmf (SUSE-SU-2023:1940-1)	Nessus	SuSE Local Security Checks	4/25/2023	1/16/2024	critical
175734	EulerOS Virtualization 2.10.0 : edk2 (EulerOS-SA-2023-1945)	Nessus	Huawei Local Security Checks	5/15/2023	5/15/2023	critical
175445	RHEL 9 : edk2 (RHSA-2023:2165)	Nessus	Red Hat Local Security Checks	5/12/2023	4/13/2025	critical
175719	Oracle Linux 9 : edk2 (ELSA-2023-2165)	Nessus	Oracle Linux Local Security Checks	5/15/2023	11/1/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical