远程 Rocky Linux 8 主机上安装的多个程序包受到 RLSA-2024:3618 公告中提及的多个漏洞影响。

    * 内核：RSA 解密操作中的 Marvin 漏洞边信道泄漏 (CVE-2023-6240)

    * 内核：vhost/vhost.c:vhost_new_msg() 中存在信息泄露 (CVE-2024-0340)

    * 内核：不受信任的 VMM 可触发 int80 syscall 处理 (CVE-2024-25744)

    * 内核：i2c：i801：修复区块进程调用事务 (CVE-2024-26593)

    * 内核：pvrusb2：修复上下文断开连接时发生的释放后使用漏洞 (CVE-2023-52445)

    * 内核：x86/fpu：停止依赖用户空间以防止 xsave 缓冲区中的信息出错，导致无限循环 (CVE-2024-26603)

    * 内核：i2c 中存在释放后使用漏洞 (CVE-2019-25162)

    * 内核：i2c：验证 compat ioctl 中的用户数据 (CVE-2021-46934)

    * 内核：media：dvbdev：修复 dvb_media_device_free() 中的内存泄漏 (CVE-2020-36777)

    * 内核：usb: hub：防止访问未初始化的 BOS 描述符 (CVE-2023-52477)

    * 内核：mtd：需要 locking 和 badblock ioctls 的写入权限 (CVE-2021-47055)

    * 内核：net/smc：修复 SMC-D connection dump 中的非法 rmb_desc 访问 (CVE-2024-26615)

    * 内核：vt：修复删除缓冲区中的字符时会发生内存重叠的问题 (CVE-2022-48627)

    * 内核：raid5_cache_count 中存在整数溢出漏洞 (CVE-2024-23307)

    * 内核：media: uvcvideo：uvc_query_v4l2_menu() 中存在越界读取漏洞 (CVE-2023-52565)

    * 内核：net：bridge：br_handle_frame_finish() 中的 data-races 包含数据争用问题 (CVE-2023-52578)

    * 内核：net: usb: smsc75xx：修复 __smsc75xx_read_reg 中的 uninit-value 访问漏洞 (CVE-2023-52528)

    * 内核：platform/x86：think-lmi：修复引用泄漏问题 (CVE-2023-52520)

    * 内核：RDMA/siw：修复连接失败处理漏洞 (CVE-2023-52513)

    * 内核：pid：初始化 `cad_pid` 时引用 (CVE-2021-47118)

    - 内核：net/sched：act_ct：修复 ooo frags 上的 skb 泄漏和崩溃问题 (CVE-2023-52610)

    * 内核：netfilter：nf_tables：取消绑定超时的匿名集时，将集标记为死集 (CVE-2024-26643)

    * 内核：netfilter：nf_tables：禁止为匿名集添加超时标记 (CVE-2024-26642)

    * 内核：i2c：i801：不要在总线重置时生成中断 (CVE-2021-47153)

    * 内核：xhci：正确处理 isoc Babble 和缓冲区溢出事件 (CVE-2024-26659)

    * 内核：hwmon：(coretemp) 修复越界内存访问漏洞 (CVE-2024-26664)

    * 内核：wifi: mac80211：修复启用 fast-xmit 时的争用条件问题 (CVE-2024-26779)

    * 内核：RDMA/srpt：支持指定 srpt_service_guid 参数 (CVE-2024-26744)

    * 内核：RDMA/qedr：修复 qedr_create_user_qp 错误流 (CVE-2024-26743)

    * 内核：tty：tty_buffer：修复 flush_to_ldisc 中的 softlockup (CVE-2021-47185)

    * 内核：do_sys_name_to_handle()：使用 kzalloc() 修复 kernel-infoleak (CVE-2024-26901)

    * 内核：RDMA/srpt：在 srpt 设备完全设置之前，不要注册事件处理程序 (CVE-2024-26872)

    * 内核：usb: ulpi：修复 debugfs 目录泄漏问题 (CVE-2024-26919)

    * 内核：usb: xhci：在 xhci_map_urb_for_dma 中添加错误处理 (CVE-2024-26964)

    * 内核：USB: core：修复 usb_deauthorize_interface() 中的死锁 (CVE-2024-26934)

    * 内核：USB：core：修复端口禁用 sysfs 属性中的死锁 (CVE-2024-26933)

    * 内核：fs: sysfs：修复 sysfs_break_active_protection() 中的引用泄漏问题 (CVE-2024-26993)

    * 内核：fat：修复 nostale filehandles 存在未初始化域问题 (CVE-2024-26973)

    * 内核：USB：usb-storage：防止 isd200_ata_command 中的除 0 错误 (CVE-2024-27059)

    * 内核：net:emac/emac-mac：修复 emac_mac_tx_buf_send 中的释放后使用漏洞 (CVE-2021-47013)

    * 内核：net: usb：修复 smsc75xx_bind 中的内存泄漏问题 (CVE-2021-47171)

    * 内核：powerpc/pseries：修复 papr_get_attr() 中潜在的内存泄漏问题 (CVE-2022-48669)

    * 内核：uio：修复 uio_open 中的释放后使用漏洞 (CVE-2023-52439)

    * 内核：wifi：ath9k：修复 ath9k_htc_txstatus() 中潜在的 array-index-out-of-bounds 读取问题 (CVE-2023-52594)

    * 内核：wifi：rt2x00：硬件重置时重新启动信标队列 (CVE-2023-52595)

Tenable 已直接从 Rocky Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3618 advisory.

    * kernel: Marvin vulnerability side-channel leakage in the RSA decryption     operation (CVE-2023-6240)
    * kernel: Information disclosure in vhost/vhost.c:vhost_new_msg()     (CVE-2024-0340)
    * kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)
    * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
    * kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)
    * kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer     that cause loop forever (CVE-2024-26603)
    * kernel: use after free in i2c (CVE-2019-25162)
    * kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)
    * kernel: media: dvbdev: Fix memory leak in dvb_media_device_free()     (CVE-2020-36777)
    * kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors     (CVE-2023-52477)
    * kernel: mtd: require write permissions for locking and badblock ioctls     (CVE-2021-47055)
    * kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump     (CVE-2024-26615)
    * kernel: vt: fix memory overlapping when deleting chars in the buffer     (CVE-2022-48627)
    * kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)
    * kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu()     (CVE-2023-52565)
    * kernel: net: bridge: data races indata-races in br_handle_frame_finish()     (CVE-2023-52578)
    * kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg     (CVE-2023-52528)
    * kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)
    * kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)
    * kernel: pid: take a reference when initializing `cad_pid` (CVE-2021-47118)
    * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags     (CVE-2023-52610)
    * kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set     with timeout (CVE-2024-26643)
    * kernel: netfilter: nf_tables: disallow anonymous set with timeout flag     (CVE-2024-26642)
    * kernel: i2c: i801: Don't generate an interrupt on bus reset     (CVE-2021-47153)
    * kernel: xhci: handle isoc Babble and Buffer Overrun events properly     (CVE-2024-26659)
    * kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)
    * kernel: wifi: mac80211: fix race condition on enabling fast-xmit     (CVE-2024-26779)
    * kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter     (CVE-2024-26744)
    * kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)
    * kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc     (CVE-2021-47185)
    * kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak     (CVE-2024-26901)
    * kernel: RDMA/srpt: Do not register event handler until srpt device is fully     setup (CVE-2024-26872)
    * kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)
    * kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)
    * kernel: USB: core: Fix deadlock in usb_deauthorize_interface()     (CVE-2024-26934)
    * kernel: USB: core: Fix deadlock in port disable sysfs attribute     (CVE-2024-26933)
    * kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection()     (CVE-2024-26993)
    * kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)
    * kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command     (CVE-2024-27059)
    * kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)
    * kernel: net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)
    * kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() (CVE-2022-48669)
    * kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
    * kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()     (CVE-2023-52594)
    * kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.129-62.227. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-004 advisory.

    A flaw was found in the Linux kernels implementation of wifi fragmentation handling. An attacker with the     ability to transmit within the wireless transmission range of an access point can abuse a flaw where     previous contents of wifi fragments can be unintentionally transmitted to another device. (CVE-2020-24586)

    A flaw was found in the Linux kernel's WiFi implementation. An attacker within the wireless range can     abuse a logic flaw in the WiFi implementation by reassembling packets from multiple fragments under     different keys, treating them as valid. This flaw allows an attacker to send a fragment under an incorrect     key, treating them as a valid fragment under the new key. The highest threat from this vulnerability is to     confidentiality. (CVE-2020-24587)

    A flaw was found in the Linux kernels wifi implementation. An attacker within wireless broadcast range can     inject custom data into the wireless communication circumventing checks on the data.  This can cause the     frame to pass checks and be considered a valid frame of a different type. (CVE-2020-24588)

    Frames used for authentication and key management between the AP and connected clients.  Some clients may     take these redirected frames masquerading as control mechanisms from the AP. (CVE-2020-26139)

    A vulnerability was found in Linux kernel's WiFi implementation.  An attacker within wireless range can     inject a control packet fragment where the kernel does not verify the Message Integrity Check     (authenticity) of fragmented TKIP frames. (CVE-2020-26141)

    A flaw was found in ath10k_htt_rx_proc_rx_frag_ind_hl in drivers/net/wireless/ath/ath10k/htt_rx.c in the     Linux kernel WiFi implementations, where it accepts a second (or subsequent) broadcast fragments even when     sent in plaintext and then process them as full unfragmented frames. The highest threat from this     vulnerability is to integrity. (CVE-2020-26145)

    A flaw was found in ieee80211_rx_h_defragment in net/mac80211/rx.c in the Linux Kernel's WiFi     implementation. This vulnerability can be abused to inject packets or exfiltrate selected fragments when     another device sends fragmented frames, and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
    The highest threat from this vulnerability is to integrity. (CVE-2020-26147)

    A flaw was found in the Linux kernel in certs/blacklist.c, When signature entries for EFI_CERT_X509_GUID     are contained in the Secure Boot Forbidden Signature Database, the entries are skipped. This can cause a     security threat and breach system integrity, confidentiality and even lead to a denial of service problem.
    (CVE-2020-26541)

    A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing (SSP),     Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable     to an impersonation attack where an active attacker can impersonate the initiating device without any     previous knowledge. (CVE-2020-26558)

    A flaw was found in the Linux kernel. Improper access control in BlueZ may allow an authenticated user to     potentially enable information disclosure via adjacent access. The highest threat from this vulnerability     is to data confidentiality and integrity. (CVE-2021-0129)

    A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VM_IO|VM_PFNMAP     VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest.
    This flaw allows users who can start and control a VM to read/write random pages of memory, resulting in     local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity,     and system availability. (CVE-2021-22543)

    A flaw was found in the Linux kernel's handling of the removal of Bluetooth HCI controllers. This flaw     allows an attacker with a local account to exploit a race condition, leading to corrupted memory and     possible privilege escalation. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-32399)

    A use-after-free flaw was found in hci_send_acl in the bluetooth host controller interface (HCI) in Linux     kernel, where a local attacker with an access rights could cause a denial of service problem on the system     The issue results from the object hchan, freed in hci_disconn_loglink_complete_evt, yet still used in     other places. The highest threat from this vulnerability is to data integrity, confidentiality and system     availability. (CVE-2021-33034)

    The canbus filesystem in the Linux kernel contains an information leak of kernel memory to devices on the     CAN bus network link layer.  An attacker with the ability to dump messages on the CAN bus is able to learn     of uninitialized stack values by dumbing messages on the can bus. (CVE-2021-34693)

    An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux     kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a     system crash or a leak of internal kernel information. The highest threat from this vulnerability is to     system availability. (CVE-2021-3506)

    A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. (CVE-2021-3564)

    A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in     the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call     hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(),     hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system     or escalate their privileges on the system. (CVE-2021-3573)

    A flaw was found in the Linux kernels NFC implementation, A NULL pointer dereference and BUG leading to a     denial of service can be triggered by a local unprivileged user causing a kernel panic. (CVE-2021-38208)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: fix info leak in hid_submit_ctrl

    In hid_submit_ctrl(), the way of calculating the report length doesn'ttake into account that report->size     can be zero. When running thesyzkaller reproducer, a report of size 0 causes hid_submit_ctrl) tocalculate     transfer_buffer_length as 16384. When this urb is passed tothe usb core layer, KMSAN reports an info leak     of 16384 bytes.

    To fix this, first modify hid_report_len() to account for the zeroreport size case by using DIV_ROUND_UP     for the division. Then, call itfrom hid_submit_ctrl(). (CVE-2021-46906)

    In the Linux kernel, the following vulnerability has been resolved:

    dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (CVE-2021-46938)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: properly indicate failure when ending a failed write request

    This patch addresses a data corruption bug in raid1 arrays using bitmaps.Without this fix, the bitmap bits     for the failed I/O end up being cleared.

    Since we are in the failure leg of raid1_end_write_request, the requesteither needs to be retried     (R1BIO_WriteError) or failed (R1BIO_Degraded). (CVE-2021-46950)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: efi: Use local variable for calculating final log size (CVE-2021-46951)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (CVE-2021-46953)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: fix stack OOB read while fragmenting IPv4 packets (CVE-2021-46955)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix memory leak in virtio_fs_probe() (CVE-2021-46956)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: Fix use-after-free with devm_spi_alloc_* (CVE-2021-46959)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Return correct error code from smb2_get_enc_key (CVE-2021-46960)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Do not enable irqs when handling spurious interrups (CVE-2021-46961)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() (CVE-2021-46963)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: Fix NULL pointer in flush_workqueue (CVE-2021-46981)

    In the Linux kernel, the following vulnerability has been resolved:

    kyber: fix out of bounds access when preempted (CVE-2021-46984)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: scan: Fix a memory leak in an error handling path (CVE-2021-46985)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix use-after-free in i40e_client_subtask() (CVE-2021-46991)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: avoid overflows in nft_hash_buckets() (CVE-2021-46992)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix out-of-bound access in uclamp (CVE-2021-46993)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: do asoc update earlier in sctp_sf_do_dupcook_a (CVE-2021-46999)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix inode leak on getattr error in __fh_to_dentry (CVE-2021-47000)

    In the Linux kernel, the following vulnerability has been resolved:

    ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook (CVE-2021-47006)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Only allow init netns to set default tcp cong to a restricted algo (CVE-2021-47010)

    In the Linux kernel, the following vulnerability has been resolved:

    net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Fix RX consumer index logic in the error path. (CVE-2021-47015)

    In the Linux kernel, the following vulnerability has been resolved:

    bus: qcom: Put child node before return (CVE-2021-47054)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: set debugfs_name to NULL after it is freed (CVE-2021-47058)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Stop looking for coalesced MMIO zones if the bus is destroyed (CVE-2021-47060)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Fix a memory leak in error handling paths (CVE-2021-47071)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Clear all QP fields if creation failed (CVE-2021-47078)

    In the Linux kernel, the following vulnerability has been resolved:

    neighbour: allow NUD_NOARP entries to be forced GCed (CVE-2021-47109)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Disable kvmclock on all CPUs on shutdown (CVE-2021-47110)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Teardown PV features on boot CPU as well (CVE-2021-47112)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed (CVE-2021-47117)

    In the Linux kernel, the following vulnerability has been resolved:

    pid: take a reference when initializing `cad_pid` (CVE-2021-47118)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: magicmouse: fix NULL-deref on disconnect (CVE-2021-47120)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (CVE-2021-47126)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: skip expectations for confirmed conntrack (CVE-2021-47129)

    In the Linux kernel, the following vulnerability has been resolved:

    cxgb4: avoid accessing registers when clearing filters (CVE-2021-47138)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix a use-after-free (CVE-2021-47142)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd/amdgpu: fix refcount leak (CVE-2021-47144)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not BUG_ON in link_to_fixup_dir (CVE-2021-47145)

    In the Linux kernel, the following vulnerability has been resolved:

    mld: fix panic in mld_newpack() (CVE-2021-47146)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: fix a crash if ->get_sset_count() fails (CVE-2021-47159)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: skb_linearize the head skb when reassembling msgs (CVE-2021-47162)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: wait and exit until all work queues are done (CVE-2021-47163)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() (CVE-2021-47166)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (CVE-2021-47167)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: fix an incorrect limit in filelayout_decode_layout() (CVE-2021-47168)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: usbfs: Don't WARN about excessively large memory allocations (CVE-2021-47170)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix sysfs leak in alloc_iommu() (CVE-2021-47177)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst refcnt when egressing (CVE-2021-47222)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst null pointer dereference (CVE-2021-47223)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Immediately reset the MMU context when the SMM flag is cleared (CVE-2021-47230)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in ip_mc_add1_src (CVE-2021-47238)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: synproxy: Fix out of bounds when parsing TCP options (CVE-2021-47245)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix page reclaim for dead peer hairpin (CVE-2021-47246)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: fix race between close() and udp_abort() (CVE-2021-47248)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: fix memory leak in rds_recvmsg (CVE-2021-47249)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in netlbl_cipsov4_add_std (CVE-2021-47250)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix use-after-free in gfs2_glock_shrink_scan (CVE-2021-47254)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: LAPIC: Restore guard to prevent illegal APIC register access (CVE-2021-47255)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: make sure wait for page writeback in memory_failure (CVE-2021-47256)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix error handling of scsi_host_alloc() (CVE-2021-47258)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix use-after-free in nfs4_init_client() (CVE-2021-47259)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a potential NULL dereference in nfs_get_client() (CVE-2021-47260)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/mlx5: Fix initializing CQ fragments buffer (CVE-2021-47261)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message (CVE-2021-47262)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ipoib: Fix warning caused by destroying non-initial netns (CVE-2021-47266)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Correct the length check which causes memory corruption (CVE-2021-47274)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Do not blindly read the ip address in ftrace_bug() (CVE-2021-47276)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: avoid speculation-based attacks from out-of-range memslot accesses (CVE-2021-47277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix use-after-free read in drm_getunique() (CVE-2021-47280)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.238-182.421. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1685 advisory.

    A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing (SSP),     Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable     to an impersonation attack where an active attacker can impersonate the initiating device without any     previous knowledge. (CVE-2020-26558)

    A flaw was found in the Linux kernel. Improper access control in BlueZ may allow an authenticated user to     potentially enable information disclosure via adjacent access. The highest threat from this vulnerability     is to data confidentiality and integrity. (CVE-2021-0129)

    A denial-of-service (DoS) flaw was identified  in the Linux kernel due to an incorrect memory barrier in     xt_replace_table in net/netfilter/x_tables.c in the netfilter subsystem. (CVE-2021-29650)

    A flaw was found in the Linux kernel's handling of the removal of Bluetooth HCI controllers. This flaw     allows an attacker with a local account to exploit a race condition, leading to corrupted memory and     possible privilege escalation. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-32399)

    A use-after-free flaw was found in hci_send_acl in the bluetooth host controller interface (HCI) in Linux     kernel, where a local attacker with an access rights could cause a denial of service problem on the system     The issue results from the object hchan, freed in hci_disconn_loglink_complete_evt, yet still used in     other places. The highest threat from this vulnerability is to data integrity, confidentiality and system     availability. (CVE-2021-33034)

    In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because     of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a     side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

    A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. (CVE-2021-3564)

    A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in     the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call     hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(),     hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system     or escalate their privileges on the system. (CVE-2021-3573)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: fix info leak in hid_submit_ctrl

    In hid_submit_ctrl(), the way of calculating the report length doesn'ttake into account that report->size     can be zero. When running thesyzkaller reproducer, a report of size 0 causes hid_submit_ctrl) tocalculate     transfer_buffer_length as 16384. When this urb is passed tothe usb core layer, KMSAN reports an info leak     of 16384 bytes.

    To fix this, first modify hid_report_len() to account for the zeroreport size case by using DIV_ROUND_UP     for the division. Then, call itfrom hid_submit_ctrl(). (CVE-2021-46906)

    In the Linux kernel, the following vulnerability has been resolved:

    dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (CVE-2021-46938)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: properly indicate failure when ending a failed write request

    This patch addresses a data corruption bug in raid1 arrays using bitmaps.Without this fix, the bitmap bits     for the failed I/O end up being cleared.

    Since we are in the failure leg of raid1_end_write_request, the requesteither needs to be retried     (R1BIO_WriteError) or failed (R1BIO_Degraded). (CVE-2021-46950)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (CVE-2021-46953)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: fix stack OOB read while fragmenting IPv4 packets (CVE-2021-46955)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: Fix use-after-free with devm_spi_alloc_* (CVE-2021-46959)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Return correct error code from smb2_get_enc_key (CVE-2021-46960)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: scan: Fix a memory leak in an error handling path (CVE-2021-46985)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: avoid overflows in nft_hash_buckets() (CVE-2021-46992)

    In the Linux kernel, the following vulnerability has been resolved:

    ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook (CVE-2021-47006)

    In the Linux kernel, the following vulnerability has been resolved:

    net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

    In the Linux kernel, the following vulnerability has been resolved:

    bus: qcom: Put child node before return (CVE-2021-47054)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Clear all QP fields if creation failed (CVE-2021-47078)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed (CVE-2021-47117)

    In the Linux kernel, the following vulnerability has been resolved:

    pid: take a reference when initializing `cad_pid` (CVE-2021-47118)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix a use-after-free (CVE-2021-47142)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not BUG_ON in link_to_fixup_dir (CVE-2021-47145)

    In the Linux kernel, the following vulnerability has been resolved:

    mld: fix panic in mld_newpack() (CVE-2021-47146)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: skb_linearize the head skb when reassembling msgs (CVE-2021-47162)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() (CVE-2021-47166)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: fix an incorrect limit in filelayout_decode_layout() (CVE-2021-47168)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix sysfs leak in alloc_iommu() (CVE-2021-47177)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst null pointer dereference (CVE-2021-47223)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in ip_mc_add1_src (CVE-2021-47238)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: synproxy: Fix out of bounds when parsing TCP options (CVE-2021-47245)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: fix race between close() and udp_abort() (CVE-2021-47248)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: fix memory leak in rds_recvmsg (CVE-2021-47249)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in netlbl_cipsov4_add_std (CVE-2021-47250)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix use-after-free in gfs2_glock_shrink_scan (CVE-2021-47254)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: make sure wait for page writeback in memory_failure (CVE-2021-47256)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix error handling of scsi_host_alloc() (CVE-2021-47258)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix use-after-free in nfs4_init_client() (CVE-2021-47259)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a potential NULL dereference in nfs_get_client() (CVE-2021-47260)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Correct the length check which causes memory corruption (CVE-2021-47274)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Do not blindly read the ip address in ftrace_bug() (CVE-2021-47276)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: avoid speculation-based attacks from out-of-range memslot accesses (CVE-2021-47277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix use-after-free read in drm_getunique() (CVE-2021-47280)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
200609	Rocky Linux 8：内核更新（中危）(RLSA-2024:3618)	Nessus	Rocky Linux Local Security Checks	6/14/2024	9/9/2024	high
200115	AlmaLinux 8 : kernel update (Medium) (ALSA-2024:3618)	Nessus	Alma Linux Local Security Checks	6/5/2024	9/9/2024	high
160440	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-004)	Nessus	Amazon Linux Local Security Checks	5/2/2022	6/23/2025	high
151793	Amazon Linux 2 : kernel (ALAS-2021-1685)	Nessus	Amazon Linux Local Security Checks	7/16/2021	5/22/2025	high

Detections

Analytics

Plugins Search

high

high

high

high