The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4810-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality     (bsc#1217332).
    - CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
    - CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
    - CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
    - CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host     side of a virtio ring (bsc#1215710).
    - CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames     larger than the MTU (bsc#1216259).
    - CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component     (bsc#1216584).
    - CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create()     (bsc#1216965).
    - CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver     (bsc#1216959).
    - CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2950 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2950 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from     the References section.

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8398:15 advisory.

    * Update the version to 4.18.0-553.el8_10

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.5.6.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.5.6.7 advisory.

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances     where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection     were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other     places in the script where the file names of certificates being hashed were possibly passed to a command     executed through the shell. This script is distributed by some operating systems in a manner where it is     automatically executed. On such operating systems, an attacker could execute arbitrary commands with the     privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the     OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in     OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). (CVE-2022-2068)

  - Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant     code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead     of using a named curve). In those cases it is possible that such a group does not have the cofactor     present. This can occur even where all the parameters match a known named curve. If such a curve is used     then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery     during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability     to time the creation of a large number of signatures where explicit parameters with no co-factor present     are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because     explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL     1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). (CVE-2019-1547)

  - OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as     certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and     is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and     1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a     Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be     '/usr/local'. However, mingw programs are Windows programs, and as such, find themselves looking at sub-     directories of 'C:/usr/local', which may be world writable, which enables untrusted users to modify     OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules,     etc. For OpenSSL 1.0.2, '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows     targets, including Visual C builds. However, some build instructions for the diverse Windows targets on     1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by     this issue. Due to the limited scope of affected deployments this has been assessed as low severity and     therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
    Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
    (CVE-2019-1552)

  - In situations where an attacker receives automated notification of the success or failure of a decryption     attempt an attacker, after sending a very large number of messages to be decrypted, can recover a     CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the     public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a     certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the     correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL     1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). (CVE-2019-1563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12159 advisory.

    - RDMA/irdma: Prevent zero-length STAG registration (Christopher Bednarz) [Orabug: 36155612]     {CVE-2023-25775}
    - netfilter: nf_tables: bail out on mismatching dynset and set expressions (Pablo Neira Ayuso) [Orabug:
    36155544] {CVE-2023-6622}
    - netfilter: nf_tables: remove catchall element in GC sync path (Pablo Neira Ayuso) [Orabug: 36028059]     {CVE-2023-6111}
    - x86/sev: Check for user-space IOIO pointing to kernel space (Joerg Roedel) [Orabug: 35959905]     {CVE-2023-46813}
    - x86/sev: Check IOBM for IOIO exceptions from user-space (Joerg Roedel) [Orabug: 35959905]     {CVE-2023-46813}
    - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi) [Orabug: 35959595]     {CVE-2020-26555}
    - ravb: Fix use-after-free issue in ravb_tx_timeout_work() (Yoshihiro Shimoda) [Orabug: 35959875]     {CVE-2023-35827}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2004 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security fixes:

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

    * kernel: irdma: Improper access control (CVE-2023-25775)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer     dereference (CVE-2020-36558)

    This update also fixes the following bugs:

    * NFS client closes active connection (RHEL-22193)

    * kernel panic at __list_del_entry from smb2_reconnect_server (RHEL-26301)

    * kernel: race condition when call to VT_RESIZEX ioctl and vc_cons[i].d is already NULL, causing a NULL     pointer dereference. (RHEL-28639)

    * kernel: net/sched: sch_hfsc UAF (RHEL-16458)

    * kernel: irdma: Improper access control (RHEL-6299)

    * The message in RHEL 7 ?stack-protector: Kernel stack is corrupted in:? is triggered because     perf_trace_buf_prepare() does not verify that per_cpu array perf_trace_buf has allocated per_cpu buffers     in it. (RHEL-18052)

    * [rhel7] gfs2: Invalid metadata access in punch_hole (RHEL-28785)

    * UDP packets dropped due to SELinux denial (RHEL-27751)

    * Boot fails with kernel panic at acpi_device_hid+0x6 (RHEL-8721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2394 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133,     CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085,     CVE-2024-26582)

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915,     CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)

    * kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)

    * kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)

    * kernel: GC's deletion of an SKB races with unix_stream_read_generic()  leading to UAF (CVE-2023-6531)

    * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size     (CVE-2023-6931)

    * kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)

    * kernel: irdma: Improper access control (CVE-2023-25775)

    * Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)

    * kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)

    * kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl     (CVE-2023-31083)

    * kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193,     CVE-2023-6121, CVE-2023-39194)

    * kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)

    * kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)

    * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)

    * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)

    * kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)

    * kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)

    * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

    * kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)

    * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

    * kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in     function receive_encrypted_standard of client (CVE-2024-0565)

    * kernel: tls: race between async notify and socket close (CVE-2024-26583)

    * kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)

    * kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)

    * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)

    * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

    * kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)

    * kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)

    * kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)

    * kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)

    * kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2394 advisory.

    - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28877 RHEL-28878]     {CVE-2023-52489}
    - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26463 RHEL-26465] {CVE-2024-26586}
    - i2c: i801: Fix block process call transactions (David Arcari) [RHEL-26479 RHEL-26481] {CVE-2024-26593}
    - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23428     RHEL-23429] {CVE-2024-26602}
    - tls: fix use-after-free on failed backlog decryption (Sabrina Dubroca) [RHEL-26410 RHEL-26415]     {CVE-2024-26584}
    - tls: separate no-async decryption request handling from async (Sabrina Dubroca) [RHEL-26410 RHEL-26415]     {CVE-2024-26584}
    - tls: decrement decrypt_pending if no async completion will be called (Sabrina Dubroca) [RHEL-26416     RHEL-26421] {CVE-2024-26583}
    - net: tls: fix use-after-free with partial reads and async decrypt (Sabrina Dubroca) [RHEL-26398     RHEL-26401] {CVE-2024-26582}
    - net: tls: handle backlogging of crypto requests (Sabrina Dubroca) [RHEL-26410 RHEL-26415]     {CVE-2024-26584}
    - tls: fix race between tx work scheduling and socket close (Sabrina Dubroca) [RHEL-26361 RHEL-26363]     {CVE-2024-26585}
    - tls: fix race between async notify and socket close (Sabrina Dubroca) [RHEL-26416 RHEL-26421]     {CVE-2024-26583}
    - net: tls: factor out tls_*crypt_async_wait() (Sabrina Dubroca) [RHEL-26416 RHEL-26421] {CVE-2024-26583}
    - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26500 RHEL-26502]     {CVE-2023-52448}
    - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21687 RHEL-21688]     {CVE-2024-0565}
    - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841} (Audra Mitchell)     [RHEL-20615 RHEL-20617] {CVE-2024-0841}
    - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26242 RHEL-26244]     {CVE-2023-52434}
    - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26242 RHEL-26244]     {CVE-2023-52434}
    - tty: n_gsm: initialize more members at gsm_alloc_mux() (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix race condition in gsmld_write() (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix resource allocation order in gsm_activate_mux() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix race condition in status line change on dead connections (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix flow control handling in tx path (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Debug output allocation must use GFP_ATOMIC (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output() (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix NULL pointer access due to DLCI release (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: name the debug bits (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: replace use of gsm_read_ea() with gsm_read_ea_val() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix missing tty wakeup in convergence layer type 2 (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix wrong signal octets encoding in MSC (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix buffer over-read in gsm_dlci_data() (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong modem processing in convergence layer type 2 (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix user open not possible at responder until initiator open (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: Delete gsmtty open SABM frame when config requester (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix deadlock and link starvation in outgoing data path (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix non flow control frames during mux flow off (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix reset fifo race condition (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix missing explicit ldisc flush (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix deadlock in gsmtty_open() (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: Modify CR,PF bit printk info when config requester (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix SW flow control encoding/handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: add parameters used with parameter negotiation (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix wrong command retry handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: introduce macro for minimal unit size (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix insufficient txframe size (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: introduce gsm_control_command() function (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix invalid use of MSC in advanced option (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong command frame length field encoding (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong tty control line for flow control (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix missing timer to handle stalled links (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: add parameter negotiation support (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix tty registration before control channel open (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix software flow control handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Fix packet data hex dump output (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Don't ignore write return value in gsmld_output() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: name gsm tty device minors (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: stop using alloc_tty_driver (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: don't store semi-state into tty drivers (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - hvsi: don't panic on tty_register_driver failure (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - amiserial: switch rs_table to a single state (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - amiserial: expand 'custom' (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - amiserial: remove serial_* strings (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - amiserial: use memset to zero serial_state (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - Revert 'tty: n_gsm: fix UAF in gsm_cleanup_mux' (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix encoding of command/response bit (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix broken virtual tty handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix missing update of modem controls after DLCI open (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix frame reception handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: clean up indenting in gsm_queue() (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Save dlci address open status when config requester (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: Modify CR,PF bit when config requester (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix UAF in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix wrong DLCI release order (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix mux cleanup after unregister tty device (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix decoupled mux resource (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix restart handling via CLD command (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Modify gsmtty driver register method when config requester (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - netfilter: nf_tables: bail out on mismatching dynset and set expressions (Florian Westphal) [RHEL-19016     RHEL-19017] {CVE-2023-6622}
    - netfilter: nf_tables: check if catch-all set element is active in next generation (Florian Westphal)     [RHEL-23505 RHEL-23511] {CVE-2024-1085}
    - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-23502 RHEL-23508]     {CVE-2024-1086}
    - Bluetooth: Add more enc key size check (Bastien Nocera) [RHEL-19668 RHEL-19669] {CVE-2023-24023}
    - ida: Fix crash in ida_free when the bitmap is empty (Wander Lairson Costa) [RHEL-19683 RHEL-19684]     {CVE-2023-6915}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3711 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3711-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     January 11, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.205-2~deb10u1     CVE ID         : CVE-2021-44879 CVE-2023-5178 CVE-2023-5197 CVE-2023-5717                      CVE-2023-6121 CVE-2023-6531 CVE-2023-6817 CVE-2023-6931                      CVE-2023-6932 CVE-2023-25775 CVE-2023-34324 CVE-2023-35827                      CVE-2023-45863 CVE-2023-46813 CVE-2023-46862 CVE-2023-51780                      CVE-2023-51781 CVE-2023-51782     Debian Bug     : 1032104 1035587 1052304

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2021-44879

        Wenqing Liu reported a NULL pointer dereference in the f2fs         implementation. An attacker able to mount a specially crafted image         can take advantage of this flaw for denial of service.

    CVE-2023-5178

        Alon Zahavi reported a use-after-free flaw in the NVMe-oF/TCP         subsystem in the queue initialization setup, which may result in         denial of service or privilege escalation.

    CVE-2023-5197

        Kevin Rich discovered a use-after-free flaw in the netfilter         subsystem which may result in denial of service or privilege         escalation for a user with the CAP_NET_ADMIN capability in any user         or network namespace.

    CVE-2023-5717

        Budimir Markovic reported a heap out-of-bounds write vulnerability         in the Linux kernel's Performance Events system caused by improper         handling of event groups, which may result in denial of service or         privilege escalation. The default settings in Debian prevent         exploitation unless more permissive settings have been applied in         the kernel.perf_event_paranoid sysctl.

    CVE-2023-6121

        Alon Zahavi reported an out-of-bounds read vulnerability in the         NVMe-oF/TCP which may result in an information leak.

    CVE-2023-6531

        Jann Horn discovered a use-after-free flaw due to a race condition         when the unix garbage collector's deletion of a SKB races         with unix_stream_read_generic() on the socket that the SKB is         queued on.

    CVE-2023-6817

        Xingyuan Mo discovered that a use-after-free in Netfilter's         implementation of PIPAPO (PIle PAcket POlicies) may result in denial         of service or potential local privilege escalation for a user with         the CAP_NET_ADMIN capability in any user or network namespace.

    CVE-2023-6931

        Budimir Markovic reported a heap out-of-bounds write vulnerability         in the Linux kernel's Performance Events system which may result in         denial of service or privilege escalation. The default settings in         Debian prevent exploitation unless more permissive settings have         been applied in the kernel.perf_event_paranoid sysctl.

    CVE-2023-6932

        A use-after-free vulnerability in the IPv4 IGMP implementation may         result in denial of service or privilege escalation.

    CVE-2023-25775

        Ivan D Barrera, Christopher Bednarz, Mustafa Ismail and Shiraz         Saleem discovered that improper access control in the Intel Ethernet         Controller RDMA driver may result in privilege escalation.

    CVE-2023-34324

        Marek Marczykowski-Gorecki reported a possible deadlock in the Xen         guests event channel code which may allow a malicious guest         administrator to cause a denial of service.

    CVE-2023-35827

        Zheng Wang reported a use-after-free flaw in the Renesas Ethernet         AVB support driver.

    CVE-2023-45863

        A race condition in library routines for handling generic kernel         objects may result in an out-of-bounds write in the         fill_kobj_path() function.

    CVE-2023-46813

        Tom Dohrmann reported that a race condition in the Secure Encrypted         Virtualization (SEV) implementation when accessing MMIO registers         may allow a local attacker in a SEV guest VM to cause a denial of         service or potentially execute arbitrary code.

    CVE-2023-46862

        It was discovered that a race condition in the io_uring         subsystem may result in a NULL pointer dereference, causing a         denial of service.

    CVE-2023-51780

        It was discovered that a race condition in the ATM (Asynchronous         Transfer Mode) subsystem may lead to a use-after-free.

    CVE-2023-51781

        It was discovered that a race condition in the Appletalk subsystem         may lead to a use-after-free.

    CVE-2023-51782

        It was discovered that a race condition in the Amateur Radio X.25         PLP (Rose) support may lead to a use-after-free. This module is not         auto-loaded on Debian systems, so this issue only affects systems         where it is explicitly loaded.

    For Debian 10 buster, these problems have been fixed in version     5.10.205-2~deb10u1.  This update additionally fixes Debian bugs     #1032104, #1035587, and #1052304; and includes many more bug fixes     from stable updates 5.10.198-5.10.205 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
186871	SUSE SLED15: cluster-md-kmp-64kb / cluster-md-kmp-default / dlm-kmp-64kb / etc (SUSE-SU-2023:4810-1)	Nessus	SuSE Local Security Checks	12/14/2023	6/25/2026	critical
197794	RHEL 8 : kernel-rt (RHSA-2024:2950)	Nessus	Red Hat Local Security Checks	5/23/2024	9/25/2025	critical
200620	RockyLinux 8 : kernel-rt (RLSA-2024:2950)	Nessus	Rocky Linux Local Security Checks	6/14/2024	9/26/2025	critical
293435	MiracleLinux 8 : kernel-4.18.0-553.el8_10 (AXSA:2024-8398:15)	Nessus	Miracle Linux Local Security Checks	1/20/2026	2/4/2026	critical
212513	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.5.6.7)	Nessus	Misc.	12/11/2024	9/17/2025	critical
190580	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2024-12159)	Nessus	Oracle Linux Local Security Checks	2/15/2024	2/9/2026	critical
193779	RHEL 7 : kernel (RHSA-2024:2004)	Nessus	Red Hat Local Security Checks	4/24/2024	11/7/2024	critical
194794	RHEL 9 : kernel (RHSA-2024:2394)	Nessus	Red Hat Local Security Checks	4/30/2024	10/29/2025	critical
195036	Oracle Linux 9 : kernel (ELSA-2024-2394)	Nessus	Oracle Linux Local Security Checks	5/6/2024	2/9/2026	critical
189090	Debian dla-3711 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	1/16/2024	1/22/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical