The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1608-1 advisory.

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020. (CVE-2022-3523)

  - An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS). (CVE-2022-36280)

  - A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c     in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a     local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-38096)

  - The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The     ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL     MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the     TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to     the prctl syscall. The patch that added the support for the conditional mitigation via prctl     (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit     a664ec9158eeddd75121d39c9a0758016097fa96 (CVE-2023-0045)

  - A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(),     allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected     versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4. (CVE-2023-0122)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was     found in the way user can guess location of exception stack(s) or other important data. A local user could     use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in     drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

  - In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the     drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually     an error pointer). (CVE-2023-22998)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23001)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

  - atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

  - In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an     integer overflow in an addition. (CVE-2023-23559)

  - The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a     crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

  - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3404 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3404-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 3, 2023                                   https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.178-3~deb10u1     CVE ID         : CVE-2022-2196 CVE-2022-3424 CVE-2022-3707 CVE-2022-4129                      CVE-2022-4379 CVE-2023-0045 CVE-2023-0458 CVE-2023-0459                      CVE-2023-0461 CVE-2023-1073 CVE-2023-1074 CVE-2023-1076                      CVE-2023-1077 CVE-2023-1078 CVE-2023-1079 CVE-2023-1118                      CVE-2023-1281 CVE-2023-1513 CVE-2023-1611 CVE-2023-1670                      CVE-2023-1829 CVE-2023-1855 CVE-2023-1859 CVE-2023-1872                      CVE-2023-1989 CVE-2023-1990 CVE-2023-1998 CVE-2023-2162                      CVE-2023-2194 CVE-2023-22998 CVE-2023-23004 CVE-2023-23559                      CVE-2023-25012 CVE-2023-26545 CVE-2023-28328 CVE-2023-28466                      CVE-2023-30456     Debian Bug     : 989705 993612 1022126 1031753

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service, or information     leak.

    CVE-2022-2196

        A regression was discovered the KVM implementation for Intel CPUs,         affecting Spectre v2 mitigation for nested virtualisation.  When         KVM was used as the L0 hypervisor, an L2 guest could exploit this         to leak sensitive information from its L1 hypervisor.

    CVE-2022-3424

        Zheng Wang and Zhuorao Yang reported a flaw in the SGI GRU driver         which could lead to a use-after-free.  On systems where this driver         is used, a local user can explit this for denial of service (crash         or memory corruption) or possibly for privilege escalation.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-3707

        Zheng Wang reported a flaw in the i915 graphics driver's         virtualisation (GVT-g) support that could lead to a double-free.
        On systems where this feature is used, a guest can exploit this         for denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2022-4129

        Haowei Yan reported a race condition in the L2TP protocol         implementation which could lead to a null pointer dereference.  A         local user could exploit this for denial of service (crash).

    CVE-2022-4379

        Xingyuan Mo reported a flaw in the NFSv4.2 inter server to         server copy implementation which could lead to a use-after-free.

        This feature is not enabled in Debian's official kernel         configurations.

    CVE-2023-0045

        Rodrigo Branco and Rafael Correa De Ysasi reported that when a         user-space task told the kernel to enable Spectre v2 mitigation         for it, the mitigation was not enabled until the task was next         rescheduled.  This might be exploitable by a local or remote         attacker to leak sensitive information from such an application.

    CVE-2023-0458

        Jordy Zimmer and Alexandra Sandulescu found that getrlimit() and         related system calls were vulnerable to speculative execution         attacks such as Spectre v1.  A local user could explot this to         leak sensitive information from the kernel.

    CVE-2023-0459

        Jordy Zimmer and Alexandra Sandulescu found a regression in         Spectre v1 mitigation in the user-copy functions for the amd64         (64-bit PC) architecture.  Where the CPUs do not implement SMAP or         it is disabled, a local user could exploit this to leak sensitive         information from the kernel.  Other architectures may also be         affected.

    CVE-2023-0461

        slipper reported a flaw in the kernel's support for ULPs (Upper         Layer Protocols) on top of TCP that can lead to a double-free when         using kernel TLS sockets.  A local user can exploit this for         denial of service (crash or memory corruption) or possibly for         privilege escalation.

        Kernel TLS is not enabled in Debian's official kernel         configurations.

    CVE-2023-1073

        Pietro Borrello reported a type confusion flaw in the HID (Human         Interface Device) subsystem.  An attacker able to insert and         remove USB devices might be able to use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1074

        Pietro Borrello reported a type confusion flaw in the SCTP         protocol implementation which can lead to a memory leak.  A local         user could exploit this to cause a denial of service (resource         exhaustion).

    CVE-2023-1076

        Pietro Borrello reported a type confusion flaw in the TUN/TAP         network driver, which results in all TUN/TAP sockets being marked         as belonging to user ID 0 (root).  This may allow local users to         evade local firewall rules based on user ID.

    CVE-2023-1077

        Pietro Borrello reported a type confusion flaw in the task         scheduler.  A local user might be able to exploit this to cause a         denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2023-1078

        Pietro Borrello reported a type confusion flaw in the RDS protocol         implementation.  A local user could exploit this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-1079

        Pietro Borrello reported a race condition in the hid-asus HID         driver which could lead to a use-after-free.  An attacker able to         insert and remove USB devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1118

        Duoming Zhou reported a race condition in the ene_ir remote         control driver that can lead to a use-after-free if the driver         is unbound.  It is not clear what the security impact of this is.

    CVE-2023-1281, CVE-2023-1829

        valis reported two flaws in the cls_tcindex network traffic         classifier which could lead to a use-after-free.  A local user can         exploit these for privilege escalation.  This update removes         cls_tcindex entirely.

    CVE-2023-1513

        Xingyuan Mo reported an information leak in the KVM implementation         for the i386 (32-bit PC) architecture.  A local user could exploit         this to leak sensitive information from the kernel.

    CVE-2023-1611

        butt3rflyh4ck reported a race condition in the btrfs filesystem         driver which can lead to a use-after-free.  A local user could         exploit this to cause a denial of service (crash or memory         corruption) or possibly for privilege escalation.

    CVE-2023-1670

        Zheng Wang reported a race condition in the xirc2ps_cs network         driver which can lead to a use-after-free.  An attacker able to         insert and remove PCMCIA devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1855

        Zheng Wang reported a race condition in the xgene-hwmon hardware         monitoring driver that may lead to a use-after-free.  It is not         clear what the security impact of this is.

    CVE-2023-1859

        Zheng Wang reported a race condition in the 9pnet_xen transport         for the 9P filesystem on Xen, which can lead to a use-after-free.
        On systems where this feature is used, a backend driver in another         domain can use this to cause a denial of service (crash or memory         corruption) or possibly to run arbitrary code in the vulnerable         domain.

    CVE-2023-1872

        Bing-Jhong Billy Jheng reported a race condition in the io_uring         subsystem that can lead to a use-after-free.  A local user could         exploit this to cause a denial of service (crash or memory         corruption) or possibly for privilege escalation.

    CVE-2023-1989

        Zheng Wang reported a race condition in the btsdio Bluetooth         adapter driver that can lead to a use-after-free.  An attacker         able to insert and remove SDIO devices can use this to cause a         denial of service (crash or memory corruption) or possibly to run         arbitrary code in the kernel.

    CVE-2023-1990

        Zheng Wang reported a race condition in the st-nci NFC adapter         driver that can lead to a use-after-free.  It is not clear what         the security impact of this is.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2023-1998

        Jos Oliveira and Rodrigo Branco reported a regression in Spectre         v2 mitigation for user-space on x86 CPUs supporting IBRS but not         eIBRS.  This might be exploitable by a local or remote attacker to         leak sensitive information from a user-space application.

    CVE-2023-2162

        Mike Christie reported a race condition in the iSCSI TCP transport         that can lead to a use-after-free.  On systems where this feature         is used, a local user might be able to use this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-2194

        Wei Chen reported a potential heap buffer overflow in the         i2c-xgene-slimpro IC adapter driver.  A local user with         permission to access such a device can use this to cause a denial         of service (crash or memory corruption) and probably for privilege         escalation.

    CVE-2023-22998

        Miaoqian Lin reported an incorrect error check in the virtio-gpu         GPU driver.  A local user with access to such a device might be         able to use this to cause a denial of service (crash).

    CVE-2023-23004

        Miaoqian Lin reported an incorrect error check in the mali-dp GPU         driver.  A local user with access to such a device might be able         to use this to cause a denial of service (crash).

    CVE-2023-23559

        Szymon Heidrich reported incorrect bounds checks in the rndis_wlan         Wi-Fi driver which may lead to a heap buffer overflow or overread.
        An attacker able to insert and remove USB devices can use this to         cause a denial of service (crash or memory corruption) or         information leak, or possibly to run arbitrary code in the kernel.

    CVE-2023-25012

        Pietro Borrello reported a race condition in the hid-bigbenff HID         driver which could lead to a use-after-free.  An attacker able to         insert and remove USB devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-26545

        Lianhui Tang reported a flaw in the MPLS protocol implementation         that could lead to a double-free.  A local user might be able to         exploit this to cause a denial of service (crash or memory         corruption) or possibl for privilege escalation.

    CVE-2023-28328

        Wei Chen reported a flaw in the az6927 DVB driver that can lead to         a null pointer dereference.  A local user permitted to access an         IC adapter device that this driver creates can use this to cause         a denial of service (crash).

    CVE-2023-28466

        Hangyu Hua reported a race condition in the kernel TLS socket         implementation which can lead to a use-after-free or null         pointer dereference.  A local user can exploit this for         denial of service (crash or memory corruption) or possibly for         privilege escalation.

        This feature is not enabled in Debian's official kernel         configurations.

    CVE-2023-30456

        Reima ISHII reported a flaw in the KVM implementation for Intel         CPUs affecting nested virtualisation.  When KVM was used as the L0         hypervisor, and EPT and/or unrestricted guest mode was disabled,         it did not prevent an L2 guest from being configured with an         architecturally invalid protection/paging mode.  A malicious guest         could exploit this to cause a denial of service (crash).

    For Debian 10 buster, these problems have been fixed in version     5.10.178-3~deb10u1.  This update additionally fixes Debian bugs     #989705, #993612, #1022126, and #1031753; and includes many more bug     fixes from stable updates 5.10.163-5.10.178 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
173627	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:1608-1)	Nessus	SuSE Local Security Checks	3/29/2023	7/14/2023	high
175925	Debian dla-3404 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	5/17/2023	1/22/2025	high

Detections

Analytics

Plugins Search

high

high