The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4346-1 advisory.

  - An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error     in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.
    (CVE-2023-31085)

  - The vulnerability exists due to improper event handling in Linux kernel. A malicious guest can disable     paravirtualized device to cause a deadlock in a backend domain (other than dom0). (CVE-2023-34324)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4347-1 advisory.

  - An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte     of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with     a hole in the struct. (CVE-2020-36766)

  - A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS     transfers response data to a system call, there are still local variable points to the memory region, and     if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a     denial of service. (CVE-2023-1192)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs     in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem,     possibly leading to a kernel information leak. (CVE-2023-1859)

  - An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error     in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.
    (CVE-2023-31085)

  - The vulnerability exists due to improper event handling in Linux kernel. A malicious guest can disable     paravirtualized device to cause a deadlock in a backend domain (other than dom0). (CVE-2023-34324)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

  - A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

  - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before     6.4.10. There is a use-after-free because the children of an sk are mishandled. (CVE-2023-40283)

  - A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system. (CVE-2023-42754)

  - An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4375-1 advisory.

  - Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly     marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and     container escape. (CVE-2023-2163)

  - An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error     in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.
    (CVE-2023-31085)

  - The vulnerability exists due to improper event handling in Linux kernel. A malicious guest can disable     paravirtualized device to cause a deadlock in a backend domain (other than dom0). (CVE-2023-34324)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked     whether the chain is bound and the chain's owner rule can also release the objects in certain     circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.
    (CVE-2023-3777)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs     due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to     executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-39191)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to     cause a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3138 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6536-1 advisory.

    Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some     attributes passed from userspace. A local attacker could use this to cause a denial of service (system     crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

    Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket     buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference     vulnerability. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-42754)

    Yikebaer Aizezi discovered that the ext4 file system implementation in the Linux kernel contained a use-     after-free vulnerability when handling inode extent metadata. An attacker could use this to construct a     malicious ext4 file system image that, when mounted, could cause a denial of service (system crash).
    (CVE-2023-45898)

    Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov     buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service     (host system crash). (CVE-2023-5158)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue     initialization failures in certain situations, leading to a use-after-free vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-5178)

    Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event     groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6548-1 advisory.

    It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could     potentially use this to expose sensitive information. (CVE-2023-3006)

    It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling     device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

    Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some     attributes passed from userspace. A local attacker could use this to cause a denial of service (system     crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

    Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32     packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause     a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

    Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP     data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

    Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not     properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-39194)

    Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket     buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference     vulnerability. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-42754)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue     initialization failures in certain situations, leading to a use-after-free vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-5178)

    Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event     groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

    It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic     operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6534-2 advisory.

    It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling     device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

    Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not properly     initialize a policy data structure, leading to an out-of-bounds vulnerability. A local privileged attacker     could use this to cause a denial of service (system crash) or possibly expose sensitive information     (kernel memory). (CVE-2023-3773)

    Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some     attributes passed from userspace. A local attacker could use this to cause a denial of service (system     crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

    Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32     packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause     a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

    Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP     data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

    Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel did not     properly handle state filters, leading to an out- of-bounds read vulnerability. A privileged local     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-39194)

    It was discovered that a race condition existed in QXL virtual GPU driver in the Linux kernel, leading to     a use after free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-39198)

    Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket     buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference     vulnerability. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-42754)

    Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov     buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service     (host system crash). (CVE-2023-5158)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue     initialization failures in certain situations, leading to a use-after-free vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-5178)

    Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event     groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

    It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash). (CVE-2023-6039)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.15.133-86.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-027 advisory.

    An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds     and crash in read_descriptors in drivers/usb/core/sysfs.c. (CVE-2023-37453)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: exthdr: fix 4-byte stack OOB write

    If priv->len is a multiple of 4, then dst[len / 4] can write pastthe destination array which leads to     stack corruption.

    This construct is necessary to clean the remainder of the registerin case ->len is NOT a multiple of the     register size, so make itconditional just like nft_payload.c does.

    The bug was added in 4.1 cycle and then copied/inherited whentcp/sctp and ip option support was added.

    Bug reported by Zero Day Initiative project (ZDI-CAN-21950,ZDI-CAN-21951, ZDI-CAN-21961). (CVE-2023-52628)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3710 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3710-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     January 10, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 4.19.304-1     CVE ID         : CVE-2021-44879 CVE-2023-0590 CVE-2023-1077 CVE-2023-1206                      CVE-2023-1989 CVE-2023-3212 CVE-2023-3390 CVE-2023-3609                      CVE-2023-3611 CVE-2023-3772 CVE-2023-3776 CVE-2023-4206                      CVE-2023-4207 CVE-2023-4208 CVE-2023-4244 CVE-2023-4622                      CVE-2023-4623 CVE-2023-4921 CVE-2023-5717 CVE-2023-6606                      CVE-2023-6931 CVE-2023-6932 CVE-2023-25775 CVE-2023-34319                      CVE-2023-34324 CVE-2023-35001 CVE-2023-39189 CVE-2023-39192                      CVE-2023-39193 CVE-2023-39194 CVE-2023-40283 CVE-2023-42753                      CVE-2023-42754 CVE-2023-42755 CVE-2023-45863 CVE-2023-45871                      CVE-2023-51780 CVE-2023-51781 CVE-2023-51782

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2021-44879

        Wenqing Liu reported a NULL pointer dereference in the f2fs         implementation. An attacker able to mount a specially crafted image         can take advantage of this flaw for denial of service.

    CVE-2023-0590

        Dmitry Vyukov discovered a race condition in the network scheduler         core that that can lead to a use-after-free.  A local user with         the CAP_NET_ADMIN capability in any user or network namespace         could exploit this to cause a denial of service (crash or memory         corruption) or possibly for privilege escalation.

    CVE-2023-1077

        Pietro Borrello reported a type confusion flaw in the task         scheduler.  A local user might be able to exploit this to cause a         denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2023-1206

        It was discovered that the networking stack permits attackers to         force hash collisions in the IPv6 connection lookup table, which         may result in denial of service (significant increase in the cost         of lookups, increased CPU utilization).

    CVE-2023-1989

        Zheng Wang reported a race condition in the btsdio Bluetooth         adapter driver that can lead to a use-after-free.  An attacker         able to insert and remove SDIO devices can use this to cause a         denial of service (crash or memory corruption) or possibly to run         arbitrary code in the kernel.

    CVE-2023-3212

        Yang Lan discovered that missing validation in the GFS2 filesystem         could result in denial of service via a NULL pointer dereference         when mounting a malformed GFS2 filesystem.

    CVE-2023-3390

        A use-after-free flaw in the netfilter subsystem caused by         incorrect error path handling may result in denial of service or         privilege escalation.

    CVE-2023-3609, CVE-2023-3776, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208

        It was discovered that a use-after-free in the cls_fw, cls_u32,         cls_route and network classifiers may result in denial of service         or potential local privilege escalation.

    CVE-2023-3611

        It was discovered that an out-of-bounds write in the traffic         control subsystem for the Quick Fair Queueing scheduler (QFQ) may         result in denial of service or privilege escalation.

    CVE-2023-3772

        Lin Ma discovered a NULL pointer dereference flaw in the XFRM         subsystem which may result in denial of service.

    CVE-2023-4244

        A race condition was found in the nftables subsystem that could         lead to a use-after-free.  A local user could exploit this to         cause a denial of service (crash), information leak, or possibly         for privilege escalation.

    CVE-2023-4622

        Bing-Jhong Billy Jheng discovered a use-after-free within the Unix         domain sockets component, which may result in local privilege         escalation.

    CVE-2023-4623

        Budimir Markovic reported a missing configuration check in the         sch_hfsc network scheduler that could lead to a use-after-free or         other problems.  A local user with the CAP_NET_ADMIN capability in         any user or network namespace could exploit this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-4921

        valis reported flaws in the sch_qfq network scheduler that could         lead to a use-after-free.  A local user with the CAP_NET_ADMIN         capability in any user or network namespace could exploit this to         cause a denial of service (crash or memory corruption) or possibly         for privilege escalation.

    CVE-2023-5717

        Budimir Markovic reported a heap out-of-bounds write vulnerability         in the Linux kernel's Performance Events system caused by improper         handling of event groups, which may result in denial of service or         privilege escalation. The default settings in Debian prevent         exploitation unless more permissive settings have been applied in         the kernel.perf_event_paranoid sysctl.

    CVE-2023-6606

        j51569436 reported a potential out-of-bounds read in the CIFS         filesystem implementation.  If a CIFS filesystem is mounted from a         malicious server, the server could possibly exploit this to cause         a denial of service (crash).

    CVE-2023-6931

        Budimir Markovic reported a heap out-of-bounds write vulnerability         in the Linux kernel's Performance Events system which may result in         denial of service or privilege escalation. The default settings in         Debian prevent exploitation unless more permissive settings have         been applied in the kernel.perf_event_paranoid sysctl.

    CVE-2023-6932

        A use-after-free vulnerability in the IPv4 IGMP implementation may         result in denial of service or privilege escalation.

    CVE-2023-25775

        Ivan D Barrera, Christopher Bednarz, Mustafa Ismail and Shiraz         Saleem discovered that improper access control in the Intel Ethernet         Controller RDMA driver may result in privilege escalation.

    CVE-2023-34319

        Ross Lagerwall discovered a buffer overrun in Xen's netback driver         which may allow a Xen guest to cause denial of service to the         virtualisation host by sending malformed packets.

    CVE-2023-34324

        Marek Marczykowski-Gorecki reported a possible deadlock in the Xen         guests event channel code which may allow a malicious guest         administrator to cause a denial of service.

    CVE-2023-35001

        Tanguy DUBROCA discovered an out-of-bounds reads and write flaw in         the Netfilter nf_tables implementation when processing an         nft_byteorder expression, which may result in local privilege         escalation for a user with the CAP_NET_ADMIN capability in any         user or network namespace.

    CVE-2023-39189, CVE-2023-39192, CVE-2023-39193

        Lucas Leong of Trend Micro Zero Day Initiative reported missing         bounds checks in the nfnetlink_osf, xt_u32, and xt_sctp netfilter         modules.  A local user with the CAP_NET_ADMIN capability in any         user or network namespace could exploit these to leak sensitive         information from the kernel or for denial of service (crash).

    CVE-2023-39194

        Lucas Leong of Trend Micro Zero Day Initiative reported a missing         bounds check in the xfrm (IPsec) subsystem.  A local user with the         CAP_NET_ADMIN capability in any user or network namespace could         exploit this to leak sensitive information from the kernel or for         denial of service (crash).

    CVE-2023-40283

        A use-after-free was discovered in Bluetooth L2CAP socket         handling.

    CVE-2023-42753

        Kyle Zeng discovered an off-by-one error in the netfilter ipset         subsystem which could lead to out-of-bounds memory access.  A         local user with the CAP_NET_ADMIN capability in any user or         network namespace could exploit this to cause a denial of service         (memory corruption or crash) and possibly for privilege         escalation.

    CVE-2023-42754

        Kyle Zeng discovered a flaw in the IPv4 implementation which could         lead to a null pointer deference.  A local user could exploit this         for denial of service (crash).

    CVE-2023-42755

        Kyle Zeng discovered missing configuration validation in the         cls_rsvp network classifier which could lead to out-of-bounds         reads.  A local user with the CAP_NET_ADMIN capability in any user         or network namespace could exploit this to cause a denial of         service (crash) or to leak sensitive information.

        This flaw has been mitigated by removing the cls_rsvp classifier.

    CVE-2023-45863

        A race condition in library routines for handling generic kernel         objects may result in an out-of-bounds write in the         fill_kobj_path() function.

    CVE-2023-45871

        Manfred Rudigier reported a flaw in the igb network driver for         Intel Gigabit Ethernet interfaces.  When the rx-all feature was         enabled on such a network interface, an attacker on the same         network segment could send packets that would overflow a receive         buffer, leading to a denial of service (crash or memory         corruption) or possibly remote code execution.

    CVE-2023-51780

        It was discovered that a race condition in the ATM (Asynchronous         Transfer Mode) subsystem may lead to a use-after-free.

    CVE-2023-51781

        It was discovered that a race condition in the Appletalk subsystem         may lead to a use-after-free.

    CVE-2023-51782

        It was discovered that a race condition in the Amateur Radio X.25         PLP (Rose) support may lead to a use-after-free. This module is not         auto-loaded on Debian systems, so this issue only affects systems         where it is explicitly loaded.

    For Debian 10 buster, these problems have been fixed in version     4.19.304-1.  This update additionally includes many more bug fixes     from stable updates 4.19.290-4.19.304 inclusive.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2394 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133,     CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085,     CVE-2024-26582)

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915,     CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)

    * kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)

    * kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)

    * kernel: GC's deletion of an SKB races with unix_stream_read_generic()  leading to UAF (CVE-2023-6531)

    * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size     (CVE-2023-6931)

    * kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)

    * kernel: irdma: Improper access control (CVE-2023-25775)

    * Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)

    * kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)

    * kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl     (CVE-2023-31083)

    * kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193,     CVE-2023-6121, CVE-2023-39194)

    * kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)

    * kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)

    * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)

    * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)

    * kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)

    * kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)

    * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

    * kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)

    * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

    * kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in     function receive_encrypted_standard of client (CVE-2024-0565)

    * kernel: tls: race between async notify and socket close (CVE-2024-26583)

    * kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)

    * kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)

    * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)

    * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

    * kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)

    * kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)

    * kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)

    * kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)

    * kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
184342	SUSE SLES12 Security Update : kernel (SUSE-SU-2023:4346-1)	Nessus	SuSE Local Security Checks	11/3/2023	11/3/2023	medium
184345	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:4347-1)	Nessus	SuSE Local Security Checks	11/3/2023	11/3/2023	high
184797	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:4375-1)	Nessus	SuSE Local Security Checks	11/7/2023	6/19/2024	high
197808	RHEL 8 : kernel (RHSA-2024:3138)	Nessus	Red Hat Local Security Checks	5/23/2024	3/21/2025	critical
186614	Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6536-1)	Nessus	Ubuntu Local Security Checks	12/6/2023	8/28/2024	high
186743	Ubuntu 18.04 ESM / 20.04 LTS : Linux kernel vulnerabilities (USN-6548-1)	Nessus	Ubuntu Local Security Checks	12/11/2023	8/27/2024	high
186758	Ubuntu 23.04 : Linux kernel vulnerabilities (USN-6534-2)	Nessus	Ubuntu Local Security Checks	12/12/2023	8/28/2024	high
226746	Linux Distros Unpatched Vulnerability : CVE-2023-39189	Nessus	Misc.	3/5/2025	3/5/2025	medium
182654	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-027)	Nessus	Amazon Linux Local Security Checks	10/6/2023	3/17/2025	high
189094	Debian dla-3710 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	1/16/2024	3/31/2025	critical
204290	Photon OS 5.0: Linux PHSA-2023-5.0-0111	Nessus	PhotonOS Local Security Checks	7/24/2024	11/7/2024	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	7/22/2021	4/10/2025	critical
194794	RHEL 9 : kernel (RHSA-2024:2394)	Nessus	Red Hat Local Security Checks	4/30/2024	3/24/2025	critical

Detections

Analytics

Plugins Search

medium

high

high

critical

high

high

high

medium

high

critical

high

critical

critical