The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0114 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-3108:
    An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in     drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().

    CVE-2023-2006:
    A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC     bundles. This issue results from the lack of proper locking when performing operations on an object. This     may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

    CVE-2023-2156:
    A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system.

    CVE-2023-3090:
    A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

    CVE-2023-31084:
    An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process.

    CVE-2023-3111:
    A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag().

    CVE-2023-3117:
    A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and     anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel     memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their     privileges on the system.

    CVE-2023-3161:
    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and     font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds     occurs leading to undefined behavior and possible denial of service.

    CVE-2023-3212:
    A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.

    CVE-2023-35823:
    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c.

    CVE-2023-35824:
    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in     drivers/media/pci/dm1105/dm1105.c.

    CVE-2023-35828:
    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in     renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.

    CVE-2023-35829:
    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in     drivers/staging/media/rkvdec/rkvdec.c.

    CVE-2023-3609:
    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

    CVE-2023-3610:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in     the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend     upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.

    CVE-2023-3611:
    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

    CVE-2023-3773:
    A flaw was found in the Linux kernels IP framework for transforming packets (XFRM subsystem). This     issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of     XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data     to userspace.

    CVE-2023-3776:
    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.

    CVE-2023-3812:
    An out-of-bounds memory access flaw was found in the Linux kernels TUN/TAP device driver functionality     in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw     allows a local user to crash or potentially escalate their privileges on the system.

    CVE-2023-4004:
    A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system.

    CVE-2023-4128:
    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue.

    CVE-2023-4147:
    A use-after-free flaw was found in the Linux kernels Netfilter functionality when adding a rule with     NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A use-after-free flaw was found in the Linux kernel's Netfilter functionality when adding a rule with     NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
    (CVE-2023-4147)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5069 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (5.14.0).

    Security Fix(es):

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE     (CVE-2023-3610)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

    * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

    * kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free     (CVE-2023-4147)

    * kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248)

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

    * kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593)

    * kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [Intel 9.3 BUG] [SPR][EMR][FHF] ACPI: Fix system hang during S3 wakeup (BZ#2218026)

    * [Dell 9.2 BUG] Monitor lost after replug WD19TBS to SUT port wiith VGA/DVI to type-C dongle (BZ#2219463)

    * rtmutex: Incorrect waiter woken when requeueing in rt_mutex_adjust_prio_chain() (BZ#2222121)

    * RHEL AWS ARM Instability During Microshift e2e tests (BZ#2223310)

    * RHEL 9.x updates for SEV-SNP guest support (BZ#2224587)

    * Lock state corruption from nested rtmutex blocking in blk_flush_plug() (BZ#2225623)

    * bpf_jit_limit hit again - copy_seccomp() fix (BZ#2226945)

    * libceph: harden msgr2.1 frame segment length checks (BZ#2227070)

    * Temporary values used for the FIPS integrity test should be zeroized after use (BZ#2227768)

    * Important iavf bug fixes July 2023 (BZ#2228156)

    * [i40e/ice] error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0:
    Resource temporarily unavailable (BZ#2228158)

    * lvconvert --splitcache, --uncache operations getting hung (BZ#2228481)

    * perf: EMR core and uncore PMU support (BZ#2230175)

    * NVIDIA - Grace: Backport i2c: tegra: Set ACPI node as primary fwnode (BZ#2230483)

    * NVIDIA - Grace: Backport i2c: tegra: Fix PEC support for SMBUS block read (BZ#2230488)

    * [Hyper-V][RHEL 9]incomplete fc_transport implementation in storvsc causes null dereference in     fc_timed_out() (BZ#2230747)

    * Kernel config option CONFIG_CRYPTO_STATS should be disabled until it is enhanced (BZ#2231850)

    * [RHEL 9][Hyper-V]Excessive hv_storvsc driver logging with srb_status  SRB_STATUS_INTERNAL_ERROR  (0x30)     (BZ#2231990)

    * RHEL-9: WARNING: bad unlock balance detected! (BZ#2232213)

    * NVIDIA - Grace: Backport drm/ast patch expected for kernel 6.4 (BZ#2232302)

    * [Lenovo 9.1 bug]   RHEL 9 will hang when echo c > /proc/sysrq-trigger. (BZ#2232700)

    * [RHEL-9] bz2022169 in /kernel/general/process/reg-suit fails on aarch64  (/proc/[pid]/wchan broken)     (BZ#2233928)

    Enhancement(s):

    * [Intel 9.3 FEAT] cpufreq: intel_pstate: Enable HWP IO boost for all servers (BZ#2210270)

    * [Dell 9.3 FEAT] - New MB with AMP Codec Change on Maya Bay (audio driver) (BZ#2218960)

    * [Lenovo 9.3 FEAT] MDRAID - Update to the latest upstream (BZ#2221170)

    * [Intel 9.3 FEAT] [EMR] Add EMR support to uncore-frequency driver (BZ#2230169)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5069 advisory.

    - x86/tsx: Add a feature bit for TSX control MSR support {CVE-2023-1637}
    - x86/speculation: Restore speculation related MSRs {CVE-2023-1637}
    - x86/pm: Save the MSR validity status at context setup {CVE-2023-1637}
    - x86/pm: Fix false positive kmemleak report in msr_build_context() {CVE-2023-1637}
    - x86/cpu: Restore AMD's DE_CFG MSR after resume {CVE-2023-1637}
    - x86/pm: Add enumeration check before spec MSRs {CVE-2023-1637}
    - arm64: efi: Execute runtime services from a dedicated {CVE-2023-21102}
    - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3390}
    - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain {CVE-2023-3390}
    - netfilter: nf_tables: unbind non-anonymous set if rule construction fails {CVE-2023-3390}
    - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID {CVE-2023-4147}
    - netfilter: nf_tables: do not ignore genmask when looking up chain by id {CVE-2023-31248}
    - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
    - netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of kernel-generic installed on the remote host is prior to 5.15.139 / 5.15.139_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-325-01 advisory.

    New kernel packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the kernel-generic security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
236095	Alibaba Cloud Linux 3 : 0114: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0114)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	9/23/2025	high
249037	Linux Distros Unpatched Vulnerability : CVE-2023-4147	Nessus	Misc.	8/12/2025	10/28/2025	high
181279	RHEL 9 : kernel (RHSA-2023:5069)	Nessus	Red Hat Local Security Checks	9/12/2023	3/31/2025	critical
181478	Oracle Linux 9 : kernel (ELSA-2023-5069)	Nessus	Oracle Linux Local Security Checks	9/15/2023	9/9/2025	high
203507	Photon OS 4.0: Linux PHSA-2023-4.0-0457	Nessus	PhotonOS Local Security Checks	7/23/2024	3/31/2025	critical
186088	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2023-325-01)	Nessus	Slackware Local Security Checks	11/21/2023	9/29/2025	critical

Detections

Analytics

Plugins Search

high

high

critical

high

critical

critical