The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0017 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-20588:
    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality.

    CVE-2023-28464:
    hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation.

    CVE-2023-39192:
    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure.

    CVE-2023-45863:
    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write.

    CVE-2023-45871:
    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.

    CVE-2023-4622:
    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.
    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.
    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

    CVE-2023-51779:
    bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free     because of a bt_sock_ioctl race condition.

    CVE-2023-5178:
    A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause     a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation.

    CVE-2023-52438:
    In the Linux kernel, the following vulnerability has been resolved:
    binder: fix use-after-free in shinker's callback     The mmap read lock is used during the shrinker's callback, which means     that using alloc->vma pointer isn't safe as it can race with munmap().
    As of commit dd2283f2605e (mm: mmap: zap pages with read mmap_sem in     munmap) the mmap lock is downgraded after the vma has been isolated.
    I was able to reproduce this issue by manually adding some delays and     triggering page reclaiming through the shrinker's debug sysfs. The     following KASAN report confirms the UAF:
    ==================================================================     BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8     Read of size 8 at addr ffff356ed50e50f0 by task bash/478     CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70     Hardware name: linux,dummy-virt (DT)     Call trace:
    zap_page_range_single+0x470/0x4b8     binder_alloc_free_page+0x608/0xadc
    __list_lru_walk_one+0x130/0x3b0     list_lru_walk_node+0xc4/0x22c     binder_shrink_scan+0x108/0x1dc     shrinker_debugfs_scan_write+0x2b4/0x500     full_proxy_write+0xd4/0x140     vfs_write+0x1ac/0x758     ksys_write+0xf0/0x1dc
    __arm64_sys_write+0x6c/0x9c     Allocated by task 492:
    kmem_cache_alloc+0x130/0x368     vm_area_alloc+0x2c/0x190     mmap_region+0x258/0x18bc     do_mmap+0x694/0xa60     vm_mmap_pgoff+0x170/0x29c     ksys_mmap_pgoff+0x290/0x3a0
    __arm64_sys_mmap+0xcc/0x144     Freed by task 491:
    kmem_cache_free+0x17c/0x3c8     vm_area_free_rcu_cb+0x74/0x98     rcu_core+0xa38/0x26d4     rcu_core_si+0x10/0x1c
    __do_softirq+0x2fc/0xd24     Last potentially related work creation:
    __call_rcu_common.constprop.0+0x6c/0xba0     call_rcu+0x10/0x1c     vm_area_free+0x18/0x24     remove_vma+0xe4/0x118     do_vmi_align_munmap.isra.0+0x718/0xb5c     do_vmi_munmap+0xdc/0x1fc
    __vm_munmap+0x10c/0x278
    __arm64_sys_munmap+0x58/0x7c     Fix this issue by performing instead a vma_lookup() which will fail to     find the vma that was isolated before the mmap lock downgrade. Note that     this option has better performance than upgrading to a mmap write lock     which would increase contention. Plus, mmap_write_trylock() has been     recently removed anyway.

    CVE-2023-5717:
    A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation.
    If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it     can increment or write to memory locations outside of the allocated buffer.
    We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

    CVE-2023-6176:
    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system.

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.
    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().
    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

    CVE-2023-6932:
    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.
    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.
    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.
    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.
    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2024-22099:
    NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth     modules) allows Overflow Buffers. This vulnerability is associated with program files     /net/bluetooth/rfcomm/core.C.
    This issue affects Linux kernel: v2.6.12-rc2.

    CVE-2024-24855:
    A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue.

    CVE-2024-24860:
    A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue.

    CVE-2024-26597:
    In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob     in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-     bounds read when parsing the netlink attributes. See bug trace below:
    ==================================================================     BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline]     BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at     addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N     6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call     Trace: < TASK > __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395     kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline]
    __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697     nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] __rtnl_newlink+0x50a/0x1880     net/core/rtnetlink.c:3485 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43c/0xd70     net/core/rtnetlink.c:6091 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 netlink_unicast_kernel     net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345     netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline]     sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482
    ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdcf2072359 Code: 28 00 00 00 75 05 48 83 c4 28 c3     e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246     ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 RDX:
    0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007fdcf20bd493 R08: 0000000000000000     R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13:
    00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 < /TASK > The buggy address belongs to the     variable: rmnet_policy+0x30/0xe0 The buggy address belongs to the physical page: page:0000000065bdeb3c     refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 flags:
    0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8     0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped     because: kasan: bad access detected Memory state around the buggy address: ffffffff92c43780: f9 f9 f9 f9     00 00 00 02 f9 f9 f9 f9 00 00 00 07 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9     >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 ^ ffffffff92c43900: 00 00 00 00 00 00     00 00 07 f9 f9 f9 f9 f9 f9 f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According     to the comment of `nla_parse_nested_deprecated`, the maxtype should be len(destination array) - 1. Hence     use `IFLA_RMNET_MAX` here.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of kernel installed on the remote host is prior to 5.4.257-170.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-053 advisory.

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    The upstream commit describes this issue as follows:

    The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong     `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to     slab out-of-bound access. (CVE-2023-42753)

    A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to     the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer     access. (CVE-2023-42755)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.

    If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing     curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in     update_vf(). This leaves a dangling pointer that can cause a use-after-free.

    We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.

    When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free     in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in     agg_dequeue().

    We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

    In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has     a fence use-after-free. (CVE-2023-51042)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c     (CVE-2023-53179)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix data-races around user->unix_inflight. (CVE-2023-53204)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: Fix integer overflow in radeon_cs_parser_init (CVE-2023-53309)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/msm/mdp5: Don't leak some plane state (CVE-2023-53324)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: Check start of empty przs during init (CVE-2023-53331)

    In the Linux kernel, the following vulnerability has been resolved:

    lwt: Fix return values of BPF xmit ops (CVE-2023-53338)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race issue between cpu buffer write and swap (CVE-2023-53368)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (CVE-2023-53395)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Correct devm device reference for hidinput input_dev name (CVE-2023-53454)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla4xxx: Add length check when parsing nlattrs (CVE-2023-53456)

    In the Linux kernel, the following vulnerability has been resolved:

    FS: JFS: Fix null-ptr-deref Read in txBegin (CVE-2023-53457)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    kobject: Add sanity check for kset->kobj.ktype in kset_register() (CVE-2023-53480)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (CVE-2023-53485)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    PM / devfreq: Fix leak in devfreq_dev_release() (CVE-2023-53518)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi_si: fix a memleak in try_smi_init() (CVE-2023-53611)

    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (CVE-2023-53616)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix possible data races in gfs2_show_options() (CVE-2023-53622)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: output extra debug info if we failed to find an inline backref (CVE-2023-53672)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (CVE-2023-53676)

    In the Linux kernel, the following vulnerability has been resolved:

    md: raid1: fix potential OOB in raid1_remove_disk() (CVE-2023-53722)

    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system. (CVE-2023-6176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
235960	Alibaba Cloud Linux 3 : 0017: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2024:0017)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	9/7/2021	10/16/2025	high
182660	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-053 (ALASKERNEL-5.4-2023-053)	Nessus	Amazon Linux Local Security Checks	10/6/2023	11/4/2025	high

Detections

Analytics

Plugins Search

high

high

high