The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1321-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
    - CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
    - CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests     (bsc#1220445).
    - CVE-2023-52513: Fixed connection failure handling  in RDMA/siw (bsc#1221022).
    - CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
    - CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
    - CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround  (bsc#1220251).
    - CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
    - CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
    - CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
    - CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
    - CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
    - CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
    - CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
    - CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
    - CVE-2023-52567: Fixed possible Oops in  serial/8250_port: when using IRQ polling (irq = 0)     (bsc#1220839).
    - CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i     (bsc#1221055).
    - CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
    - CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
    - CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine     (bsc#1221553).
    - CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
    - CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
    - CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
    - CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng     (bsc#1220990).
    - CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
    - CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
    - CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
    - CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
    - CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
    - CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
    - CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
    - CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
    - CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
    - CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
    - CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
    - CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
    - CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
    - CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in     net/marvell/prestera (bsc#1221009).
    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
    - CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
    - CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could     lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
    - CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
    - CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
    - CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
    - CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function
    __dma_async_device_channel_register() (bsc#1221276).
    - CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).
    - CVE-2023-52582: Fixed possible oops in netfs (bsc#1220878).
    - CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
    - CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
    - CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
    - CVE-2023-52576: Fixed potential use after free in memblock_isolate_range() (bsc#1220872).
    - CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
    - CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2023-52523: Fixed wrong redirects to non-TCP sockets in bpf (bsc#1220926).
    - CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0484-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been     exploited to achieve local privilege escalation (bsc#1219434).
    - CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
    - CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race     condition (bsc#1218730).
    - CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment     (bsc#1218836).
    - CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
    - CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code     inside the brcm80211 component (bsc#1216702).
    - CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a     driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
    - CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user     to cause an information leak problem while freeing the old quota file names before a potential failure     (bsc#1219053).
    - CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function     (bsc#1218752).
    - CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race     condition (bsc#1218757).
    - CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information     (bsc#1217946).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in     drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6819-2 advisory.

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C     PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a     denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

    Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-     bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system     crash). (CVE-2024-23849)

    It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to     a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a     denial of service (system crash). (CVE-2024-24860)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - Core kernel;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - Android drivers;

    - Drivers core;

    - Power management core;

    - Bus devices;

    - Device frequency scaling framework;

    - DMA engine subsystem;

    - EDAC drivers;

    - ARM SCMI message protocol;

    - GPU drivers;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Media drivers;

    - Multifunction device drivers;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PCI driver for MicroSemi Switchtec;

    - Power supply drivers;

    - RPMSG subsystem;

    - SCSI drivers;

    - QCOM SoC drivers;

    - SPMI drivers;

    - Thermal drivers;

    - TTY drivers;

    - VFIO drivers;

    - BTRFS file system;

    - Ceph distributed file system;

    - EFI Variable file system;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - GFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system server daemon;

    - File systems infrastructure;

    - Pstore file system;

    - ReiserFS file system;

    - SMB network file system;

    - BPF subsystem;

    - Memory management;

    - TLS protocol;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Logical Link layer;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netfilter;

    - NetLabel subsystem;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - AppArmor security module;

    - Intel ASoC drivers;

    - MediaTek ASoC drivers;

    - USB sound devices; (CVE-2023-52612, CVE-2024-26808, CVE-2023-52691, CVE-2023-52618, CVE-2023-52463,     CVE-2023-52447, CVE-2024-26668, CVE-2023-52454, CVE-2024-26670, CVE-2024-26646, CVE-2023-52472,     CVE-2024-26586, CVE-2023-52681, CVE-2023-52453, CVE-2023-52611, CVE-2023-52622, CVE-2024-26641,     CVE-2023-52616, CVE-2024-26592, CVE-2023-52606, CVE-2024-26620, CVE-2023-52692, CVE-2024-26669,     CVE-2023-52623, CVE-2023-52588, CVE-2024-26616, CVE-2024-26610, CVE-2024-35839, CVE-2023-52490,     CVE-2023-52672, CVE-2024-26612, CVE-2023-52617, CVE-2023-52697, CVE-2024-26644, CVE-2023-52458,     CVE-2023-52598, CVE-2024-35841, CVE-2023-52664, CVE-2023-52635, CVE-2023-52676, CVE-2023-52669,     CVE-2024-26632, CVE-2023-52486, CVE-2024-26625, CVE-2023-52608, CVE-2024-26634, CVE-2023-52599,     CVE-2024-26618, CVE-2024-26640, CVE-2023-52489, CVE-2023-52675, CVE-2023-52678, CVE-2024-26583,     CVE-2023-52693, CVE-2023-52498, CVE-2024-26649, CVE-2023-52670, CVE-2023-52473, CVE-2023-52449,     CVE-2023-52667, CVE-2023-52467, CVE-2023-52686, CVE-2024-26633, CVE-2023-52666, CVE-2024-35840,     CVE-2024-26629, CVE-2024-26595, CVE-2023-52593, CVE-2023-52687, CVE-2023-52465, CVE-2024-26627,     CVE-2023-52493, CVE-2023-52491, CVE-2024-26636, CVE-2024-26584, CVE-2023-52587, CVE-2023-52597,     CVE-2023-52462, CVE-2023-52633, CVE-2023-52696, CVE-2024-26585, CVE-2023-52589, CVE-2023-52456,     CVE-2023-52470, CVE-2024-35838, CVE-2024-26645, CVE-2023-52591, CVE-2023-52464, CVE-2023-52609,     CVE-2024-26608, CVE-2023-52450, CVE-2023-52584, CVE-2023-52469, CVE-2023-52583, CVE-2023-52451,     CVE-2023-52495, CVE-2023-52626, CVE-2023-52595, CVE-2023-52680, CVE-2023-52632, CVE-2024-26582,     CVE-2024-35837, CVE-2023-52494, CVE-2023-52614, CVE-2023-52443, CVE-2023-52698, CVE-2023-52448,     CVE-2024-26615, CVE-2023-52452, CVE-2023-52492, CVE-2024-26647, CVE-2023-52468, CVE-2023-52594,     CVE-2023-52621, CVE-2024-26638, CVE-2024-26594, CVE-2024-26673, CVE-2023-52457, CVE-2023-52677,     CVE-2023-52607, CVE-2024-26623, CVE-2023-52488, CVE-2023-52497, CVE-2023-52445, CVE-2024-26607,     CVE-2023-52610, CVE-2024-35842, CVE-2023-52690, CVE-2023-52683, CVE-2023-52444, CVE-2024-26671,     CVE-2023-52455, CVE-2023-52679, CVE-2024-26598, CVE-2023-52674, CVE-2023-52627, CVE-2023-52619,     CVE-2023-52487, CVE-2023-52446, CVE-2024-35835, CVE-2023-52682, CVE-2023-52685, CVE-2023-52694,     CVE-2024-26631)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
193453	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:1321-1)	Nessus	SuSE Local Security Checks	4/18/2024	6/26/2026	high
190650	SUSE SLED12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:0484-1)	Nessus	SuSE Local Security Checks	2/17/2024	6/25/2026	high
200374	Ubuntu 23.10 : Linux kernel vulnerabilities (USN-6819-2)	Nessus	Ubuntu Local Security Checks	6/11/2024	9/24/2025	high

Detections

Analytics

Plugins Search

high

high

high