According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak.(CVE-2024-0584)

    An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access.(CVE-2023-6040)

    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.(CVE-2024-0565)

    A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may     allow an attacker using this library to cause a denial of service problem due to a missing check at a     function return.(CVE-2023-6915)

    An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap.(CVE-2022-48619)

    A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file.(CVE-2024-0340)

    A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow.(CVE-2023-7192)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group().We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b.(CVE-2023-6931)

    A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two     threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline     enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This     could allow a local unprivileged user to escalate their privileges on the system.(CVE-2023-6546)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread.We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1.(CVE-2023-6932)

    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel     information.(CVE-2023-6606)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer     (dmesg).(CVE-2023-6121)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation.The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure.A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.(CVE-2023-1829)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1250 advisory.

    Security Fix(es):

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982,Downfall)

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue ()

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (JIRA:RHEL-1104)

    * [SanityOnly][kernel]BUG: sleeping function called from invalid context at     kernel/locking/spinlock_rt.c:35 at: sock_map_update_elem_sys+0x85/0x2a0 (JIRA:RHEL-17572)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18084)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19463)

    * kernel: hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (JIRA:RHEL-8592)

    * kernel: A heap out-of-bounds write (JIRA:RHEL-18008)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19356)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19454)

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (JIRA:RHEL-8978)

    * kernel: use-after-free in smb2_is_status_io_timeout() (JIRA:RHEL-15167)

    * kernel: various flaws (JIRA:RHEL-16148)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-19001)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20307)

    * RHEL9.0 - s390/qeth: recovery and set offline lose routes and IPv6 addr (JIRA:RHEL-17885)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22092)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19103)

    * 5.14.0-70.87.1.el9_0: aarch64 BUG: arch topology borken / the CLS domain not a subset of the MC domain     (JIRA:RHEL-22501)

    * RHEL-9.0 TEST-17-Setup-struct-perf-event-attr / bz1308907 test failure on Ice Lake (JIRA:RHEL-23085)

    * Unbounded memory usage by TCP for receive buffers (JIRA:RHEL-16127)

    * kernel: use-after-free in IPv4 IGMP (JIRA:RHEL-21648)

    * rbd: don't move requests to the running list on errors (JIRA:RHEL-23861)

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0. (CVE-2021-33631)

  - An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap. (CVE-2022-48619)

  - In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has     a fence use-after-free. (CVE-2023-51042)

  - In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

  - In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in     skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a     forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily :
    mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final     result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1]     general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP     KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-     executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute     Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30     net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48     b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84     24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX:
    ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578     R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12:
    ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS:
    0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000     DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109     ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53
    __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline]     validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626 __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338     dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276     packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119     sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745
    __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto     net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64     arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8692032aa9 Code: 28 00 00 00 75 05 48 83 c4 28 c3     e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff8d685418 EFLAGS: 00000246     ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9 RDX:
    0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000000f4240 R08: 0000000020000540     R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480 R13:
    0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 </TASK> Modules linked in: ---[ end trace     0000000000000000 ]--- RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed     ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea     03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS:
    00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI:
    ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R0 ---truncated--- (CVE-2023-52435)

  - In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open     core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev     = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release     get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev)
    ------------------------------------------------------- In the core-1 uio_unregister_device(), the     device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister,     put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2     will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double     freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.
    (CVE-2023-52439)

  - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer     dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl     in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL     pointer check in gfs2_rgrp_dump() to prevent that. (CVE-2023-52448)

  - An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access. (CVE-2023-6040)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may     allow an attacker using this library to cause a denial of service problem due to a missing check at a     function return. (CVE-2023-6915)

  - A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow. (CVE-2023-7192)

  - A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file. (CVE-2024-0340)

  - An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service. (CVE-2024-0565)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval()     function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes     are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every     iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local     user to cause a denial of service or potentially break NetFilter functionality. (CVE-2024-0607)

  - A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges     to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work     scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit     as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling     complete(). This seems more logical in the first place, as it's the inverse order of what the submitting     thread will do. (CVE-2024-26585)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix NULL     pointer dereference in error path When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after     failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam'     [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer     dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...]     Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0     mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0     fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90     rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390     netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0     do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b (CVE-2024-26595)

  - When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 'Packet     Too Big' (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host. (CVE-2023-52340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0. (CVE-2021-33631)

  - An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap. (CVE-2022-48619)

  - In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has     a fence use-after-free. (CVE-2023-51042)

  - In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

  - In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in     skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a     forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily :
    mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final     result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1]     general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP     KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-     executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute     Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30     net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48     b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84     24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX:
    ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578     R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12:
    ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS:
    0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000     DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109     ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53
    __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline]     validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626 __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338     dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276     packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119     sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745
    __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto     net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64     arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8692032aa9 Code: 28 00 00 00 75 05 48 83 c4 28 c3     e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff8d685418 EFLAGS: 00000246     ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9 RDX:
    0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000000f4240 R08: 0000000020000540     R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480 R13:
    0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 </TASK> Modules linked in: ---[ end trace     0000000000000000 ]--- RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed     ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea     03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS:
    00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI:
    ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R0 ---truncated--- (CVE-2023-52435)

  - In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open     core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev     = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release     get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev)
    ------------------------------------------------------- In the core-1 uio_unregister_device(), the     device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister,     put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2     will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double     freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.
    (CVE-2023-52439)

  - An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access. (CVE-2023-6040)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow. (CVE-2023-7192)

  - A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file. (CVE-2024-0340)

  - An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service. (CVE-2024-0565)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval()     function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes     are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every     iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local     user to cause a denial of service or potentially break NetFilter functionality. (CVE-2024-0607)

  - A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges     to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 'Packet     Too Big' (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host. (CVE-2023-52340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of kernel installed on the remote host is prior to 5.4.235-144.344. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-043 advisory.

    A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

    It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return     Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is     dynamically partitioned between non-idle threads.  This allows an attacker to control speculative     execution on the adjacent thread. (CVE-2022-27672)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_tproxy: restrict to prerouting hook (CVE-2022-50001)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0458)

    Due to a type confusion during initializations, the tun and tap sockets in the Linux Kernel have their     socket UID hardcoded to 0, i.e. root. While it will be often correct, as TUN/TAP devices require     CAP_NET_ADMIN, it may not always be the case. The socket UID may be used for network filtering and     routing, thus TUN/TAP sockets may be incorrectly managed, potentially bypassing network filters based on     UID. (CVE-2023-1076)

    kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

    The upstream bug report describes this issue as follows:

    A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

    When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation()     determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch     targetinjection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for     performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection     against which STIBP protects. (CVE-2023-1998)

    A use-after-free flaw was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in the SCSI     sub-component in the Linux Kernel. This issue could allow an attacker to leak kernel internal information.
    (CVE-2023-2162)

    In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

    A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service. (CVE-2023-2985)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing a font->width and     font->height greater than 32 to the fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs, leading to undefined behavior and possible denial of service. (CVE-2023-3161)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal     kernel information. (CVE-2023-3567)

    An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix mremap after fork null-deref (CVE-2023-52646)

    In the Linux kernel, the following vulnerability has been resolved:

    net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (CVE-2023-52703)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix underflow in second superblock position calculations (CVE-2023-52705)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Fix use-after-free in ep_remove_wait_queue() (CVE-2023-52707)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: mmc_spi: fix error handling in mmc_spi_probe() (CVE-2023-52708)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)

    In the Linux kernel, the following vulnerability has been resolved:

    net: USB: Fix wrong-direction WARNING in plusb.c (CVE-2023-52742)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/IPoIB: Fix legacy IPoIB due to wrong number of queues (CVE-2023-52745)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swapfile: add cond_resched() in get_swap_pages() (CVE-2023-52932)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (CVE-2023-52973)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (CVE-2023-52974)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: fix potential NULL deref in efi_mem_reserve_persistent (CVE-2023-52976)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix flow memory leak in ovs_flow_cmd_new (CVE-2023-52977)

    In the Linux kernel, the following vulnerability has been resolved:

    squashfs: harden sanity check in squashfs_read_xattr_id_table (CVE-2023-52979)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix function prototype mismatch for ext4_feat_ktype (CVE-2023-53224)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: Fix kmemleak in watchdog_cdev_register (CVE-2023-53234)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/drivers/hisi: Drop second sensor hi3660 (CVE-2023-53242)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ensure that VID header offset + VID header size <= alloc, size (CVE-2023-53265)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (CVE-2023-53271)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files (CVE-2023-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (CVE-2023-53307)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix warning and UAF when destroy the MR list (CVE-2023-53427)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Don't attach if enclosure has no components (CVE-2023-53431)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: free iio for atombios when driver shutdown (CVE-2023-53453)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (CVE-2023-53477)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (CVE-2023-53481)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not bother merging very long extents (CVE-2023-53506)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (CVE-2023-53521)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (CVE-2023-53590)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses (CVE-2023-53675)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Detect system inodes linked into directory hierarchy (CVE-2023-53695)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iocost: fix divide by 0 error in calc_lcoefs() (CVE-2023-53783)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix use-after-free when volume resizing failed (CVE-2023-53800)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (CVE-2023-53803)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (CVE-2023-53826)

    In the Linux kernel, the following vulnerability has been resolved:

    hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (CVE-2023-53862)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Destroy target device if coalesced MMIO unregistration fails (CVE-2023-54024)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: essiv - Handle EBUSY correctly (CVE-2023-54046)

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix possible null-ptr-deref in ubi_free_volume() (CVE-2023-54087)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests (CVE-2023-54108)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix out-of-bounds access in tty_driver_lookup_tty() (CVE-2023-54198)

    In the Linux kernel, the following vulnerability has been resolved:

    Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix lost destroy smbd connection when MR allocate failed (CVE-2023-54260)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: refuse to create ea block when umounted (CVE-2023-54305)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tls: avoid hanging tasks on the tx_lock (CVE-2023-54306)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: don't corrupt the zero page (CVE-2023-54317)

    kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (CVE-2023-7324)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.102-61.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-015 advisory.

    A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

    It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return     Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is     dynamically partitioned between non-idle threads.  This allows an attacker to control speculative     execution on the adjacent thread. (CVE-2022-27672)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_tproxy: restrict to prerouting hook (CVE-2022-50001)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix potential null-ptr-deref due to drmm_mode_config_init() (CVE-2022-50556)

    Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as     well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0458)

    Due to a type confusion during initializations, the tun and tap sockets in the Linux Kernel have their     socket UID hardcoded to 0, i.e. root. While it will be often correct, as TUN/TAP devices require     CAP_NET_ADMIN, it may not always be the case. The socket UID may be used for network filtering and     routing, thus TUN/TAP sockets may be incorrectly managed, potentially bypassing network filters based on     UID. (CVE-2023-1076)

    kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

    The upstream bug report describes this issue as follows:

    A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

    A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local     privilege escalation.

    The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free     vulnerability due a race condition with fixed files getting unregistered.

    We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8. (CVE-2023-1872)

    When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation()     determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch     targetinjection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for     performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection     against which STIBP protects. (CVE-2023-1998)

    In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

    A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service. (CVE-2023-2985)

    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix mremap after fork null-deref (CVE-2023-52646)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() (CVE-2023-52702)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Fix use-after-free in ep_remove_wait_queue() (CVE-2023-52707)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (CVE-2023-52735)

    In the Linux kernel, the following vulnerability has been resolved:

    Fix page corruption caused by racy check in __free_pages (CVE-2023-52739)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix use-after-free in rdata->read_into_pages() (CVE-2023-52741)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() (CVE-2023-52746)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: prevent underflow of locked_vm via exec() (CVE-2023-53171)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: uhci: fix memory leak with using debugfs_lookup() (CVE-2023-53197)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (CVE-2023-53200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: domains: fix memory leak with using debugfs_lookup() (CVE-2023-53202)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: Fix function prototype mismatch for ext4_feat_ktype (CVE-2023-53224)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: Fix kmemleak in watchdog_cdev_register (CVE-2023-53234)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (CVE-2023-53250)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (CVE-2023-53259)

    In the Linux kernel, the following vulnerability has been resolved:

    misc: vmw_balloon: fix memory leak with using debugfs_lookup() (CVE-2023-53279)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files (CVE-2023-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (CVE-2023-53307)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: fix memory leak with using debugfs_lookup() (CVE-2023-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: dd: fix memory leak with using debugfs_lookup() (CVE-2023-53390)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/blktrace: fix memory leak with using debugfs_lookup() (CVE-2023-53408)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: component: fix memory leak with using debugfs_lookup() (CVE-2023-53409)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: EM: fix memory leak with using debugfs_lookup() (CVE-2023-53411)

    In the Linux kernel, the following vulnerability has been resolved:

    objtool: Fix memory leak in create_static_call_sections() (CVE-2023-53423)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix warning and UAF when destroy the MR list (CVE-2023-53427)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (CVE-2023-53477)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Fix error unwind in iommu_group_alloc() (CVE-2023-53482)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not bother merging very long extents (CVE-2023-53506)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (CVE-2023-53590)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix resource leak in device_add() (CVE-2023-53594)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip: Fix refcount leak in platform_irqchip_probe (CVE-2023-53610)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Detect system inodes linked into directory hierarchy (CVE-2023-53695)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Handle race between rb_move_tail and rb_check_pages (CVE-2023-53709)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iocost: fix divide by 0 error in calc_lcoefs() (CVE-2023-53783)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: loop_set_status_from_info() check before assignment (CVE-2023-53820)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: early: xhci-dbc: Fix a potential out-of-bound memory access (CVE-2023-53840)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Destroy target device if coalesced MMIO unregistration fails (CVE-2023-54024)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: essiv - Handle EBUSY correctly (CVE-2023-54046)

    In the Linux kernel, the following vulnerability has been resolved:

    leds: led-core: Fix refcount leak in of_led_get() (CVE-2023-54190)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix out-of-bounds access in tty_driver_lookup_tty() (CVE-2023-54198)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: fix table blob use-after-free (CVE-2023-54243)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix lost destroy smbd connection when MR allocate failed (CVE-2023-54260)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: refuse to create ea block when umounted (CVE-2023-54305)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tls: avoid hanging tasks on the tx_lock (CVE-2023-54306)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: don't corrupt the zero page (CVE-2023-54317)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential null-ptr-deref in device_add() (CVE-2023-54321)

    kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
193612	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2024-1527)	Nessus	Huawei Local Security Checks	4/19/2024	9/26/2025	high
191901	RHEL 9 : kernel (RHSA-2024:1250)	Nessus	Red Hat Local Security Checks	3/12/2024	3/6/2025	critical
193011	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2024-1509)	Nessus	Huawei Local Security Checks	4/8/2024	5/30/2024	high
193014	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2024-1488)	Nessus	Huawei Local Security Checks	4/8/2024	5/30/2024	high
173230	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-043 (ALASKERNEL-5.4-2023-043)	Nessus	Amazon Linux Local Security Checks	3/22/2023	2/9/2026	high
173235	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-015 (ALASKERNEL-5.15-2023-015)	Nessus	Amazon Linux Local Security Checks	3/22/2023	2/9/2026	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high