The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6952-1 advisory.

    Benedict Schlter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted     hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP.
    This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose     sensitive information or possibly execute arbitrary code in the trusted execution environment.
    (CVE-2024-25742)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - M68K architecture;

    - OpenRISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Accessibility subsystem;

    - Bluetooth drivers;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - FireWire subsystem;

    - EFI core;

    - Qualcomm firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Microsoft Hyper-V drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - EEPROM drivers;

    - MMC subsystem;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Device tree and open firmware driver;

    - HiSilicon SoC PMU drivers;

    - PHY drivers;

    - Pin controllers subsystem;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Thermal drivers;

    - TTY drivers;

    - Userspace I/O drivers;

    - USB subsystem;

    - DesignWare USB3 driver;

    - ACRN Hypervisor Service Module driver;

    - Virtio drivers;

    - 9P distributed file system;

    - BTRFS file system;

    - eCrypt file system;

    - EROFS file system;

    - File systems infrastructure;

    - GFS2 file system;

    - JFFS2 file system;

    - Network file systems library;

    - Network file system client;

    - Network file system server daemon;

    - NILFS2 file system;

    - Proc file system;

    - SMB network file system;

    - Tracing file system;

    - Mellanox drivers;

    - Memory management;

    - Socket messages infrastructure;

    - Slab allocator;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - Core kernel;

    - BPF subsystem;

    - DMA mapping infrastructure;

    - RCU subsystem;

    - Dynamic debug library;

    - KUnit library;

    - Maple Tree data structure library;

    - Heterogeneous memory management;

    - Amateur Radio drivers;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NET/ROM layer;

    - NFC subsystem;

    - NSH protocol;

    - Open vSwitch;

    - Phonet protocol;

    - SMC sockets;

    - TIPC protocol;

    - Unix domain sockets;

    - Wireless networking;

    - Key management;

    - ALSA framework;

    - HD-audio driver;

    - Kirkwood ASoC drivers;

    - MediaTek ASoC drivers; (CVE-2024-38601, CVE-2024-36935, CVE-2024-35991, CVE-2024-36032, CVE-2024-35988,     CVE-2024-36886, CVE-2024-36913, CVE-2024-36928, CVE-2024-38553, CVE-2024-36927, CVE-2024-38615,     CVE-2024-36958, CVE-2024-36977, CVE-2024-36889, CVE-2024-38554, CVE-2024-38590, CVE-2024-42134,     CVE-2024-35857, CVE-2024-35850, CVE-2024-35986, CVE-2024-36921, CVE-2024-38569, CVE-2024-36966,     CVE-2024-38542, CVE-2024-38585, CVE-2024-36884, CVE-2024-36006, CVE-2024-38577, CVE-2024-36016,     CVE-2024-38584, CVE-2024-36887, CVE-2024-38598, CVE-2024-35994, CVE-2024-38603, CVE-2024-35998,     CVE-2024-27401, CVE-2024-35852, CVE-2024-36944, CVE-2024-38572, CVE-2024-36917, CVE-2024-36943,     CVE-2024-36009, CVE-2024-38587, CVE-2024-35949, CVE-2024-36945, CVE-2024-36004, CVE-2024-36919,     CVE-2024-27398, CVE-2024-38582, CVE-2024-35847, CVE-2024-38580, CVE-2024-38602, CVE-2024-36916,     CVE-2024-36903, CVE-2024-38555, CVE-2024-36952, CVE-2024-38589, CVE-2024-27394, CVE-2024-36933,     CVE-2024-36975, CVE-2024-38591, CVE-2024-38612, CVE-2024-36939, CVE-2024-35983, CVE-2024-38607,     CVE-2024-36929, CVE-2024-35849, CVE-2024-36941, CVE-2024-35858, CVE-2024-38599, CVE-2024-35996,     CVE-2024-36031, CVE-2024-36931, CVE-2024-35990, CVE-2024-35851, CVE-2024-38556, CVE-2024-36000,     CVE-2024-36910, CVE-2024-38573, CVE-2024-36906, CVE-2024-36951, CVE-2024-38604, CVE-2024-38613,     CVE-2024-38547, CVE-2024-36014, CVE-2024-36949, CVE-2024-36033, CVE-2024-38597, CVE-2024-36880,     CVE-2024-38594, CVE-2024-36894, CVE-2024-38546, CVE-2024-36947, CVE-2024-38541, CVE-2024-35989,     CVE-2024-27399, CVE-2024-38550, CVE-2024-36922, CVE-2024-36008, CVE-2024-38540, CVE-2024-36924,     CVE-2024-36892, CVE-2024-38549, CVE-2024-36882, CVE-2024-36908, CVE-2024-38566, CVE-2024-36005,     CVE-2024-38583, CVE-2024-36968, CVE-2024-36017, CVE-2024-38565, CVE-2024-36881, CVE-2024-38611,     CVE-2024-36897, CVE-2024-38560, CVE-2024-36923, CVE-2024-38575, CVE-2024-36899, CVE-2024-38570,     CVE-2024-36898, CVE-2024-36896, CVE-2024-38559, CVE-2024-38588, CVE-2024-38606, CVE-2024-38551,     CVE-2024-36891, CVE-2024-38567, CVE-2024-36895, CVE-2024-35993, CVE-2024-38552, CVE-2024-36925,     CVE-2024-36964, CVE-2024-36888, CVE-2024-36956, CVE-2024-36946, CVE-2024-38600, CVE-2024-35997,     CVE-2024-36912, CVE-2024-35984, CVE-2024-35848, CVE-2024-38545, CVE-2024-38563, CVE-2024-36918,     CVE-2024-36001, CVE-2024-36957, CVE-2024-38576, CVE-2024-36030, CVE-2024-38574, CVE-2024-36963,     CVE-2024-36890, CVE-2024-36960, CVE-2024-36901, CVE-2024-38614, CVE-2024-35859, CVE-2024-38593,     CVE-2024-36904, CVE-2024-36012, CVE-2024-38578, CVE-2024-36011, CVE-2024-36930, CVE-2024-36938,     CVE-2024-36893, CVE-2024-35987, CVE-2024-36905, CVE-2024-35853, CVE-2024-36003, CVE-2024-38562,     CVE-2024-38617, CVE-2024-35855, CVE-2024-36965, CVE-2024-38596, CVE-2024-38558, CVE-2024-38568,     CVE-2024-36955, CVE-2024-36029, CVE-2024-36967, CVE-2024-36940, CVE-2024-38595, CVE-2024-36028,     CVE-2024-38610, CVE-2024-36911, CVE-2024-35999, CVE-2024-35854, CVE-2024-38571, CVE-2024-38548,     CVE-2024-36948, CVE-2024-36002, CVE-2024-36961, CVE-2024-36900, CVE-2024-36932, CVE-2024-36902,     CVE-2024-35992, CVE-2024-36914, CVE-2024-38592, CVE-2024-38616, CVE-2024-27400, CVE-2024-36937,     CVE-2024-36920, CVE-2024-38586, CVE-2024-36909, CVE-2024-35846, CVE-2024-39482, CVE-2024-38579,     CVE-2024-38539, CVE-2024-27395, CVE-2024-36962, CVE-2024-36013, CVE-2024-27396, CVE-2024-38557,     CVE-2024-36953, CVE-2024-41011, CVE-2023-52882, CVE-2024-36969, CVE-2024-36007, CVE-2024-35856,     CVE-2024-38605, CVE-2024-36915, CVE-2024-36979, CVE-2024-36954, CVE-2024-38538, CVE-2024-36950,     CVE-2024-36926, CVE-2024-38544, CVE-2024-36959, CVE-2024-38561, CVE-2024-36883, CVE-2024-36936,     CVE-2024-38564, CVE-2024-38543, CVE-2024-36934, CVE-2024-35947, CVE-2024-38620)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6952-2 advisory.

    Benedict Schlter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted     hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP.
    This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose     sensitive information or possibly execute arbitrary code in the trusted execution environment.
    (CVE-2024-25742)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - M68K architecture;

    - OpenRISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Accessibility subsystem;

    - Bluetooth drivers;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - FireWire subsystem;

    - EFI core;

    - Qualcomm firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Microsoft Hyper-V drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - EEPROM drivers;

    - MMC subsystem;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Device tree and open firmware driver;

    - HiSilicon SoC PMU drivers;

    - PHY drivers;

    - Pin controllers subsystem;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Thermal drivers;

    - TTY drivers;

    - Userspace I/O drivers;

    - USB subsystem;

    - DesignWare USB3 driver;

    - ACRN Hypervisor Service Module driver;

    - Virtio drivers;

    - 9P distributed file system;

    - BTRFS file system;

    - eCrypt file system;

    - EROFS file system;

    - File systems infrastructure;

    - GFS2 file system;

    - JFFS2 file system;

    - Network file systems library;

    - Network file system client;

    - Network file system server daemon;

    - NILFS2 file system;

    - Proc file system;

    - SMB network file system;

    - Tracing file system;

    - Mellanox drivers;

    - Memory management;

    - Socket messages infrastructure;

    - Slab allocator;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - Core kernel;

    - BPF subsystem;

    - DMA mapping infrastructure;

    - RCU subsystem;

    - Dynamic debug library;

    - KUnit library;

    - Maple Tree data structure library;

    - Heterogeneous memory management;

    - Amateur Radio drivers;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NET/ROM layer;

    - NFC subsystem;

    - NSH protocol;

    - Open vSwitch;

    - Phonet protocol;

    - SMC sockets;

    - TIPC protocol;

    - Unix domain sockets;

    - Wireless networking;

    - Key management;

    - ALSA framework;

    - HD-audio driver;

    - Kirkwood ASoC drivers;

    - MediaTek ASoC drivers; (CVE-2024-38601, CVE-2024-36935, CVE-2024-35991, CVE-2024-36032, CVE-2024-35988,     CVE-2024-36886, CVE-2024-36913, CVE-2024-36928, CVE-2024-38553, CVE-2024-36927, CVE-2024-38615,     CVE-2024-36958, CVE-2024-36977, CVE-2024-36889, CVE-2024-38554, CVE-2024-38590, CVE-2024-42134,     CVE-2024-35857, CVE-2024-35850, CVE-2024-35986, CVE-2024-36921, CVE-2024-38569, CVE-2024-36966,     CVE-2024-38542, CVE-2024-38585, CVE-2024-36884, CVE-2024-36006, CVE-2024-38577, CVE-2024-36016,     CVE-2024-38584, CVE-2024-36887, CVE-2024-38598, CVE-2024-35994, CVE-2024-38603, CVE-2024-35998,     CVE-2024-27401, CVE-2024-35852, CVE-2024-36944, CVE-2024-38572, CVE-2024-36917, CVE-2024-36943,     CVE-2024-36009, CVE-2024-38587, CVE-2024-35949, CVE-2024-36945, CVE-2024-36004, CVE-2024-36919,     CVE-2024-27398, CVE-2024-38582, CVE-2024-35847, CVE-2024-38580, CVE-2024-38602, CVE-2024-36916,     CVE-2024-36903, CVE-2024-38555, CVE-2024-36952, CVE-2024-38589, CVE-2024-27394, CVE-2024-36933,     CVE-2024-36975, CVE-2024-38591, CVE-2024-38612, CVE-2024-36939, CVE-2024-35983, CVE-2024-38607,     CVE-2024-36929, CVE-2024-35849, CVE-2024-36941, CVE-2024-35858, CVE-2024-38599, CVE-2024-35996,     CVE-2024-36031, CVE-2024-36931, CVE-2024-35990, CVE-2024-35851, CVE-2024-38556, CVE-2024-36000,     CVE-2024-36910, CVE-2024-38573, CVE-2024-36906, CVE-2024-36951, CVE-2024-38604, CVE-2024-38613,     CVE-2024-38547, CVE-2024-36014, CVE-2024-36949, CVE-2024-36033, CVE-2024-38597, CVE-2024-36880,     CVE-2024-38594, CVE-2024-36894, CVE-2024-38546, CVE-2024-36947, CVE-2024-38541, CVE-2024-35989,     CVE-2024-27399, CVE-2024-38550, CVE-2024-36922, CVE-2024-36008, CVE-2024-38540, CVE-2024-36924,     CVE-2024-36892, CVE-2024-38549, CVE-2024-36882, CVE-2024-36908, CVE-2024-38566, CVE-2024-36005,     CVE-2024-38583, CVE-2024-36968, CVE-2024-36017, CVE-2024-38565, CVE-2024-36881, CVE-2024-38611,     CVE-2024-36897, CVE-2024-38560, CVE-2024-36923, CVE-2024-38575, CVE-2024-36899, CVE-2024-38570,     CVE-2024-36898, CVE-2024-36896, CVE-2024-38559, CVE-2024-38588, CVE-2024-38606, CVE-2024-38551,     CVE-2024-36891, CVE-2024-38567, CVE-2024-36895, CVE-2024-35993, CVE-2024-38552, CVE-2024-36925,     CVE-2024-36964, CVE-2024-36888, CVE-2024-36956, CVE-2024-36946, CVE-2024-38600, CVE-2024-35997,     CVE-2024-36912, CVE-2024-35984, CVE-2024-35848, CVE-2024-38545, CVE-2024-38563, CVE-2024-36918,     CVE-2024-36001, CVE-2024-36957, CVE-2024-38576, CVE-2024-36030, CVE-2024-38574, CVE-2024-36963,     CVE-2024-36890, CVE-2024-36960, CVE-2024-36901, CVE-2024-38614, CVE-2024-35859, CVE-2024-38593,     CVE-2024-36904, CVE-2024-36012, CVE-2024-38578, CVE-2024-36011, CVE-2024-36930, CVE-2024-36938,     CVE-2024-36893, CVE-2024-35987, CVE-2024-36905, CVE-2024-35853, CVE-2024-36003, CVE-2024-38562,     CVE-2024-38617, CVE-2024-35855, CVE-2024-36965, CVE-2024-38596, CVE-2024-38558, CVE-2024-38568,     CVE-2024-36955, CVE-2024-36029, CVE-2024-36967, CVE-2024-36940, CVE-2024-38595, CVE-2024-36028,     CVE-2024-38610, CVE-2024-36911, CVE-2024-35999, CVE-2024-35854, CVE-2024-38571, CVE-2024-38548,     CVE-2024-36948, CVE-2024-36002, CVE-2024-36961, CVE-2024-36900, CVE-2024-36932, CVE-2024-36902,     CVE-2024-35992, CVE-2024-36914, CVE-2024-38592, CVE-2024-38616, CVE-2024-27400, CVE-2024-36937,     CVE-2024-36920, CVE-2024-38586, CVE-2024-36909, CVE-2024-35846, CVE-2024-39482, CVE-2024-38579,     CVE-2024-38539, CVE-2024-27395, CVE-2024-36962, CVE-2024-36013, CVE-2024-27396, CVE-2024-38557,     CVE-2024-36953, CVE-2024-41011, CVE-2023-52882, CVE-2024-36969, CVE-2024-36007, CVE-2024-35856,     CVE-2024-38605, CVE-2024-36915, CVE-2024-36979, CVE-2024-36954, CVE-2024-38538, CVE-2024-36950,     CVE-2024-36926, CVE-2024-38544, CVE-2024-36959, CVE-2024-38561, CVE-2024-36883, CVE-2024-36936,     CVE-2024-38564, CVE-2024-38543, CVE-2024-36934, CVE-2024-35947, CVE-2024-38620)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.223-211.872. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-066 advisory.

    A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix a use-after-free (CVE-2022-48666)

    In the Linux kernel, the following vulnerability has been resolved:

    net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new     (CVE-2023-52887)

    In the Linux kernel, the following vulnerability has been resolved:

    net: relax socket state check at accept time. (CVE-2024-36484)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent NULL dereference in ip6_output() (CVE-2024-36901)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (CVE-2024-36938)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: sch_multiq: fix possible OOB write in multiq_tune() (CVE-2024-36978)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix potential kernel bug due to lack of writeback flag waiting (CVE-2024-37078)

    In the Linux kernel, the following vulnerability has been resolved:

    r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586)

    In the Linux kernel, the following vulnerability has been resolved:

    usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix deadlock in smb2_find_smb_tcon() (CVE-2024-39468)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors (CVE-2024-39469)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix variable length array abuse in btree_iter (CVE-2024-39482)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CVE-2024-39487)

    In the Linux kernel, the following vulnerability has been resolved:

    vmci: prevent speculation leaks by sanitizing event in event_deliver() (CVE-2024-39499)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (CVE-2024-39503)

    In the Linux kernel, the following vulnerability has been resolved:

    liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CVE-2024-39506)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: remove unnecessary WARN_ON() in implement() (CVE-2024-39509)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CVE-2024-40901)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix possible race in __fib6_drop_pcpu_from() (CVE-2024-40905)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode() (CVE-2024-40934)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Return right value in iommu_sva_bind_device() (CVE-2024-40945)

    In the Linux kernel, the following vulnerability has been resolved:

    ima: Avoid blocking in RCU read-side critical section (CVE-2024-40947)

    In the Linux kernel, the following vulnerability has been resolved:

    netns: Make get_net_ns() handle zero refcount net (CVE-2024-40958)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CVE-2024-40959)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent possible NULL deref in fib6_nh_init() (CVE-2024-40961)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qedi: Fix crash while reading debugfs attribute (CVE-2024-40978)

    In the Linux kernel, the following vulnerability has been resolved:

    drop_monitor: replace spin_lock by raw_spin_lock (CVE-2024-40980)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: force a dst refcount before doing decryption (CVE-2024-40983)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Revert ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine. (CVE-2024-40984)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: fix UBSAN warning in kv_dpm.c (CVE-2024-40988)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Add check for srq max_sge attribute (CVE-2024-40990)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995)

    In the Linux kernel, the following vulnerability has been resolved:

    block/ioctl: prefer different overflow check (CVE-2024-41000)

    In the Linux kernel, the following vulnerability has been resolved:

    netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: avoid too many retransmit packets (CVE-2024-41007)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009)

    In the Linux kernel, the following vulnerability has been resolved:

    filelock: Remove locks reliably when fcntl/close race is detected (CVE-2024-41012)

    In the Linux kernel, the following vulnerability has been resolved:

    filelock: Fix fcntl/close race recovery compat path (CVE-2024-41020)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (CVE-2024-41022)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix kernel bug on rename operation of broken directory (CVE-2024-41034)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CVE-2024-41035)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CVE-2024-41041)

    In the Linux kernel, the following vulnerability has been resolved:

    ppp: reject claimed-as-LCP but actually malformed packets (CVE-2024-41044)

    In the Linux kernel, the following vulnerability has been resolved:

    filelock: fix potential use-after-free in posix_lock_inode (CVE-2024-41049)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: fix uninit-value in copy_name (CVE-2024-41059)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: fix validation of block size (CVE-2024-41077)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix quota root leak after quota disable failure (CVE-2024-41078)

    In the Linux kernel, the following vulnerability has been resolved:

    ila: block BH in ila_output() (CVE-2024-41081)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: Fix double free on error (CVE-2024-41087)

    kernel: virtio-net: tap: mlx5_core short frame denial of service (CVE-2024-41090)

    kernel: virtio-net: tun: mlx5_core short frame denial of service (CVE-2024-41091)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Fix potential UAF by revoke of fence registers (CVE-2024-41092)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CVE-2024-41097)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (CVE-2024-42070)

    In the Linux kernel, the following vulnerability has been resolved:

    net: can: j1939: Initialize unused data in j1939_send_one() (CVE-2024-42076)

    In the Linux kernel, the following vulnerability has been resolved:

    xdp: Remove WARN() from __xdp_reg_mem_model() (CVE-2024-42082)

    In the Linux kernel, the following vulnerability has been resolved:

    ftruncate: pass a signed offset (CVE-2024-42084)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CVE-2024-42090)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: stop playing stack games in profile_pc() (CVE-2024-42096)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes (CVE-2024-42101)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (CVE-2024-42102)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: add missing check for inode numbers on directory entries (CVE-2024-42104)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix inode number range checks (CVE-2024-42105)

    In the Linux kernel, the following vulnerability has been resolved:

    inet_diag: Initialize pad field in struct inet_diag_req_v2 (CVE-2024-42106)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qedf: Make qedf_execute_tmf() non-preemptible (CVE-2024-42124)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: avoid overflows in dirty throttling logic (CVE-2024-42131)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/core: Implement a limit on UMAD receive List (CVE-2024-42145)

    In the Linux kernel, the following vulnerability has been resolved:

    bnx2x: Fix multiple UBSAN array-index-out-of-bounds (CVE-2024-42148)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: fix a possible leak when destroy a ctrl during qp establishment (CVE-2024-42152)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp_metrics: validate source addr length (CVE-2024-42154)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (CVE-2024-42161)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: aead,cipher - zeroize key buffer after use (CVE-2024-42229)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix race between delayed_work() and ceph_monc_stop() (CVE-2024-42232)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: serial: mos7840: fix crash on resume (CVE-2024-42244)

    In the Linux kernel, the following vulnerability has been resolved:

    wireguard: allowedips: avoid unaligned 64-bit memory accesses (CVE-2024-42247)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-643 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    md: fix kmemleak of rdev->serial (CVE-2024-26900)

    In the Linux kernel, the following vulnerability has been resolved:

    dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)

    In the Linux kernel, the following vulnerability has been resolved:

    smb3: missing lock when picking channel (CVE-2024-35999)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (CVE-2024-36017)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (CVE-2024-36028)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: use memalloc_nofs_save() in page_cache_ra_order() (CVE-2024-36882)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix out-of-bounds access in ops_init (CVE-2024-36883)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slab: make __free(kfree) accept error pointers (CVE-2024-36890)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix access violation during port device removal (CVE-2024-36896)

    In the Linux kernel, the following vulnerability has been resolved:

    gpiolib: cdev: fix uninitialised kfifo (CVE-2024-36898)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent NULL dereference in ip6_output() (CVE-2024-36901)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CVE-2024-36902)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (CVE-2024-36904)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (CVE-2024-36905)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted (CVE-2024-36909)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Don't free decrypted memory (CVE-2024-36910)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (CVE-2024-36912)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iocost: avoid out of bounds shift (CVE-2024-36916)

    In the Linux kernel, the following vulnerability has been resolved:

    block: fix overflow in blk_ioctl_discard() (CVE-2024-36917)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Check bloom filter map value size (CVE-2024-36918)

    In the Linux kernel, the following vulnerability has been resolved:

    net: core: reject skb_copy(_expand) for fraglist GSO skbs (CVE-2024-36929)

    In the Linux kernel, the following vulnerability has been resolved:

    nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (CVE-2024-36933)

    In the Linux kernel, the following vulnerability has been resolved:

    xdp: use flags field to disambiguate broadcast redirect (CVE-2024-36937)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (CVE-2024-36938)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: Handle error of rpc_proc_register() in nfs_net_init(). (CVE-2024-36939)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: core: delete incorrect free in pinctrl_enable() (CVE-2024-36940)

    In the Linux kernel, the following vulnerability has been resolved:

    Reapply drm/qxl: simplify qxl_fence_wait (CVE-2024-36944)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (CVE-2024-36953)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (CVE-2024-36959)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    kernel: cpu/hotplug: Don't offline the last non-isolated CPU(CVE-2023-52831)

    kernel: IB/mlx5: Fix initializing CQ fragments buffer(CVE-2021-47261)

    kernel: drm: Fix use-after-free read in drm_getunique()(CVE-2021-47280)

    kernel: selinux: avoid dereference of garbage after mount failure(CVE-2024-35904)

    kernel: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()(CVE-2021-47473)

    kernel: block: fix overflow in blk_ioctl_discard()(CVE-2024-36917)

    kernel: PCI/PM: Drain runtime-idle callbacks before driver removal(CVE-2024-35809)

    kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET(CVE-2023-52813)

    kernel: thermal: core: prevent potential string overflow(CVE-2023-52868)

    kernel: udf: Fix NULL pointer dereference in udf_symlink function(CVE-2021-47353)

    kernel: pinctrl: core: delete incorrect free in pinctrl_enable()(CVE-2024-36940)

    kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes(CVE-2024-35789)

    kernel: scsi: mpt3sas: Fix kernel panic during drive powercycle test(CVE-2021-47565)

    kernel: isofs: Fix out of bound access for corrupted isofs image(CVE-2021-47478)

    kernel: ext4: fix corruption during on-line resize(CVE-2024-35807)

    kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload(CVE-2024-36919)

    kernel: perf/core: Bail out early if the request AUX area is out of bound(CVE-2023-52835)

    kernel: md/dm-raid: don#39;t call md_reap_sync_thread() directly(CVE-2024-35808)

    kernel: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe(CVE-2022-48715)

    kernel: mm, slub: fix potential memoryleak in kmem_cache_open()(CVE-2021-47466)

    kernel: ext4: fix mb_cache_entry#39;s e_refcnt leak in ext4_xattr_block_cache_find()(CVE-2024-39276)

    kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up(CVE-2024-36952)

    kernel: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()(CVE-2023-52752)

    kernel:fix lockup in dm_exception_table_exit  There was reported lockup(CVE-2024-35805)

    kernel:block: prevent division by zero in blk_rq_stat_sum()(CVE-2024-35925)

    kernel:scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()  (CVE-2024-35930)

    kernel:scsi: qedf: Ensure the copied buf is NUL terminated(CVE-2024-38559)

    kernel:kvm: avoid speculation-based attacks from out-of-range memslot accesses(CVE-2021-47277)

    kernel:net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()(CVE-2021-47541)

    kernel:usbnet: sanity check for maxpacket(CVE-2021-47495)

    kernel:kprobes: Fix possible use-after-free issue on kprobe registration(CVE-2024-35955)

    kernel:tty: n_gsm: fix possible out-of-bounds in gsm0_receive()(CVE-2024-36016)

    kernel:tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets(CVE-2024-36905)

    kernel:tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().(CVE-2024-36904)

    kernel:scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()(CVE-2024-36924)

    kernel:net/mlx5: Properly link new fs rules into the tree(CVE-2024-35960)

    kernel:net: fix __dst_negative_advice() race(CVE-2024-36971)

    kernel:regmap: Fix possible double-free in regcache_rbtree_exit()(CVE-2021-47483)

    kernel:block: Fix wrong offset in bio_truncate()(CVE-2022-48747)

    kernel:ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.(CVE-2024-40984)

    kernel:igb: Fix use-after-free error during reset(CVE-2021-47301)

    kernel:netfilter: complete validation of user input(CVE-2024-35962)

    kernel:llc: verify mac len before reading mac header(CVE-2023-52843)

    kernel:tcp: Fix shift-out-of-bounds in dctcp_update_alpha().(CVE-2024-37356)

    kernel:kdb: Fix buffer overflow during tab-complete(CVE-2024-39480)

    kernel:virtio: delete vq in vp_find_vqs_msix() when request_irq() fails(CVE-2024-37353)

    kernel:net/mlx5e: Avoid field-overflowing memcpy()(CVE-2022-48744)

    kernel:ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr(CVE-2024-35969)

    kernel:ring-buffer: Fix a race between readers and resize checks(CVE-2024-38601)

    kernel:af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg(CVE-2024-38596)

    kernel:HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up(CVE-2024-35997)

    kernel:i2c: smbus: fix NULL function pointer dereference(CVE-2024-35984)

    kernel:net: bridge: xmit: make sure we have at least eth header len bytes(CVE-2024-38538)

    kernel:inet_diag: fix kernel-infoleak for UDP sockets(CVE-2021-47597)

    kernel:nfp: Fix memory leak in nfp_cpp_area_cache_add()(CVE-2021-47516)

    kernel:erspan: make sure erspan_base_hdr is present in skb-head(CVE-2024-35888)

    kernel:netfilter: validate user input for expected length(CVE-2024-35896)

    kernel:net: cdc_eem: fix tx fixup skb leak(CVE-2021-47236)

    kernel:ipvlan: add ipvlan_route_v6_outbound() helper(CVE-2023-52796)

    kernel:RDMA: Verify port when creating flow rule(CVE-2021-47265)

    kernel:ipv6: Fix infinite recursion in fib6_dump_done().(CVE-2024-35886)

    kernel:i40e: Do not use WQ_MEM_RECLAIM flag for workqueue(CVE-2024-36004)

    kernel:net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path(CVE-2021-47438)

    kernel:net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path(CVE-2023-52703)

    kernel:net/mlx5e: fix a double-free in arfs_create_groups(CVE-2024-35835)

    kernel:i40e: Fix queues reservation for XDP(CVE-2021-47619)

    kernel:sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb(CVE-2021-47397)

    kernel:calipso: fix memory leak in netlbl_calipso_add_pass()(CVE-2023-52698)

    kernel:ftrace: Fix possible use-after-free issue in ftrace_location()(CVE-2024-38588)

    kernel:i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc(CVE-2021-47501)

    kernel:i2c: acpi: fix resource leak in reconfiguration device addition(CVE-2021-47425)

    kernel:net: fix out-of-bounds access in ops_init(CVE-2024-36883)

    kernel:ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()(CVE-2024-36902)

    kernel:ipv6: prevent NULL dereference in ip6_output()(CVE-2024-36901)

    kernel:tcp: do not accept ACK of bytes we never sent(CVE-2023-52881)

    kernel:net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()(CVE-2024-40995)

    kernel:ipv6: prevent possible NULL dereference in rt6_probe()(CVE-2024-40960)

    kernel:netpoll: Fix race condition in netpoll_owner_active(CVE-2024-41005)

    kernel:scsi: megaraid_sas: Fix resource leak in case of probe failure(CVE-2021-47329)

    kernel:bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()(CVE-2024-39487)

    kernel:ACPI: CPPC: Use access_width over bit_width for system memory accesses(CVE-2024-35995)

    kernel:ext4: fix uninitialized ratelimit_state-lock access in __ext4_fill_super()(CVE-2024-40998)

    kernel:vt_ioctl: fix array_index_nospec in vt_setactivate(CVE-2022-48804)

    kernel:sctp: fix kernel-infoleak for SCTP sockets(CVE-2022-48855)

    kernel:USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages(CVE-2024-40904)

    kernel:tcp: properly terminate timers for kernel sockets(CVE-2024-35910)

    kernel:SUNRPC: Fix RPC client cleaned up the freed pipefs dentries(CVE-2023-52803)

    kernel:scsi: iscsi: Fix iscsi_task use after free(CVE-2021-47427)

    kernel:tcp: avoid too many retransmit packets(CVE-2024-41007)

    kernel:RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests(CVE-2021-47391)

    kernel:ima: Fix use-after-free on a dentry's dname.name(CVE-2024-39494)

    create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero     bytes, and crash, because of a missing check for ubi-leb_size.(CVE-2024-25739)

    audit: fix possible null-pointer dereference in audit_filter_rules(CVE-2021-47464)

    gfs2: ignore negated quota changes(CVE-2023-52759)

    bpf: Add oversize check before call kvcalloc()(CVE-2021-47376)

    ACPI: video: check for error while searching for backlight device parent(CVE-2023-52693)

    media: bttv: fix use after free error due to btv-timeout timer(CVE-2023-52847)

    isdn: mISDN: Fix sleeping function called from invalid context(CVE-2021-47468)

    cifs: Fix use-after-free in rdata-read_into_pages()(CVE-2023-52741)

    virtio-blk: fix implicit overflow on virtio_max_dma_size(CVE-2023-52762)

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()(CVE-2023-52809)

    xhci: Fix command ring pointer corruption while aborting a command(CVE-2021-47434)

    tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc(CVE-2023-52880)

    ACPI: LPIT: Avoid u32 multiplication overflow(CVE-2023-52683)

    media: gspca: cpia1: shift-out-of-bounds in set_flicker(CVE-2023-52764)

    ALSA: pcm: oss: Fix negative period/buffer sizes(CVE-2021-47511)

    mlxsw: spectrum_acl_tcam: Fix memory leak during rehash(CVE-2024-35853)

    mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update(CVE-2024-35855)

    A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious     actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL     pointer dereference in the NVMe driver, causing kernel panic and a denial of service.(CVE-2023-6536)

    drm/vmwgfx: Fix invalid reads in fence signaled events(CVE-2024-36960)

    x86/mm/pat: fix VM_PAT handling in COW mappings(CVE-2024-35877)

    HID: usbhid: free raw_report buffers in usbhid_stop(CVE-2021-47405)

    dyndbg: fix old BUG_ON in control parser(CVE-2024-35947)

    platform/x86: wmi: Fix opening of char device(CVE-2023-52864)

    isdn: mISDN: netjet: Fix crash in nj_probe(CVE-2021-47284)

    ovl: fix warning in ovl_create_real()(CVE-2021-47579)

    genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline(CVE-2024-31076)

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()(CVE-2021-47576)

    scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()(CVE-2022-48758)

    media: lgdt3306a: Add a check against null-pointer-def(CVE-2022-48772)

    USB: core: Fix hang in usb_kill_urb by adding memory barriers(CVE-2022-48760)

    media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()(CVE-2021-47288)

    tcp: fix page frag corruption on page fault(CVE-2021-47544)

    mac80211: track only QoS data frames for admission control(CVE-2021-47602)

    tipc: fix UAF in error path(CVE-2024-36886)

    wifi: mac80211: don't return unset power in ieee80211_get_tx_power()(CVE-2023-52832)

    can: peak_pci: peak_pci_remove(): fix UAF(CVE-2021-47456)

    sched/psi: Fix use-after-free in ep_remove_wait_queue()(CVE-2023-52707)

    In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to     drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.(CVE-2024-23848)

    KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio(CVE-2021-47341)

    drm/amd/display: Avoid NULL dereference of timing generator(CVE-2023-52753)

    wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach(CVE-2024-35811)

    The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in     the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local     access, this 'could be exploited in a real world scenario.' This is related to     brcmf_cfg80211_escan_timeout_worker in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.(CVE-2023-47233)

    vmci: prevent speculation leaks by sanitizing event in event_deliver()(CVE-2024-39499)

    drm/amd/display: Fix potential index out of bounds in color transformation function(CVE-2024-38552)

    netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()(CVE-2024-36286)

    ppdev: Add an error check in register_device(CVE-2024-36015)

    atl1c: Work around the DMA RX overflow issue(CVE-2023-52834)

    igc: Fix use-after-free error during reset(CVE-2021-47302)

    rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation(CVE-2024-36017)

    wifi: nl80211: don't free NULL coalescing rule(CVE-2024-36941)

    nsh: Restore skb-{protocol,data,mac_header} for outer header in nsh_gso_segment().(CVE-2024-36933)

    drm/amd/display: Skip on writeback when it's not applicable(CVE-2024-36914)

    amd/amdkfd: sync all devices to wait all processes being evicted(CVE-2024-36949)

    bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue(CVE-2024-36938)

    tipc: fix a possible memleak in tipc_buf_append(CVE-2024-36954)

    nvme: fix a possible use-after-free in controller reset during load(CVE-2022-48790)

    nvme-tcp: fix possible use-after-free in transport error_recovery work(CVE-2022-48789)

    drivers: core: synchronize really_probe() and dev_uevent()(CVE-2024-39501)

    net: openvswitch: fix overwriting ct original tuple for ICMPv6(CVE-2024-38558)

    drm/vrr: Set VRR capable prop only if it is attached to connector(CVE-2022-48843)

    Input: aiptek - properly check endpoint type(CVE-2022-48836)

    scsi: qedf: Fix refcount issue when LOGO is received during TMF(CVE-2022-48823)

    media: mxl111sf: change mutex_init() location(CVE-2021-47583)

    net-sysfs: add check for netdevice being present to speed_show(CVE-2022-48850)

    A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function.
    This can result in a bluetooth sniffing exception issue, possibly leading denial of     service.(CVE-2024-24859)

    A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set()     function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial     of service.(CVE-2024-24858)

    A race condition was found in the Linux kernel's net/bluetooth device driver in     conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to     bluetooth connection abnormality or denial of service.(CVE-2024-24857)

    mmc: sdio: fix possible resource leaks in some error paths(CVE-2023-52730)

    scsi: libfc: Fix array index out of bound exception(CVE-2021-47308)

    IB/hfi1: Restore allocated resources on failed copyout(CVE-2023-52747)

    firewire: ohci: mask bus reset interrupts between ISR and bottom half(CVE-2024-36950)

    Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj(CVE-2022-48775)

    media: imon: fix access to invalid resource for the second interface(CVE-2023-52754)

    ipvlan: Dont Use skb-sk in ipvlan_process_v{4,6}_outbound(CVE-2024-33621)

    ipv6: fix potential 'struct net' leak in inet6_rtm_getaddr()(CVE-2024-27417)

    scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory(CVE-2024-40901)

    NFSD: Fix ia_size underflow(CVE-2022-48828)

    net: amd-xgbe: Fix skb data length underflow(CVE-2022-48743)

    drm     ouveau: fix off by one in BIOS boundary checking(CVE-2022-48732)

    net: fix information leakage in /proc/net/ptype(CVE-2022-48757)

    dma-buf/sync_file: Don't leak fences on merge failure(CVE-2021-47305)

    nvme-rdma: fix possible use-after-free in transport error_recovery work(CVE-2022-48788)

    crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak(CVE-2024-39493)

    scsi: qedi: Fix crash while reading debugfs attribute(CVE-2024-40978)

    ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup(CVE-2021-47399)

    net/sched: act_skbmod: prevent kernel-infoleak(CVE-2024-35893)

    bpf, sockmap: Prevent lock inversion deadlock in map delete elem(CVE-2024-35895)

    netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()(CVE-2024-35898)

    mac80211: limit injected vht mcs     ss in ieee80211_parse_tx_radiotap(CVE-2021-47395)

    mlxsw: spectrum_acl_tcam: Fix incorrect list API usage(CVE-2024-36006)

    kvm: LAPIC: Restore guard to prevent illegal APIC register access(CVE-2021-47255)

    tipc: fix kernel panic when enabling bearer(CVE-2022-48865)

    tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING(CVE-2023-52845)

    xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING(CVE-2024-35976)

    mlxsw: spectrum_acl_tcam: Fix warning during rehash(CVE-2024-36007)

    net: bridge: fix vlan tunnel dst null pointer dereference(CVE-2021-47223)

    net/sched: act_skbmod: Skip non-Ethernet packets(CVE-2021-47293)

    net: bridge: fix vlan tunnel dst refcnt when egressing(CVE-2021-47222)

    asix: fix uninit-value in asix_mdio_read()(CVE-2021-47101)

    A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in     drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a     denial of service.(CVE-2023-7042)

    A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000     xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to     malfunction or denial of service issue.(CVE-2024-24861)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7195-1 advisory.

    Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error     conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this     vulnerability to cause a denial of service. (CVE-2022-38096)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - S390 architecture;

    - x86 architecture;

    - Power management core;

    - GPU drivers;

    - InfiniBand drivers;

    - Network drivers;

    - S/390 drivers;

    - SCSI subsystem;

    - TTY drivers;

    - BTRFS file system;

    - Ext4 file system;

    - EROFS file system;

    - F2FS file system;

    - File systems infrastructure;

    - BPF subsystem;

    - Socket messages infrastructure;

    - Bluetooth subsystem;

    - Memory management;

    - Amateur Radio drivers;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - Network traffic control;

    - Sun RPC protocol;

    - VMware vSockets driver;

    - SELinux security module; (CVE-2024-42240, CVE-2024-36938, CVE-2024-35967, CVE-2024-36953,     CVE-2022-48938, CVE-2024-38553, CVE-2024-35904, CVE-2024-35965, CVE-2024-26947, CVE-2024-36968,     CVE-2024-43892, CVE-2024-38597, CVE-2023-52498, CVE-2021-47501, CVE-2024-44942, CVE-2024-42077,     CVE-2024-53057, CVE-2024-46724, CVE-2024-35963, CVE-2022-48943, CVE-2024-42068, CVE-2024-42156,     CVE-2022-48733, CVE-2023-52639, CVE-2021-47101, CVE-2023-52821, CVE-2024-44940, CVE-2024-36952,     CVE-2021-47001, CVE-2024-38538, CVE-2024-40910, CVE-2021-47076, CVE-2024-35966, CVE-2024-50264,     CVE-2024-35951, CVE-2023-52488, CVE-2023-52497, CVE-2024-49967)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7195-2 advisory.

    Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error     conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this     vulnerability to cause a denial of service. (CVE-2022-38096)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - S390 architecture;

    - x86 architecture;

    - Power management core;

    - GPU drivers;

    - InfiniBand drivers;

    - Network drivers;

    - S/390 drivers;

    - SCSI subsystem;

    - TTY drivers;

    - BTRFS file system;

    - Ext4 file system;

    - EROFS file system;

    - F2FS file system;

    - File systems infrastructure;

    - BPF subsystem;

    - Socket messages infrastructure;

    - Bluetooth subsystem;

    - Memory management;

    - Amateur Radio drivers;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - Network traffic control;

    - Sun RPC protocol;

    - VMware vSockets driver;

    - SELinux security module; (CVE-2024-42240, CVE-2024-36938, CVE-2024-35967, CVE-2024-36953,     CVE-2022-48938, CVE-2024-38553, CVE-2024-35904, CVE-2024-35965, CVE-2024-26947, CVE-2024-36968,     CVE-2024-43892, CVE-2024-38597, CVE-2023-52498, CVE-2021-47501, CVE-2024-44942, CVE-2024-42077,     CVE-2024-53057, CVE-2024-46724, CVE-2024-35963, CVE-2022-48943, CVE-2024-42068, CVE-2024-42156,     CVE-2022-48733, CVE-2023-52639, CVE-2021-47101, CVE-2023-52821, CVE-2024-44940, CVE-2024-36952,     CVE-2021-47001, CVE-2024-38538, CVE-2024-40910, CVE-2021-47076, CVE-2024-35966, CVE-2024-50264,     CVE-2024-35951, CVE-2023-52488, CVE-2023-52497, CVE-2024-49967)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787307395 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash direct_functions     on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection     fault, probably for non-canonical address \ 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI     [...] [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48     85 d2 74 [...] [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 [ ] RAX: 0000000000000000 RBX:
    ffffffff813e0df0 RCX: 000000000000003b [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI:
    ffffffff813e0df0 [ ] RBP: ffffffffa00a3000 R08: ffffffff81180ce0 R09: 0000000000000001 [ ] R10:
    ffffc9000138bc18 R11: 0000000000000001 R12: ffffffff813e0df0 [ ] R13: ffffffff813e0df0 R14:
    ffff888171b56400 R15: 0000000000000000 [ ] FS: 00007fa9420c7780(0000) GS:ffff888ff6a00000(0000)     knlGS:000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 000000000770d000 CR3:
    0000000107d50003 CR4: 0000000000370ee0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
    0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] Call Trace: [ ]     <TASK> [ ] register_ftrace_direct+0x54/0x290 [ ] ? render_sigset_t+0xa0/0xa0 [ ]     bpf_trampoline_update+0x3f5/0x4a0 [ ] ? 0xffffffffa00a3000 [ ] bpf_trampoline_link_prog+0xa9/0x140 [ ]     bpf_tracing_prog_attach+0x1dc/0x450 [ ] bpf_raw_tracepoint_open+0x9a/0x1e0 [ ] ? find_held_lock+0x2d/0x90     [ ] ? lock_release+0x150/0x430 [ ] __sys_bpf+0xbd6/0x2700 [ ] ? lock_is_held_type+0xd8/0x130 [ ]
    __x64_sys_bpf+0x1c/0x20 [ ] do_syscall_64+0x3a/0x80 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xae [ ] RIP:
    0033:0x7fa9421defa9 [ ] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 9 f8 [...] [ ] RSP:
    002b:00007ffed743bd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ ] RAX: ffffffffffffffda RBX:
    00000000069d2480 RCX: 00007fa9421defa9 [ ] RDX: 0000000000000078 RSI: 00007ffed743bd80 RDI:
    0000000000000011 [ ] RBP: 00007ffed743be00 R08: 0000000000bb7270 R09: 0000000000000000 [ ] R10:
    00000000069da210 R11: 0000000000000246 R12: 0000000000000001 [ ] R13: 00007ffed743c4b0 R14:
    00000000069d2480 R15: 0000000000000001 [ ] </TASK> [ ] Modules linked in: klp_vm(OK) [ ] ---[ end trace     0000000000000000 ]--- One way to trigger this is: 1. load a livepatch that patches kernel function xxx; 2.
    run bpftrace -e 'kfunc:xxx {}', this will fail (expected for now); 3. repeat #2 => gpf. This is because     the entry is added to direct_functions, but not removed. Fix this by remove the entry from     direct_functions when register_ftrace_direct fails. Also remove the last trailing space from ftrace.c, so     we don't have to worry about it anymore. (CVE-2022-49402)

  - In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix refcount leak in     gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we     should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
    (CVE-2022-49715)

  - In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Add u64 casts to avoid     overflowing The fields of the _CPC object are unsigned 32-bits values. To avoid overflows while using
    _CPC's values, add 'u64' casts. (CVE-2022-49750)

  - In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in     sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP     sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will     cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless     SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we     put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct     ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in     sk_error_queue, socket refcount is kept elevated. 3) Application closes the socket, while error queue is     not empty. Since tcp_close() no longer purges the socket error queue, we might end up with a TCP socket     with at least one skb in error queue keeping the socket alive forever. This bug can be (ab)used to consume     all kernel memory and freeze the host. We need to purge the error queue, with proper synchronization     against concurrent writers. (CVE-2022-50838)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Add preempt_count_{sub,add} into     btf id deny list The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave     preempt_count_{sub,add} unprotected. When attaching trampoline to them we get panic as follows, [     867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is     0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [     867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [     867.843101] <TASK> [ 867.843104] asm_exc_int3+0x3a/0x40 [ 867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0     [ 867.843135] __bpf_prog_enter_recur+0x17/0x90 [ 867.843148] bpf_trampoline_6442468108_0+0x2e/0x1000 [     867.843154] ? preempt_count_sub+0x1/0xa0 [ 867.843157] preempt_count_sub+0x5/0xa0 [ 867.843159] ?     migrate_enable+0xac/0xf0 [ 867.843164] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843168]     bpf_trampoline_6442468108_0+0x55/0x1000 ... [ 867.843788] preempt_count_sub+0x5/0xa0 [ 867.843793] ?     migrate_enable+0xac/0xf0 [ 867.843829] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard     page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ     stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843]     BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [     867.843842] bpf_trampoline_6442468108_0+0x55/0x1000 ... That is because in __bpf_prog_exit_recur, the     preempt_count_{sub,add} are called after prog->active is decreased. Fixing this by adding these two     functions into btf ids deny list. (CVE-2023-54086)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
205289	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-6952-1)	Nessus	Ubuntu Local Security Checks	8/9/2024	1/6/2026	high
205475	Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6952-2)	Nessus	Ubuntu Local Security Checks	8/13/2024	1/6/2026	high
205750	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2024-066 (ALASKERNEL-5.10-2024-066)	Nessus	Amazon Linux Local Security Checks	8/17/2024	2/26/2026	high
206177	Photon OS 4.0: Linux PHSA-2024-4.0-0669	Nessus	PhotonOS Local Security Checks	8/24/2024	3/3/2026	high
200913	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-643)	Nessus	Amazon Linux Local Security Checks	6/24/2024	2/24/2026	high
207166	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2024-2441)	Nessus	Huawei Local Security Checks	9/12/2024	12/30/2025	high
213656	Ubuntu 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-7195-1)	Nessus	Ubuntu Local Security Checks	1/9/2025	9/24/2025	high
214144	Ubuntu 18.04 LTS : Linux kernel (Azure) vulnerabilities (USN-7195-2)	Nessus	Ubuntu Local Security Checks	1/14/2025	9/24/2025	high
332215	Photon OS 5.0: Linux PHSA-2024-5.0-91-0305	Nessus	PhotonOS Local Security Checks	8/5/2026	8/8/2026	high
361223	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787307395)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/1/2026	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

medium