According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through     crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected     versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)

  - An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations     often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success     or failure of each one is reported to the backend driver, and the backend driver then loops over the     results, performing follow-up actions based on the success or failure of each operation. Unfortunately,     when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively     implying their success from the success of related batch elements. In other cases, errors resulting from     one batch element lead to further batch elements not being inspected, and hence successful ones to not be     possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are     vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and     drivers/xen/gntdev.c. (CVE-2021-26932)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel     through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to     element -2 of an array, aka CID-298a58e165e4. (CVE-2021-32078)

  - In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel (CVE-2021-39633)

  - In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an     incorrect flag check. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-210292376References: Upstream kernel (CVE-2021-39685)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network     protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more     buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). (CVE-2022-0322)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0825 advisory.

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's     cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting     the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.
    (CVE-2021-4154)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for     s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain     unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.
    (CVE-2022-0516)

  - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

  - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0825 advisory.

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's     cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting     the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.
    (CVE-2021-4154)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for     s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain     unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.
    (CVE-2022-0516)

  - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

  - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0592 advisory.

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic     error. This could lead to local escalation of privilege with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel (CVE-2020-0466)

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to     gain access to files opened by other processes on the system through a dangling 'file' pointer.
    (CVE-2022-22942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0029 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-0330:
    A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system.

    CVE-2022-22942:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2021-4197:
    An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system.

    CVE-2022-0185:
    A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem     Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in     case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local     user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to     legacy handling) could use this flaw to escalate their privileges on the system.

    CVE-2022-0492:
    A vulnerability was found in the Linux kernels cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

    CVE-2022-1011:
    CVE-2022-1011 kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow     hashes

    CVE-2022-1016:
    CVE-2022-1016 kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to     UM

    CVE-2022-0995:
    CVE-2022-0995 kernel: kernel bug in the watch_queue subsystem

    CVE-2021-22600:
    CVE-2021-22600 kernel: double free in packet_set_ring() in net/packet/af_packet.c

    CVE-2022-27666:
    CVE-2022-27666 kernel: buffer overflow in IPsec ESP transformation code

    CVE-2022-25636:
    CVE-2022-25636 kernel: heap out of bounds write in nf_dup_netdev.c

    CVE-2020-36516:
    CVE-2020-36516 kernel: an off-path attacker may inject data or terminate a victim's TCP session

    CVE-2021-44879:
    CVE-2021-44879 kernel: NULL pointer dereference in folio_mark_dirty() via a crafted f2fs image

    CVE-2021-45402:
    CVE-2021-45402 kernel: pointer leak in check_alu_op() of kernel/bpf/verifier.c

    CVE-2022-24448:
    CVE-2022-24448 kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR

    CVE-2021-4204:
    CVE-2021-4204 kernel: improper input validation may lead to privilege escalation

    CVE-2022-23222:
    CVE-2022-23222 kernel: local privileges escalation in kernel/bpf/verifier.c

    CVE-2021-4135:
    CVE-2021-4135 kernel: Heap information leak in map_lookup_elem function

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
159815	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2022-1429)	Nessus	Huawei Local Security Checks	4/18/2022	11/1/2023	high
179417	AlmaLinux 8 : kernel (ALSA-2022:0825)	Nessus	Alma Linux Local Security Checks	8/7/2023	8/8/2023	high
184936	Rocky Linux 8 : kernel (RLSA-2022:0825)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/8/2023	high
208541	CentOS 7 : kpatch-patch (RHSA-2022:0592)	Nessus	CentOS Local Security Checks	10/9/2024	10/10/2024	high
236676	Alibaba Cloud Linux 3 : 0029: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2022:0029)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high