The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7933 advisory.

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A denial of service (DOS) issue was found in the Linux kernel's smb2_ioctl_query_info function in the     fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user     function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
    (CVE-2022-0168)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

  - A use after free in the Linux kernel File System notify functionality was found in the way user triggers     copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to     crash the system or potentially escalate their privileges on the system. (CVE-2022-1998)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the     O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a     regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file     descriptor. (CVE-2022-24448)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets     are in the intended state. (CVE-2022-28893)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9274 advisory.

    - KVM: x86/mmu: do compare-and-exchange of gPTE via the user address (Paolo       Bonzini)  [Orabug: 34053807]  {CVE-2022-1158}
    - netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso)  [Orabug: 34035701]     {CVE-2022-1016}
    - sr9700: sanity check for packet length (Brian Maly)  [Orabug: 33962705]  {CVE-2022-26966}
    - net/packet: rx_owner_map depends on pg_vec (Willem de Bruijn)  [Orabug: 33835787]  {CVE-2021-22600}
    - NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust)  [Orabug: 33958154]     {CVE-2022-24448}
    - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause)  [Orabug: 33840432]     {CVE-2022-22942}
    - udf: Restore i_lenAlloc when inode expansion fails (Jan Kara)  [Orabug: 33870266]  {CVE-2022-0617}
    - udf: Fix NULL ptr deref when converting from inline format (Jan Kara)  [Orabug: 33870266]     {CVE-2022-0617}
    - ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet)  [Orabug: 33917056]  {CVE-2020-36516}
    - ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet)  [Orabug: 33917056]     {CVE-2020-36516}
    - arm64: Use the clearbhb instruction in mitigations (James Morse)  [Orabug: 33921736]  {CVE-2022-23960}
    - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly)  [Orabug: 33921736]  {CVE-2022-23960}
    - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse)  [Orabug:
    33921736]  {CVE-2022-23960}
    - arm64: Mitigate spectre style branch history side channels (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - KVM: arm64: Add templates for BHB mitigation sequences (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)  [Orabug: 33921736]  {CVE-2022-23960}
    - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: Add part number for Arm Cortex-A77 (Rob Herring)  [Orabug: 33921736]  {CVE-2022-23960}
    - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse)  [Orabug:
    33921736]  {CVE-2022-23960}
    - arm64: Add percpu vectors for EL1 (James Morse)  [Orabug: 33921736]  {CVE-2022-23960}
    - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)  [Orabug:
    33921736]  {CVE-2022-23960}
    - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse)  [Orabug:
    33921736]  {CVE-2022-23960}
    - arm64: entry: Move the trampoline data page before the text page (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: entry: Free up another register on kpti's tramp_exit path (James Morse)  [Orabug: 33921736]     {CVE-2022-23960}
    - arm64: entry: Make the trampoline cleanup optional (James Morse)  [Orabug: 33921736]  {CVE-2022-23960}
    - arm64: entry.S: Add ventry overflow sanity checks (James Morse)  [Orabug: 33921736]  {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King)  [Orabug: 33921736]     {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King)  [Orabug:
    33921736]  {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King)  [Orabug: 33921736]     {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King)  [Orabug:
    33921736]  {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.'     (Russell King)  [Orabug: 33921736]  {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King)  [Orabug:
    33921736]  {CVE-2022-23960}
    - Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King)  [Orabug: 33921736]     {CVE-2022-23960}
    - Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King)  [Orabug: 33921736]     {CVE-2022-23960}
    - Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King)  [Orabug: 33921736]  {CVE-2022-23960}
    - Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King)  [Orabug: 33921736]     {CVE-2022-23960}
    - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33941936]     {CVE-2021-26401}
    - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)     [Orabug: 33941936]  {CVE-2021-26401}
    - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33941936]     {CVE-2021-26401}
    - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33941936]     {CVE-2021-26401}
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)     [Orabug: 33941936]  {CVE-2021-26401}
    - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33941936]  {CVE-2021-26401}
    - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33941936]  {CVE-2021-26401}
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33941936]     {CVE-2021-26401}
    - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug:
    33941936]  {CVE-2021-26401}
    - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33941936]     {CVE-2021-26401}
    - x86/speculation: Fix bug in retpoline mode on AMD with  (Patrick Colp)  [Orabug: 33941936]     {CVE-2021-26401}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1197-1 advisory.

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to     obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to     the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be     encountered. In one case, an error encountered earlier might be discarded by later processing, resulting     in the caller assuming successful mapping, and hence subsequent operations trying to access space that     wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery     from the error. This affects drivers/block/xen-blkback/blkback.c. (CVE-2021-26930)

  - The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when     transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context.
    This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.
    (CVE-2021-38300)

  - In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel (CVE-2021-39633)

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the     O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a     regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file     descriptor. (CVE-2022-24448)

  - drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
    (CVE-2022-24958)

  - An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive     information from kernel memory. (CVE-2022-25375)

  - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to     obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

  - In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not     validated and might be manipulated by the host for out-of-array access. (CVE-2022-27223)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain,which can cause a use-     after-free.This issue needs to handle return with proper preconditions,as it can lead to a kernel     information leak problem caused by a local,unprivileged attacker. (CVE-2022-1016)

  - kernel: Null pointer dereference and use after free in ax25_release() (CVE-2022-1199)

  - A use-after-free flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality in the     way a user connects with the protocol. This flaw allows a local user to crash the system. (CVE-2022-1204)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of kernel installed on the remote host is prior to 5.10.106-102.504. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-012 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' (CVE-2021-46937)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/dbgfs: protect targets destructions with kdamond_lock (CVE-2021-47088)

    A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local     user to crash or escalate their privileges on the system. (CVE-2022-0500)

    A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

    A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

    A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle return with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23037)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23038)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23039)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23040)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23042)

    The Amazon Linux kernel now enables, by default, a software mitigation for this issue, on all ARM-based     EC2 instance types. (CVE-2022-23960)

    An out-of-bounds (OOB) memory access flaw was found in nft_fwd_dup_netdev_offload in     net/netfilter/nf_dup_netdev.c in the netfilter subcomponent in the Linux kernel due to a heap out-of-     bounds write problem. This flaw allows a local attacker with a user account on the system to gain access     to out-of-bounds memory, leading to a system crash or a privilege escalation threat. (CVE-2022-25636)

    A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: Fix filter limit check (CVE-2022-48847)

    In the Linux kernel, the following vulnerability has been resolved:

    net-sysfs: add check for netdevice being present to speed_show (CVE-2022-48850)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix kernel-infoleak for SCTP sockets (CVE-2022-48855)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix a race on command flush flow (CVE-2022-48858)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix kernel panic when enabling bearer (CVE-2022-48865)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: ensure we call ipv6_mc_down() at most once (CVE-2022-48910)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_queue: fix possible use-after-free (CVE-2022-48911)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: fix use-after-free in __nf_register_net_hook() (CVE-2022-48912)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/netfront: destroy queues before real_num_tx_queues is zeroed (CVE-2022-48914)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: Fix TZ_GET_TRIP NULL pointer dereference (CVE-2022-48915)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix double free race when mount fails in cifs_get_root() (CVE-2022-48919)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: int340x: fix memory leak in int3400_notify() (CVE-2022-48924)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Do not change route.addr.src_addr outside state checks (CVE-2022-48925)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ib_srp: Fix a deadlock (CVE-2022-48930)

    In the Linux kernel, the following vulnerability has been resolved:

    configfs: fix a race in configfs_{,un}register_subsystem() (CVE-2022-48931)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix memory leak during stateful obj update (CVE-2022-48933)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: add a schedule point in io_add_buffers() (CVE-2022-48937)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Add schedule points in batch ops (CVE-2022-48939)

    In the Linux kernel, the following vulnerability has been resolved:

    hwmon: Handle failure to register sensor with thermal zone correctly (CVE-2022-48942)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: make apf token non-zero to fix bug (CVE-2022-48943)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: initialize registers in nft_do_chain() (CVE-2022-49293)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8267 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

    * kernel info leak issue in pfkey_register (CVE-2022-1353)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

    * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

    * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816,     CVE-2022-29900)

    * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nf_tables disallow binding to already bound chain (CVE-2022-39190)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9313 advisory.

    - netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso)  [Orabug: 34012925]     {CVE-2022-1016}
    - btrfs: unlock newly allocated extent buffer after error (Qu Wenruo)  [Orabug: 33997138]  {CVE-2021-4149}
    - sr9700: sanity check for packet length (Oliver Neukum)  [Orabug: 33962706]  {CVE-2022-26966}
    - lib/timerqueue: Rely on rbtree semantics for next timer (Davidlohr Bueso)  [Orabug: 33406086]     {CVE-2021-20317} {CVE-2021-20317}
    - NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust)  [Orabug: 33958155]     {CVE-2022-24448}
    - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)     [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)     [Orabug: 33937656]  {CVE-2021-26401}
    - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug:
    33937656]  {CVE-2021-26401}
    - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Fix bug in retpoline mode on AMD with 'spectre_v2=none' (Patrick Colp)  [Orabug:
    33937656]  {CVE-2021-26401}
    - ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet)  [Orabug: 33917057]  {CVE-2020-36516}
    - ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet)  [Orabug: 33917057]     {CVE-2020-36516}
    - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann)  [Orabug: 33910800]     {CVE-2022-0847}
    - udf: Restore i_lenAlloc when inode expansion fails (Jan Kara)  [Orabug: 33870267]  {CVE-2022-0617}
    - udf: Fix NULL ptr deref when converting from inline format (Jan Kara)  [Orabug: 33870267]     {CVE-2022-0617}
    - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause)  [Orabug: 33840433]     {CVE-2022-22942}
    - drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin)  [Orabug: 33835811]     {CVE-2022-0330}
    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit)  [Orabug: 33617219]  {CVE-2021-4002}
    - tipc: improve size validations for received domain records (Jon Maloy)  [Orabug: 33850803]     {CVE-2022-0435} {CVE-2022-0435}
    - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman)  [Orabug: 33825688]     {CVE-2022-0492}
    - Linux 4.14.257 (Greg Kroah-Hartman)   {CVE-2021-38199}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux     Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.
    (CVE-2022-0812)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount     of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will     access the freed drm_vgem_gem_object. (CVE-2022-1419)

  - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients. (CVE-2022-1678)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
167989	AlmaLinux 9 : kernel-rt (ALSA-2022:7933)	Nessus	Alma Linux Local Security Checks	11/19/2022	6/26/2024	high
159644	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9274)	Nessus	Oracle Linux Local Security Checks	4/11/2022	2/9/2026	high
159748	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:1197-1)	Nessus	SuSE Local Security Checks	4/15/2022	7/13/2023	high
163617	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2022-2200)	Nessus	Huawei Local Security Checks	7/29/2022	6/3/2026	high
160433	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-012 (ALASKERNEL-5.10-2022-012)	Nessus	Amazon Linux Local Security Checks	5/2/2022	2/26/2026	high
167620	RHEL 9 : kernel (RHSA-2022:8267)	Nessus	Red Hat Local Security Checks	11/16/2022	9/12/2025	high
292383	MiracleLinux 7 : kernel-3.10.0-1160.119.1.0.1.el7.AXS7 (AXSA:2024-8651:24)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
160190	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2022-9313)	Nessus	Oracle Linux Local Security Checks	4/25/2022	6/3/2026	high
165375	EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2022-2348)	Nessus	Huawei Local Security Checks	9/23/2022	1/13/2023	high
234407	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	4/15/2025	6/26/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high