According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in     drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based     device.(CVE-2023-33203)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors.(CVE-2023-2513)

    A race condition vulnerability was found in the Linux kernel's Qualcomm EMAC Gigabit Ethernet Controller     when the user physically removes the device before cleanup in the emac_remove function. This flaw can     eventually result in a use-after-free issue, possibly leading to a system crash or other undefined     behaviors.(CVE-2023-2483)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    An out-of-bounds memory access flaw was found in the Linux kernels traffic control (QoS) subsystem in     how a user triggers the qfq_change_class function with an incorrect MTU value of the network device used     as lmax. This flaw allows a local user to crash or potentially escalate their privileges on the     system.(CVE-2023-2248)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the 'access_ok' check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond     commit74e19ef0ff8061ef55957c3abd71614ef0f42f47(CVE-2023-0459)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

    An out-of-bounds memory access flaw was found in the Linux kernels XFS file system in how a user     restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system.(CVE-2023-2124)

    A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege.(CVE-2023-2176)

    An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The     userspace 'data-block[0]' variable was not capped to a number between 0-255 and was used as the size of     a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to     crash the system or potentially achieve code execution.(CVE-2023-2194)

    The Linux kernel allows userspace processes to enable mitigations by calling prctl with     PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed     that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to     attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be     observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened     because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that     STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection.
    However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons,     which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target     injection against which STIBP protects.(CVE-2023-1998)

    A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault     handler. The issue results from the lack of proper validation of user-supplied data, which can result in a     memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges     and execute arbitrary code in the context of the kernel.(CVE-2023-2008)

    A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local     privilege escalation. The io_file_get_fixed function lacks the presence of ctx-uring_lock which can     lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We     recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.(CVE-2023-1872)

    A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue.(CVE-2022-1015)

    An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS).(CVE-2022-36280)

    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4.(CVE-2023-30456)

    A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem.(CVE-2023-1838)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks.(CVE-2023-1637)

    A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak.(CVE-2023-1513)

    A double-free flaw was found in the Linux kernels TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system.(CVE-2022-4744)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation.The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext.A local attacker user can use     this vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.(CVE-2023-1281)

    do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference).(CVE-2023-28466)

    A use-after-free flaw was found in the Linux kernels core dump subsystem. This flaw allows a local user     to crash the system. Only if patch 390031c94211 ('coredump: Use the vma snapshot in fill_files_note') not     applied yet, then kernel could be affected.(CVE-2023-1249)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was     the duplicate of CVE-2023-31436. (CVE-2023-2248)

  - A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

  - A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2022-4378)

  - A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or commit     739790605705ddcf18f21782b9c99ad7d53a8c11 (CVE-2023-0458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2442-1 advisory.

  - Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

  - A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In     this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on     hdev devices. (CVE-2023-1989)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

  - hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation. (CVE-2023-28464)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2415 advisory.

  - Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

  - A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In     this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on     hdev devices. (CVE-2023-1989)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation. (CVE-2023-28464)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6081-1 advisory.

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6118-1 advisory.

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6256-1 advisory.

    Jiasheng Jiang discovered that the HSA Linux kernel driver for AMD Radeon GPU devices did not properly     validate memory allocation in certain situations, leading to a null pointer dereference vulnerability. A     local attacker could use this to cause a denial of service (system crash). (CVE-2022-3108)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A     local attacker with physical access could plug in a specially crafted USB device to cause a denial of     service (memory exhaustion). (CVE-2022-3903)

    Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP)     implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-4129)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A     local attacker could use this to cause a denial of service (system crash). (CVE-2023-1076)

    It was discovered that the Real-Time Scheduling Class implementation in the Linux kernel contained a type     confusion vulnerability in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-1077)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    It was discovered that the ASUS HID driver in the Linux kernel did not properly handle device removal,     leading to a use-after-free vulnerability. A local attacker with physical access could plug in a specially     crafted USB device to cause a denial of service (system crash). (CVE-2023-1079)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2023-1281)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     data buffer size validation in some situations. A physically proximate attacker could use this to craft a     malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose     sensitive information. (CVE-2023-1380)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the Xircom PCMCIA network device driver in the Linux kernel did not properly handle     device removal events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2023-1670)

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel did not     properly perform filter deactivation in some situations. A local attacker could possibly use this to gain     elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier     has been removed. (CVE-2023-1829)

    It was discovered that a race condition existed in the Xen transport layer implementation for the 9P file     system protocol in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (guest crash) or expose sensitive information (guest kernel memory).
    (CVE-2023-1859)

    Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2 mitigations with prctl syscall were     insufficient in some situations. A local attacker could possibly use this to expose sensitive information.
    (CVE-2023-1998)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    It was discovered that the BigBen Interactive Kids' gamepad driver in the Linux kernel did not properly     handle device removal, leading to a use- after-free vulnerability. A local attacker with physical access     could plug in a specially crafted USB device to cause a denial of service (system crash). (CVE-2023-25012)

    Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race     condition when handling inode locking in some situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2023-2612)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that a use-after-free vulnerability existed in the HFS+ file system implementation in     the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2985)

    Reima Ishii discovered that the nested KVM implementation for Intel x86 processors in the Linux kernel did     not properly validate control registers in certain situations. An attacker in a guest VM could use this to     cause a denial of service (guest crash). (CVE-2023-30456)

    Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-31436)

    Sanan Hasanov discovered that the framebuffer console driver in the Linux kernel did not properly perform     checks for font dimension limits. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-3161)

    Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the     Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-32233)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-     bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-35788, LP: #2023577)

    It was discovered that for some Intel processors the INVLPG instruction implementation did not properly     flush global TLB entries when PCIDs are enabled. An attacker could use this to expose sensitive     information (kernel memory) or possibly cause undesired behaviors. (LP: #2023220)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0134 advisory.

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled address, potentially     leading to information disclosure. (CVE-2023-20569)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-     after-free flaw in the way memory objects were handled when they were being used to store a surface. When     running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially     use this flaw to escalate their privileges. (CVE-2023-5633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2420 advisory.

  - A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In     this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on     hdev devices. (CVE-2023-1989)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

  - hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation. (CVE-2023-28464)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2395 advisory.

  - A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In     this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on     hdev devices. (CVE-2023-1989)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
188850	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2023-2724)	Nessus	Huawei Local Security Checks	1/16/2024	9/29/2025	high
193543	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2024-0017)	Nessus	NewStart CGSL Local Security Checks	4/18/2024	9/24/2025	high
176961	SUSE SLES12 Security Update : kernel (Live Patch 38 for SLE 12 SP5) (SUSE-SU-2023:2442-1)	Nessus	SuSE Local Security Checks	6/8/2023	7/14/2023	high
176962	SUSE SLES12 Security Update : kernel (Live Patch 39 for SLE 12 SP5) (SUSE-SU-2023:2415)	Nessus	SuSE Local Security Checks	6/8/2023	7/12/2023	high
175884	Ubuntu 16.04 ESM / 18.04 LTS : Linux kernel vulnerabilities (USN-6081-1)	Nessus	Ubuntu Local Security Checks	5/16/2023	8/27/2024	high
176493	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-6118-1)	Nessus	Ubuntu Local Security Checks	5/30/2023	8/28/2024	high
178920	Ubuntu 20.04 LTS : Linux kernel (IoT) vulnerabilities (USN-6256-1)	Nessus	Ubuntu Local Security Checks	7/27/2023	9/19/2024	critical
188023	Rocky Linux 8 : kernel-rt (RLSA-2024:0134)	Nessus	Rocky Linux Local Security Checks	1/12/2024	1/12/2024	high
176929	SUSE SLES12 Security Update : kernel (Live Patch 30 for SLE 12 SP4) (SUSE-SU-2023:2420)	Nessus	SuSE Local Security Checks	6/8/2023	7/12/2023	high
176956	SUSE SLES12 Security Update : kernel (Live Patch 42 for SLE 12 SP5) (SUSE-SU-2023:2395)	Nessus	SuSE Local Security Checks	6/8/2023	7/12/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

high

high

high