The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5991-1 advisory.

    It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large     shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2021-3669)

    It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A     local attacker could possibly use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3424)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference     counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    Jos Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did     not properly protect against indirect branch prediction attacks in some situations. A local attacker could     possibly use this to expose sensitive information. (CVE-2023-0045)

    It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture     (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-0266)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow     vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

    Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer     dereference when handling certain messages from user space. A local attacker could use this to cause a     denial of service (system crash). (CVE-2023-28328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5987-1 advisory.

    It was discovered that the KVM VMX implementation in the Linux kernel did not properly handle indirect     branch prediction isolation between L1 and L2 VMs. An attacker in a guest VM could use this to expose     sensitive information from the host OS or other guest VMs. (CVE-2022-2196)

    It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A     local attacker could possibly use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3424)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference     counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

    Gerald Lee discovered that the USB Gadget file system implementation in the Linux kernel contained a race     condition, leading to a use-after-free vulnerability in some situations. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-4382)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds write vulnerability. A local attacker could     use this to cause a denial of service (system crash). (CVE-2022-48423)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2022-48424)

    Jos Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did     not properly protect against indirect branch prediction attacks in some situations. A local attacker could     possibly use this to expose sensitive information. (CVE-2023-0045)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer     lengths, leading to a heap-based buffer overflow. A remote attacker could possibly use this to cause a     denial of service (system crash). (CVE-2023-0210)

    It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture     (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-0266)

    Kyle Zeng discovered that the class-based queuing discipline implementation in the Linux kernel contained     a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23454)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow     vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly handle a     loop termination condition, leading to an out-of-bounds read vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information.
    (CVE-2023-26606)

    Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer     dereference when handling certain messages from user space. A local attacker could use this to cause a     denial of service (system crash). (CVE-2023-28328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6009-1 advisory.

    It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large     shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2021-3669)

    It was discovered that a use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A     local attacker could possibly use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3424)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference     counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    Jos Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did     not properly protect against indirect branch prediction attacks in some situations. A local attacker could     possibly use this to expose sensitive information. (CVE-2023-0045)

    It was discovered that a use-after-free vulnerability existed in the Advanced Linux Sound Architecture     (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-0266)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow     vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

    Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer     dereference when handling certain messages from user space. A local attacker could use this to cause a     denial of service (system crash). (CVE-2023-28328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12196 advisory.

    - l2tp: Serialize access to sk_user_data with sk_callback_lock (Jakub Sitnicki) [Orabug: 34951574]     {CVE-2022-4129}
    - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich) [Orabug: 35037701]     {CVE-2023-23559}
    - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu) [Orabug: 35005828]     {CVE-2023-0394}
    - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne) [Orabug: 34983525]     {CVE-2023-0266}
    - net: sched: disallow noqueue for qdisc classes (Frederick Lawler) [Orabug: 35005790] {CVE-2022-47929}
    - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983582]     {CVE-2023-23454}
    - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983613]     {CVE-2023-23455}
    - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai) [Orabug: 34820628]     {CVE-2022-41218}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6020-1 advisory.

    It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large     shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2021-3669)

    It was discovered that the KVM VMX implementation in the Linux kernel did not properly handle indirect     branch prediction isolation between L1 and L2 VMs. An attacker in a guest VM could use this to expose     sensitive information from the host OS or other guest VMs. (CVE-2022-2196)

    Gerald Lee discovered that the USB Gadget file system implementation in the Linux kernel contained a race     condition, leading to a use-after-free vulnerability in some situations. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-4382)

    It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow     vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6032-1 advisory.

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    Gerald Lee discovered that the USB Gadget file system implementation in the Linux kernel contained a race     condition, leading to a use-after-free vulnerability in some situations. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-4382)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow     vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

    It was discovered that the file system writeback functionality in the Linux kernel contained a user-after-     free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash)     or execute arbitrary code. (CVE-2023-26605)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1608-1 advisory.

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020. (CVE-2022-3523)

  - An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS). (CVE-2022-36280)

  - A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c     in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a     local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-38096)

  - The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The     ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL     MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the     TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to     the prctl syscall. The patch that added the support for the conditional mitigation via prctl     (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit     a664ec9158eeddd75121d39c9a0758016097fa96 (CVE-2023-0045)

  - A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(),     allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected     versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4. (CVE-2023-0122)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was     found in the way user can guess location of exception stack(s) or other important data. A local user could     use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The     rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user     can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info`     actually points to something else that is potentially controlled by local user. It is known how to trigger     this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in     drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

  - In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the     drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually     an error pointer). (CVE-2023-22998)

  - In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return     value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

  - In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23001)

  - In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return     value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

  - atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

  - In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an     integer overflow in an addition. (CVE-2023-23559)

  - The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a     crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

  - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3403 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3403-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 3, 2023                                   https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 4.19.282-1     CVE ID         : CVE-2022-2873 CVE-2022-3424 CVE-2022-3545 CVE-2022-3707                      CVE-2022-4744 CVE-2022-36280 CVE-2022-41218 CVE-2022-45934                      CVE-2022-47929 CVE-2023-0045 CVE-2023-0266 CVE-2023-0394                      CVE-2023-0458 CVE-2023-0459 CVE-2023-0461 CVE-2023-1073                      CVE-2023-1074 CVE-2023-1078 CVE-2023-1079 CVE-2023-1118                      CVE-2023-1281 CVE-2023-1513 CVE-2023-1670 CVE-2023-1829                      CVE-2023-1855 CVE-2023-1859 CVE-2023-1989 CVE-2023-1990                      CVE-2023-1998 CVE-2023-2162 CVE-2023-2194 CVE-2023-23454                      CVE-2023-23455 CVE-2023-23559 CVE-2023-26545 CVE-2023-28328                      CVE-2023-30456 CVE-2023-30772     Debian Bug     : 825141

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service, or information     leak.

    CVE-2022-2873

        Zheyu Ma discovered that an out-of-bounds memory access flaw in         the Intel iSMT SMBus 2.0 host controller driver may result in         denial of service (system crash).

    CVE-2022-3424

        Zheng Wang and Zhuorao Yang reported a flaw in the SGI GRU driver         which could lead to a use-after-free.  On systems where this driver         is used, a local user can explit this for denial of service (crash         or memory corruption) or possibly for privilege escalation.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-3545

        It was discovered that the Netronome Flow Processor (NFP) driver         contained a use-after-free flaw in area_cache_get(), which may         result in denial of service or the execution of arbitrary code.

    CVE-2022-3707

        Zheng Wang reported a flaw in the i915 graphics driver's         virtualisation (GVT-g) support that could lead to a double-free.
        On systems where this feature is used, a guest can exploit this         for denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2022-4744

        The syzkaller tool found a flaw in the TUN/TAP network driver,         which can lead to a double-free.  A local user can exploit this         for denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2022-36280

        An out-of-bounds memory write vulnerability was discovered in the         vmwgfx driver, which may allow a local unprivileged user to cause         a denial of service (system crash).

    CVE-2022-41218

        Hyunwoo Kim reported a use-after-free flaw in the Media DVB core         subsystem caused by refcount races, which may allow a local user         to cause a denial of service or escalate privileges.

    CVE-2022-45934

        An integer overflow in l2cap_config_req() in the Bluetooth         subsystem was discovered, which may allow a physically proximate         attacker to cause a denial of service (system crash).

    CVE-2022-47929

        Frederick Lawler reported a NULL pointer dereference in the         traffic control subsystem allowing an unprivileged user to cause a         denial of service by setting up a specially crafted traffic         control configuration.

    CVE-2023-0045

        Rodrigo Branco and Rafael Correa De Ysasi reported that when a         user-space task told the kernel to enable Spectre v2 mitigation         for it, the mitigation was not enabled until the task was next         rescheduled.  This might be exploitable by a local or remote         attacker to leak sensitive information from such an application.

    CVE-2023-0266

        A use-after-free flaw in the sound subsystem due to missing         locking may result in denial of service or privilege escalation.

    CVE-2023-0394

        Kyle Zeng discovered a NULL pointer dereference flaw in         rawv6_push_pending_frames() in the network subsystem allowing a         local user to cause a denial of service (system crash).

    CVE-2023-0458

        Jordy Zimmer and Alexandra Sandulescu found that getrlimit() and         related system calls were vulnerable to speculative execution         attacks such as Spectre v1.  A local user could explot this to         leak sensitive information from the kernel.

    CVE-2023-0459

        Jordy Zimmer and Alexandra Sandulescu found a regression in         Spectre v1 mitigation in the user-copy functions for the amd64         (64-bit PC) architecture.  Where the CPUs do not implement SMAP or         it is disabled, a local user could exploit this to leak sensitive         information from the kernel.  Other architectures may also be         affected.

    CVE-2023-0461

        slipper reported a flaw in the kernel's support for ULPs (Upper         Layer Protocols) on top of TCP that can lead to a double-free when         using kernel TLS sockets.  A local user can exploit this for         denial of service (crash or memory corruption) or possibly for         privilege escalation.

        Kernel TLS is not enabled in Debian's official kernel         configurations.

    CVE-2023-1073

        Pietro Borrello reported a type confusion flaw in the HID (Human         Interface Device) subsystem.  An attacker able to insert and         remove USB devices might be able to use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1074

        Pietro Borrello reported a type confusion flaw in the SCTP         protocol implementation which can lead to a memory leak.  A local         user could exploit this to cause a denial of service (resource         exhaustion).

    CVE-2023-1078

        Pietro Borrello reported a type confusion flaw in the RDS protocol         implementation.  A local user could exploit this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-1079

        Pietro Borrello reported a race condition in the hid-asus HID         driver which could lead to a use-after-free.  An attacker able to         insert and remove USB devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1118

        Duoming Zhou reported a race condition in the ene_ir remote         control driver that can lead to a use-after-free if the driver         is unbound.  It is not clear what the security impact of this is.

    CVE-2023-1281, CVE-2023-1829

        valis reported two flaws in the cls_tcindex network traffic         classifier which could lead to a use-after-free.  A local user can         exploit these for privilege escalation.  This update removes         cls_tcindex entirely.

    CVE-2023-1513

        Xingyuan Mo reported an information leak in the KVM implementation         for the i386 (32-bit PC) architecture.  A local user could exploit         this to leak sensitive information from the kernel.

    CVE-2023-1670

        Zheng Wang reported a race condition in the xirc2ps_cs network         driver which can lead to a use-after-free.  An attacker able to         insert and remove PCMCIA devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1855

        Zheng Wang reported a race condition in the xgene-hwmon hardware         monitoring driver that may lead to a use-after-free.  It is not         clear what the security impact of this is.

    CVE-2023-1859

        Zheng Wang reported a race condition in the 9pnet_xen transport         for the 9P filesystem on Xen, which can lead to a use-after-free.
        On systems where this feature is used, a backend driver in another         domain can use this to cause a denial of service (crash or memory         corruption) or possibly to run arbitrary code in the vulnerable         domain.

    CVE-2023-1989

        Zheng Wang reported a race condition in the btsdio Bluetooth         adapter driver that can lead to a use-after-free.  An attacker         able to insert and remove SDIO devices can use this to cause a         denial of service (crash or memory corruption) or possibly to run         arbitrary code in the kernel.

    CVE-2023-1990

        Zheng Wang reported a race condition in the st-nci NFC adapter         driver that can lead to a use-after-free.  It is not clear what         the security impact of this is.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2023-1998

        Jos Oliveira and Rodrigo Branco reported a regression in Spectre         v2 mitigation for user-space on x86 CPUs supporting IBRS but not         eIBRS.  This might be exploitable by a local or remote attacker to         leak sensitive information from a user-space application.

    CVE-2023-2162

        Mike Christie reported a race condition in the iSCSI TCP transport         that can lead to a use-after-free.  On systems where this feature         is used, a local user might be able to use this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-2194

        Wei Chen reported a potential heap buffer overflow in the         i2c-xgene-slimpro IC adapter driver.  A local user with         permission to access such a device can use this to cause a denial         of service (crash or memory corruption) and probably for privilege         escalation.

    CVE-2023-23454

        Kyle Zeng reported that the Class Based Queueing (CBQ) network         scheduler was prone to denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23455

        Kyle Zeng reported that the ATM Virtual Circuits (ATM) network         scheduler was prone to a denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23559

        Szymon Heidrich reported incorrect bounds checks in the rndis_wlan         Wi-Fi driver which may lead to a heap buffer overflow or overread.
        An attacker able to insert and remove USB devices can use this to         cause a denial of service (crash or memory corruption) or         information leak, or possibly to run arbitrary code in the kernel.

    CVE-2023-26545

        Lianhui Tang reported a flaw in the MPLS protocol implementation         that could lead to a double-free.  A local user might be able to         exploit this to cause a denial of service (crash or memory         corruption) or possibl for privilege escalation.

    CVE-2023-28328

        Wei Chen reported a flaw in the az6927 DVB driver that can lead to         a null pointer dereference.  A local user permitted to access an         IC adapter device that this driver creates can use this to cause         a denial of service (crash).

    CVE-2023-30456

        Reima ISHII reported a flaw in the KVM implementation for Intel         CPUs affecting nested virtualisation.  When KVM was used as the L0         hypervisor, and EPT and/or unrestricted guest mode was disabled,         it did not prevent an L2 guest from being configured with an         architecturally invalid protection/paging mode.  A malicious guest         could exploit this to cause a denial of service (crash).

    CVE-2023-30772

        Zheng Wang reported a race condition in the da9150 charger driver         which could lead to a use-after-free.  It is not clear what the         security impact of this is.

        This driver is not enabled in Debian's official kernel         configurations.

    For Debian 10 buster, these problems have been fixed in version     4.19.282-1.  This update additionally fixes Debian bug #825141, and     includes many more bug fixes from stable updates 4.19.270-4.19.282     inclusive.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4160-1 advisory.

  - A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.
    We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

  - In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an     integer overflow in an addition. (CVE-2023-23559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3404 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3404-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 3, 2023                                   https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.178-3~deb10u1     CVE ID         : CVE-2022-2196 CVE-2022-3424 CVE-2022-3707 CVE-2022-4129                      CVE-2022-4379 CVE-2023-0045 CVE-2023-0458 CVE-2023-0459                      CVE-2023-0461 CVE-2023-1073 CVE-2023-1074 CVE-2023-1076                      CVE-2023-1077 CVE-2023-1078 CVE-2023-1079 CVE-2023-1118                      CVE-2023-1281 CVE-2023-1513 CVE-2023-1611 CVE-2023-1670                      CVE-2023-1829 CVE-2023-1855 CVE-2023-1859 CVE-2023-1872                      CVE-2023-1989 CVE-2023-1990 CVE-2023-1998 CVE-2023-2162                      CVE-2023-2194 CVE-2023-22998 CVE-2023-23004 CVE-2023-23559                      CVE-2023-25012 CVE-2023-26545 CVE-2023-28328 CVE-2023-28466                      CVE-2023-30456     Debian Bug     : 989705 993612 1022126 1031753

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service, or information     leak.

    CVE-2022-2196

        A regression was discovered the KVM implementation for Intel CPUs,         affecting Spectre v2 mitigation for nested virtualisation.  When         KVM was used as the L0 hypervisor, an L2 guest could exploit this         to leak sensitive information from its L1 hypervisor.

    CVE-2022-3424

        Zheng Wang and Zhuorao Yang reported a flaw in the SGI GRU driver         which could lead to a use-after-free.  On systems where this driver         is used, a local user can explit this for denial of service (crash         or memory corruption) or possibly for privilege escalation.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-3707

        Zheng Wang reported a flaw in the i915 graphics driver's         virtualisation (GVT-g) support that could lead to a double-free.
        On systems where this feature is used, a guest can exploit this         for denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2022-4129

        Haowei Yan reported a race condition in the L2TP protocol         implementation which could lead to a null pointer dereference.  A         local user could exploit this for denial of service (crash).

    CVE-2022-4379

        Xingyuan Mo reported a flaw in the NFSv4.2 inter server to         server copy implementation which could lead to a use-after-free.

        This feature is not enabled in Debian's official kernel         configurations.

    CVE-2023-0045

        Rodrigo Branco and Rafael Correa De Ysasi reported that when a         user-space task told the kernel to enable Spectre v2 mitigation         for it, the mitigation was not enabled until the task was next         rescheduled.  This might be exploitable by a local or remote         attacker to leak sensitive information from such an application.

    CVE-2023-0458

        Jordy Zimmer and Alexandra Sandulescu found that getrlimit() and         related system calls were vulnerable to speculative execution         attacks such as Spectre v1.  A local user could explot this to         leak sensitive information from the kernel.

    CVE-2023-0459

        Jordy Zimmer and Alexandra Sandulescu found a regression in         Spectre v1 mitigation in the user-copy functions for the amd64         (64-bit PC) architecture.  Where the CPUs do not implement SMAP or         it is disabled, a local user could exploit this to leak sensitive         information from the kernel.  Other architectures may also be         affected.

    CVE-2023-0461

        slipper reported a flaw in the kernel's support for ULPs (Upper         Layer Protocols) on top of TCP that can lead to a double-free when         using kernel TLS sockets.  A local user can exploit this for         denial of service (crash or memory corruption) or possibly for         privilege escalation.

        Kernel TLS is not enabled in Debian's official kernel         configurations.

    CVE-2023-1073

        Pietro Borrello reported a type confusion flaw in the HID (Human         Interface Device) subsystem.  An attacker able to insert and         remove USB devices might be able to use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1074

        Pietro Borrello reported a type confusion flaw in the SCTP         protocol implementation which can lead to a memory leak.  A local         user could exploit this to cause a denial of service (resource         exhaustion).

    CVE-2023-1076

        Pietro Borrello reported a type confusion flaw in the TUN/TAP         network driver, which results in all TUN/TAP sockets being marked         as belonging to user ID 0 (root).  This may allow local users to         evade local firewall rules based on user ID.

    CVE-2023-1077

        Pietro Borrello reported a type confusion flaw in the task         scheduler.  A local user might be able to exploit this to cause a         denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2023-1078

        Pietro Borrello reported a type confusion flaw in the RDS protocol         implementation.  A local user could exploit this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-1079

        Pietro Borrello reported a race condition in the hid-asus HID         driver which could lead to a use-after-free.  An attacker able to         insert and remove USB devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1118

        Duoming Zhou reported a race condition in the ene_ir remote         control driver that can lead to a use-after-free if the driver         is unbound.  It is not clear what the security impact of this is.

    CVE-2023-1281, CVE-2023-1829

        valis reported two flaws in the cls_tcindex network traffic         classifier which could lead to a use-after-free.  A local user can         exploit these for privilege escalation.  This update removes         cls_tcindex entirely.

    CVE-2023-1513

        Xingyuan Mo reported an information leak in the KVM implementation         for the i386 (32-bit PC) architecture.  A local user could exploit         this to leak sensitive information from the kernel.

    CVE-2023-1611

        butt3rflyh4ck reported a race condition in the btrfs filesystem         driver which can lead to a use-after-free.  A local user could         exploit this to cause a denial of service (crash or memory         corruption) or possibly for privilege escalation.

    CVE-2023-1670

        Zheng Wang reported a race condition in the xirc2ps_cs network         driver which can lead to a use-after-free.  An attacker able to         insert and remove PCMCIA devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1855

        Zheng Wang reported a race condition in the xgene-hwmon hardware         monitoring driver that may lead to a use-after-free.  It is not         clear what the security impact of this is.

    CVE-2023-1859

        Zheng Wang reported a race condition in the 9pnet_xen transport         for the 9P filesystem on Xen, which can lead to a use-after-free.
        On systems where this feature is used, a backend driver in another         domain can use this to cause a denial of service (crash or memory         corruption) or possibly to run arbitrary code in the vulnerable         domain.

    CVE-2023-1872

        Bing-Jhong Billy Jheng reported a race condition in the io_uring         subsystem that can lead to a use-after-free.  A local user could         exploit this to cause a denial of service (crash or memory         corruption) or possibly for privilege escalation.

    CVE-2023-1989

        Zheng Wang reported a race condition in the btsdio Bluetooth         adapter driver that can lead to a use-after-free.  An attacker         able to insert and remove SDIO devices can use this to cause a         denial of service (crash or memory corruption) or possibly to run         arbitrary code in the kernel.

    CVE-2023-1990

        Zheng Wang reported a race condition in the st-nci NFC adapter         driver that can lead to a use-after-free.  It is not clear what         the security impact of this is.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2023-1998

        Jos Oliveira and Rodrigo Branco reported a regression in Spectre         v2 mitigation for user-space on x86 CPUs supporting IBRS but not         eIBRS.  This might be exploitable by a local or remote attacker to         leak sensitive information from a user-space application.

    CVE-2023-2162

        Mike Christie reported a race condition in the iSCSI TCP transport         that can lead to a use-after-free.  On systems where this feature         is used, a local user might be able to use this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-2194

        Wei Chen reported a potential heap buffer overflow in the         i2c-xgene-slimpro IC adapter driver.  A local user with         permission to access such a device can use this to cause a denial         of service (crash or memory corruption) and probably for privilege         escalation.

    CVE-2023-22998

        Miaoqian Lin reported an incorrect error check in the virtio-gpu         GPU driver.  A local user with access to such a device might be         able to use this to cause a denial of service (crash).

    CVE-2023-23004

        Miaoqian Lin reported an incorrect error check in the mali-dp GPU         driver.  A local user with access to such a device might be able         to use this to cause a denial of service (crash).

    CVE-2023-23559

        Szymon Heidrich reported incorrect bounds checks in the rndis_wlan         Wi-Fi driver which may lead to a heap buffer overflow or overread.
        An attacker able to insert and remove USB devices can use this to         cause a denial of service (crash or memory corruption) or         information leak, or possibly to run arbitrary code in the kernel.

    CVE-2023-25012

        Pietro Borrello reported a race condition in the hid-bigbenff HID         driver which could lead to a use-after-free.  An attacker able to         insert and remove USB devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-26545

        Lianhui Tang reported a flaw in the MPLS protocol implementation         that could lead to a double-free.  A local user might be able to         exploit this to cause a denial of service (crash or memory         corruption) or possibl for privilege escalation.

    CVE-2023-28328

        Wei Chen reported a flaw in the az6927 DVB driver that can lead to         a null pointer dereference.  A local user permitted to access an         IC adapter device that this driver creates can use this to cause         a denial of service (crash).

    CVE-2023-28466

        Hangyu Hua reported a race condition in the kernel TLS socket         implementation which can lead to a use-after-free or null         pointer dereference.  A local user can exploit this for         denial of service (crash or memory corruption) or possibly for         privilege escalation.

        This feature is not enabled in Debian's official kernel         configurations.

    CVE-2023-30456

        Reima ISHII reported a flaw in the KVM implementation for Intel         CPUs affecting nested virtualisation.  When KVM was used as the L0         hypervisor, and EPT and/or unrestricted guest mode was disabled,         it did not prevent an L2 guest from being configured with an         architecturally invalid protection/paging mode.  A malicious guest         could exploit this to cause a denial of service (crash).

    For Debian 10 buster, these problems have been fixed in version     5.10.178-3~deb10u1.  This update additionally fixes Debian bugs     #989705, #993612, #1022126, and #1031753; and includes many more bug     fixes from stable updates 5.10.163-5.10.178 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
173782	Ubuntu 18.04 LTS : Linux kernel (GCP) vulnerabilities (USN-5991-1)	Nessus	Ubuntu Local Security Checks	4/3/2023	8/27/2024	high
173834	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-5987-1)	Nessus	Ubuntu Local Security Checks	4/4/2023	8/27/2024	high
174155	Ubuntu 16.04 ESM : Linux kernel (GCP) vulnerabilities (USN-6009-1)	Nessus	Ubuntu Local Security Checks	4/12/2023	8/27/2024	high
172633	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2023-12196)	Nessus	Oracle Linux Local Security Checks	3/17/2023	11/1/2024	high
174330	Ubuntu 20.04 LTS : Linux kernel (BlueField) vulnerabilities (USN-6020-1)	Nessus	Ubuntu Local Security Checks	4/14/2023	8/27/2024	high
174485	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6032-1)	Nessus	Ubuntu Local Security Checks	4/19/2023	8/27/2024	high
173627	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:1608-1)	Nessus	SuSE Local Security Checks	3/29/2023	7/14/2023	high
175926	Debian dla-3403 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	5/17/2023	1/22/2025	high
183770	SUSE SLES15 Security Update : suse-module-tools (SUSE-SU-2023:4160-1)	Nessus	SuSE Local Security Checks	10/24/2023	10/24/2023	high
175925	Debian dla-3404 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	5/17/2023	1/22/2025	high
502888	Siemens SIMATIC S7-1500 TM MFP Linux Kernel Integer Overflow or Wraparound (CVE-2023-23559)	Tenable OT Security	Tenable.ot	2/24/2025	2/25/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high