The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2802-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601, bsc#1225600).
    - CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
    - CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
    - CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
    - CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
    - CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
    - CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
    - CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
    - CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
    - CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
    - CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
    - CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
    - CVE-2024-26691: KVM: arm64: Fix circular locking dependency (bsc#1222463).
    - CVE-2024-26734: devlink: fix possible use-after-free and memory leaks in devlink_init() (bsc#1222438).
    - CVE-2024-26785: iommufd: Fix protection fault in iommufd_test_syz_conv_iova (bsc#1222779).
    - CVE-2024-26826: mptcp: fix data re-injection from stale subflow (bsc#1223010).
    - CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
    - CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
    - CVE-2024-27012: netfilter: nf_tables: restore set elements when delete set fails (bsc#1223804).
    - CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
    - CVE-2024-27016: netfilter: flowtable: validate pppoe header (bsc#1223807).
    - CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
    - CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
    - CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
    - CVE-2024-27064: netfilter: nf_tables: Fix a memory leak in nf_tables_updchain (bsc#1223740).
    - CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
    - CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
    - CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
    - CVE-2024-35805: dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743).
    - CVE-2024-35853: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (bsc#1224604).
    - CVE-2024-35854: Fixed possible use-after-free during rehash (bsc#1224636).
    - CVE-2024-35890: gro: fix ownership transfer (bsc#1224516).
    - CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
    - CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
    - CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
    - CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
    - CVE-2024-35942: pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain (bsc#1224589).
    - CVE-2024-36003: ice: fix LAG and VF lock dependency in ice_reset_vf() (bsc#1224544).
    - CVE-2024-36004: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1224545)
    - CVE-2024-36901: ipv6: prevent NULL dereference in ip6_output() (bsc#1225711)
    - CVE-2024-36902: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (bsc#1225719).
    - CVE-2024-36909: Drivers: hv: vmbus: Do not free ring buffers that couldn't be re-encrypted     (bsc#1225744).
    - CVE-2024-36910: uio_hv_generic: Do not free decrypted memory (bsc#1225717).
    - CVE-2024-36911: hv_netvsc: Do not free decrypted memory (bsc#1225745).
    - CVE-2024-36912: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (bsc#1225752).
    - CVE-2024-36913: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (bsc#1225753).
    - CVE-2024-36914: drm/amd/display: Skip on writeback when it's not applicable (bsc#1225757).
    - CVE-2024-36946: phonet: fix rtm_phonet_notify() skb allocation (bsc#1225851).
    - CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
    - CVE-2024-38558: net: openvswitch: fix overwriting ct original tuple for ICMPv6 (bsc#1226783).
    - CVE-2024-38586: r8169: Fix possible ring buffer corruption on fragmented Tx packets (bsc#1226750).
    - CVE-2024-38598: md: fix resync softlockup when bitmap size is less than array size (bsc#1226757).
    - CVE-2024-38604: block: refine the EOF check in blkdev_iomap_begin (bsc#1226866).
    - CVE-2024-38659: enic: Validate length of nl attributes in enic_set_vf_port (bsc#1226883).
    - CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
    - CVE-2024-39468: smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103.
    - CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
    - CVE-2024-39474: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL (bsc#1227434).
    - CVE-2024-39482: bcache: fix variable length array abuse in btree_iter (bsc#1227447).
    - CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
    - CVE-2024-39490: ipv6: sr: fix missing sk_buff release in seg6_input_core (bsc#1227626).
    - CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
    - CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
    - CVE-2024-39498: drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 (bsc#1227723)
    - CVE-2024-39502: ionic: fix use after netif_napi_del() (bsc#1227755).
    - CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
    - CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
    - CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
    - CVE-2024-40906: net/mlx5: Always stop health timer during driver removal (bsc#1227763).
    - CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
    - CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()     (bsc#1227779).
    - CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
    - CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
    - CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
    - CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
    - CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
    - CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
    - CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
    - CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
    - CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
    - CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
    - CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
    - CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
    - CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
    - CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
    - CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
    - CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()     (bsc#1227866).
    - CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
    - CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
    - CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
    - CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
    - CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
    - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
    - CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5730 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5730-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 15, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2022-43945 CVE-2022-48772 CVE-2024-25741 CVE-2024-26629                      CVE-2024-27019 CVE-2024-31076 CVE-2024-33621 CVE-2024-33847                      CVE-2024-34027 CVE-2024-35247 CVE-2024-36014 CVE-2024-36015                      CVE-2024-36016 CVE-2024-36270 CVE-2024-36286 CVE-2024-36288                      CVE-2024-36489 CVE-2024-36894 CVE-2024-36971 CVE-2024-36974                      CVE-2024-36978 CVE-2024-37078 CVE-2024-37353 CVE-2024-37356                      CVE-2024-38381 CVE-2024-38546 CVE-2024-38547 CVE-2024-38548                      CVE-2024-38549 CVE-2024-38552 CVE-2024-38555 CVE-2024-38558                      CVE-2024-38559 CVE-2024-38560 CVE-2024-38565 CVE-2024-38567                      CVE-2024-38578 CVE-2024-38579 CVE-2024-38582 CVE-2024-38583                      CVE-2024-38586 CVE-2024-38587 CVE-2024-38589 CVE-2024-38590                      CVE-2024-38596 CVE-2024-38597 CVE-2024-38598 CVE-2024-38599                      CVE-2024-38601 CVE-2024-38605 CVE-2024-38607 CVE-2024-38612                      CVE-2024-38613 CVE-2024-38615 CVE-2024-38618 CVE-2024-38619                      CVE-2024-38621 CVE-2024-38627 CVE-2024-38633 CVE-2024-38634                      CVE-2024-38635 CVE-2024-38637 CVE-2024-38659 CVE-2024-38661                      CVE-2024-38662 CVE-2024-38780 CVE-2024-39276 CVE-2024-39292                      CVE-2024-39301 CVE-2024-39467 CVE-2024-39468 CVE-2024-39469                      CVE-2024-39471 CVE-2024-39475 CVE-2024-39476 CVE-2024-39480                      CVE-2024-39482 CVE-2024-39484 CVE-2024-39488 CVE-2024-39489                      CVE-2024-39493 CVE-2024-39495 CVE-2024-39499 CVE-2024-39501                      CVE-2024-39502 CVE-2024-39503 CVE-2024-39505 CVE-2024-39506                      CVE-2024-39509 CVE-2024-40901 CVE-2024-40902 CVE-2024-40904                      CVE-2024-40905 CVE-2024-40912 CVE-2024-40916 CVE-2024-40929                      CVE-2024-40931 CVE-2024-40932 CVE-2024-40934 CVE-2024-40941                      CVE-2024-40942 CVE-2024-40943 CVE-2024-40945 CVE-2024-40958                      CVE-2024-40959 CVE-2024-40960 CVE-2024-40961 CVE-2024-40963                      CVE-2024-40968 CVE-2024-40971 CVE-2024-40974 CVE-2024-40976                      CVE-2024-40978 CVE-2024-40980 CVE-2024-40981 CVE-2024-40983                      CVE-2024-40984 CVE-2024-40987 CVE-2024-40988 CVE-2024-40990                      CVE-2024-40993 CVE-2024-40995 CVE-2024-41000 CVE-2024-41004                      CVE-2024-41005 CVE-2024-41006

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 5.10.221-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7008-1 advisory.

    Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2024-23848)

    It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing     xattr debug information. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-40902)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - PA-RISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - ACPI drivers;

    - Drivers core;

    - Null block device driver;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - Buffer Sharing and Synchronization framework;

    - DMA engine subsystem;

    - EFI core;

    - FPGA Framework;

    - GPU drivers;

    - Greybus drivers;

    - HID subsystem;

    - HW tracing;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device (Mouse) drivers;

    - Mailbox framework;

    - Media drivers;

    - Microchip PCI driver;

    - VMware VMCI Driver;

    - MMC subsystem;

    - Network drivers;

    - PCI subsystem;

    - x86 platform drivers;

    - PTP clock framework;

    - S/390 drivers;

    - SCSI drivers;

    - SoundWire subsystem;

    - Sonic Silicon Backplane drivers;

    - Greybus lights staging drivers;

    - Thermal drivers;

    - TTY drivers;

    - USB subsystem;

    - VFIO drivers;

    - Framebuffer layer;

    - Watchdog drivers;

    - 9P distributed file system;

    - BTRFS file system;

    - File systems infrastructure;

    - Ext4 file system;

    - F2FS file system;

    - JFS file system;

    - Network file system server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - Tracing file system;

    - IOMMU subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Core kernel;

    - BPF subsystem;

    - Kernel debugger infrastructure;

    - DMA mapping infrastructure;

    - IRQ subsystem;

    - Memory management;

    - 9P file system network protocol;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Networking core;

    - Ethtool driver;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netfilter;

    - NET/ROM layer;

    - NFC subsystem;

    - Network traffic control;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - Wireless networking;

    - XFRM subsystem;

    - AppArmor security module;

    - Integrity Measurement Architecture(IMA) framework;

    - Landlock security;

    - Linux Security Modules (LSM) Framework;

    - SELinux security module;

    - Simplified Mandatory Access Control Kernel framework;

    - ALSA framework;

    - HD-audio driver;

    - SOF drivers;

    - KVM core; (CVE-2024-38623, CVE-2024-38662, CVE-2024-39484, CVE-2024-42148, CVE-2024-39493,     CVE-2024-38637, CVE-2024-40962, CVE-2024-36281, CVE-2024-40922, CVE-2024-40958, CVE-2024-40920,     CVE-2024-40986, CVE-2024-40929, CVE-2024-40967, CVE-2024-39296, CVE-2024-40900, CVE-2024-40995,     CVE-2024-40974, CVE-2024-40942, CVE-2024-39464, CVE-2024-40916, CVE-2024-40952, CVE-2024-40997,     CVE-2024-41004, CVE-2024-40970, CVE-2024-40911, CVE-2024-40972, CVE-2024-36477, CVE-2024-40996,     CVE-2024-40988, CVE-2024-38619, CVE-2024-40998, CVE-2024-38627, CVE-2024-36971, CVE-2024-37021,     CVE-2024-40989, CVE-2024-40947, CVE-2024-40957, CVE-2024-39508, CVE-2024-41005, CVE-2024-40931,     CVE-2024-34777, CVE-2024-38633, CVE-2024-38663, CVE-2024-36288, CVE-2024-40955, CVE-2024-40973,     CVE-2024-39483, CVE-2024-38388, CVE-2024-40976, CVE-2024-38622, CVE-2024-40915, CVE-2024-38661,     CVE-2024-38306, CVE-2024-39507, CVE-2024-38659, CVE-2024-40980, CVE-2024-39301, CVE-2024-40945,     CVE-2024-39461, CVE-2024-40948, CVE-2024-39465, CVE-2024-38667, CVE-2024-39498, CVE-2024-39470,     CVE-2024-38629, CVE-2024-40984, CVE-2024-38381, CVE-2024-40903, CVE-2024-38636, CVE-2024-36478,     CVE-2023-52884, CVE-2024-40906, CVE-2024-39371, CVE-2024-38384, CVE-2024-40938, CVE-2024-36978,     CVE-2024-39502, CVE-2024-39291, CVE-2024-39473, CVE-2024-40956, CVE-2024-38618, CVE-2024-40992,     CVE-2024-40944, CVE-2024-39495, CVE-2024-39494, CVE-2024-38632, CVE-2024-38390, CVE-2024-39497,     CVE-2024-40899, CVE-2024-40939, CVE-2024-36481, CVE-2024-40977, CVE-2024-40961, CVE-2024-33847,     CVE-2024-40963, CVE-2024-39276, CVE-2024-40902, CVE-2024-40971, CVE-2024-39485, CVE-2024-40930,     CVE-2024-40985, CVE-2024-39501, CVE-2024-40960, CVE-2024-39503, CVE-2024-40909, CVE-2024-36973,     CVE-2024-36489, CVE-2024-40928, CVE-2024-34027, CVE-2024-40914, CVE-2024-40925, CVE-2024-39500,     CVE-2024-39292, CVE-2024-40987, CVE-2024-39480, CVE-2024-40934, CVE-2024-36270, CVE-2024-38780,     CVE-2024-39479, CVE-2024-39462, CVE-2024-40966, CVE-2024-39510, CVE-2024-39471, CVE-2024-39505,     CVE-2024-37078, CVE-2024-40913, CVE-2024-37356, CVE-2024-38624, CVE-2024-40917, CVE-2024-39506,     CVE-2024-40943, CVE-2024-38625, CVE-2024-38664, CVE-2024-40901, CVE-2024-40964, CVE-2024-40924,     CVE-2024-40918, CVE-2024-36974, CVE-2022-48772, CVE-2024-39509, CVE-2024-38385, CVE-2024-40994,     CVE-2024-39469, CVE-2024-40905, CVE-2024-35247, CVE-2024-41006, CVE-2024-40965, CVE-2024-40932,     CVE-2024-39491, CVE-2024-39499, CVE-2024-40908, CVE-2024-36972, CVE-2024-37026, CVE-2024-40968,     CVE-2024-36244, CVE-2024-39468, CVE-2024-39489, CVE-2024-33621, CVE-2024-40951, CVE-2024-39481,     CVE-2024-40959, CVE-2024-40935, CVE-2024-40927, CVE-2024-40912, CVE-2024-36479, CVE-2024-39467,     CVE-2024-34030, CVE-2024-41003, CVE-2024-40936, CVE-2024-39474, CVE-2024-40969, CVE-2024-40904,     CVE-2024-40937, CVE-2024-40978, CVE-2024-40983, CVE-2024-40910, CVE-2024-39466, CVE-2024-40949,     CVE-2024-39478, CVE-2024-40999, CVE-2024-33619, CVE-2024-38621, CVE-2024-40981, CVE-2024-39475,     CVE-2024-40954, CVE-2024-41000, CVE-2024-39496, CVE-2024-40926, CVE-2024-41040, CVE-2024-39298,     CVE-2024-38635, CVE-2024-39492, CVE-2024-38628, CVE-2024-39504, CVE-2024-42078, CVE-2024-41001,     CVE-2024-39463, CVE-2024-36286, CVE-2024-36484, CVE-2024-40990, CVE-2024-31076, CVE-2024-38630,     CVE-2024-40979, CVE-2024-36015, CVE-2024-40923, CVE-2024-40921, CVE-2024-41002, CVE-2024-40940,     CVE-2024-40975, CVE-2024-40953, CVE-2024-40933, CVE-2024-37354, CVE-2024-40982, CVE-2024-38634,     CVE-2024-39490, CVE-2024-39277, CVE-2024-39488, CVE-2024-40941, CVE-2024-32936, CVE-2024-40919)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7007-3 advisory.

    Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2024-23848)

    Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the     device to be enabled before writing. A local attacker could possibly use this to cause a denial of     service. (CVE-2024-25741)

    It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing     xattr debug information. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-40902)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - M68K architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Accessibility subsystem;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - Drivers core;

    - Bluetooth drivers;

    - Character device driver;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Buffer Sharing and Synchronization framework;

    - DMA engine subsystem;

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - Greybus drivers;

    - HID subsystem;

    - HW tracing;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device (Mouse) drivers;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - VMware VMCI Driver;

    - Network drivers;

    - Near Field Communication (NFC) drivers;

    - NVME drivers;

    - Pin controllers subsystem;

    - PTP clock framework;

    - S/390 drivers;

    - SCSI drivers;

    - SoundWire subsystem;

    - Greybus lights staging drivers;

    - Media staging drivers;

    - Thermal drivers;

    - TTY drivers;

    - USB subsystem;

    - DesignWare USB3 driver;

    - Framebuffer layer;

    - ACRN Hypervisor Service Module driver;

    - eCrypt file system;

    - File systems infrastructure;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - JFS file system;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - IOMMU subsystem;

    - Memory management;

    - Netfilter;

    - BPF subsystem;

    - Kernel debugger infrastructure;

    - DMA mapping infrastructure;

    - IRQ subsystem;

    - Tracing infrastructure;

    - 9P file system network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - IUCV driver;

    - MAC80211 subsystem;

    - Multipath TCP;

    - NET/ROM layer;

    - NFC subsystem;

    - Open vSwitch;

    - Network traffic control;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - Wireless networking;

    - XFRM subsystem;

    - ALSA framework;

    - SoC Audio for Freescale CPUs drivers;

    - Kirkwood ASoC drivers; (CVE-2024-42105, CVE-2024-41002, CVE-2024-38558, CVE-2023-52887, CVE-2024-39487,     CVE-2024-39276, CVE-2024-42077, CVE-2024-39493, CVE-2024-40934, CVE-2024-39277, CVE-2024-42087,     CVE-2024-38598, CVE-2024-38618, CVE-2024-40981, CVE-2024-42127, CVE-2024-38607, CVE-2024-38586,     CVE-2024-40901, CVE-2024-40916, CVE-2024-42247, CVE-2024-42093, CVE-2024-36489, CVE-2024-38615,     CVE-2024-42120, CVE-2024-38567, CVE-2024-40957, CVE-2024-39501, CVE-2024-42140, CVE-2024-33621,     CVE-2024-38573, CVE-2023-52884, CVE-2024-39468, CVE-2024-41092, CVE-2024-40931, CVE-2024-42145,     CVE-2024-39490, CVE-2024-38555, CVE-2024-42086, CVE-2024-38597, CVE-2024-40956, CVE-2024-42223,     CVE-2024-36894, CVE-2024-40961, CVE-2024-42076, CVE-2024-40994, CVE-2024-38619, CVE-2024-39467,     CVE-2024-39466, CVE-2022-48772, CVE-2024-39507, CVE-2024-40914, CVE-2024-41046, CVE-2024-42094,     CVE-2024-38591, CVE-2024-42098, CVE-2024-41027, CVE-2024-41040, CVE-2024-41089, CVE-2024-40945,     CVE-2024-39503, CVE-2024-37356, CVE-2024-36286, CVE-2024-39495, CVE-2024-42101, CVE-2024-40941,     CVE-2024-42137, CVE-2024-38381, CVE-2024-38627, CVE-2024-31076, CVE-2024-42092, CVE-2024-40932,     CVE-2024-40995, CVE-2024-40937, CVE-2024-39489, CVE-2024-42084, CVE-2024-40929, CVE-2024-36978,     CVE-2024-36015, CVE-2024-36014, CVE-2024-42124, CVE-2024-40976, CVE-2024-39502, CVE-2024-38599,     CVE-2024-38661, CVE-2024-42104, CVE-2024-42096, CVE-2024-40904, CVE-2024-40990, CVE-2024-38579,     CVE-2024-40974, CVE-2024-41055, CVE-2024-38633, CVE-2024-38659, CVE-2024-41093, CVE-2024-42154,     CVE-2024-38624, CVE-2024-41049, CVE-2024-38552, CVE-2024-38578, CVE-2024-38605, CVE-2024-40970,     CVE-2024-38601, CVE-2024-38550, CVE-2024-38559, CVE-2024-38571, CVE-2024-40971, CVE-2024-41097,     CVE-2024-40967, CVE-2024-38612, CVE-2024-38587, CVE-2024-41004, CVE-2024-33847, CVE-2024-38580,     CVE-2024-39506, CVE-2024-42102, CVE-2024-36032, CVE-2024-38548, CVE-2024-39499, CVE-2024-38610,     CVE-2024-42152, CVE-2024-40943, CVE-2024-40959, CVE-2024-39488, CVE-2024-36972, CVE-2024-38637,     CVE-2024-40942, CVE-2024-42106, CVE-2024-38546, CVE-2024-38634, CVE-2024-39471, CVE-2024-39482,     CVE-2024-41095, CVE-2024-42229, CVE-2024-42131, CVE-2024-41007, CVE-2024-42095, CVE-2024-42097,     CVE-2024-39480, CVE-2024-35927, CVE-2024-42153, CVE-2024-42080, CVE-2024-42089, CVE-2024-41087,     CVE-2024-39475, CVE-2024-42119, CVE-2024-41041, CVE-2024-38623, CVE-2024-39469, CVE-2024-34777,     CVE-2024-42157, CVE-2024-42085, CVE-2024-36270, CVE-2024-34027, CVE-2024-35247, CVE-2024-38549,     CVE-2024-40954, CVE-2024-41034, CVE-2024-41044, CVE-2024-39509, CVE-2024-40987, CVE-2024-42161,     CVE-2024-40911, CVE-2024-42070, CVE-2024-42109, CVE-2024-37078, CVE-2024-40912, CVE-2024-40988,     CVE-2024-40978, CVE-2024-41048, CVE-2024-41005, CVE-2024-40905, CVE-2024-41047, CVE-2024-41006,     CVE-2024-38560, CVE-2024-42225, CVE-2024-42148, CVE-2024-38596, CVE-2024-38588, CVE-2024-39301,     CVE-2024-38613, CVE-2024-38635, CVE-2024-40960, CVE-2024-39505, CVE-2024-42244, CVE-2024-40963,     CVE-2024-39500, CVE-2024-42082, CVE-2024-36971, CVE-2024-42068, CVE-2024-40984, CVE-2024-41035,     CVE-2024-38583, CVE-2024-42121, CVE-2024-40968, CVE-2024-40958, CVE-2024-40927, CVE-2024-40980,     CVE-2024-40908, CVE-2024-38780, CVE-2024-38590, CVE-2024-42115, CVE-2024-42224, CVE-2024-42232,     CVE-2024-42240, CVE-2024-42236, CVE-2024-38547, CVE-2024-38565, CVE-2024-40902, CVE-2024-38662,     CVE-2024-42090, CVE-2024-36974, CVE-2024-38621, CVE-2024-41000, CVE-2024-40983, CVE-2024-42130,     CVE-2024-38582, CVE-2024-38589)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session     lookup and expire Increment the session reference count within the lock for lookup to avoid racy issue     with session expire. (CVE-2024-58087)

  - In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition     around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see     something like this crash. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD     8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID:
    53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS     PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]     Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b     47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1 RSP:
    0000:ffffac20c5857838 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001     RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180 RBP: 00000000000006d8 R08:
    ffffac20c5857ad0 R09: 0000000000ffff10 R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c     R13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c FS: 00007fe395eed7c0(0000)     GS:ffffa07e2c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000     DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ... ?     gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20     [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ?
    __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ?
    __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ?
    __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]     nvkm_vmm_map_locked+0x224/0x3a0 [nouveau] Adding any sort of useful debug usually makes it go away, so I     hand wrote the function in a line, and debugged the asm. Every so often pt->memory->ptrs is NULL. This     ptrs ptr is set in the nv50_instobj_acquire called from nvkm_kmap. If Thread A and Thread B both get to     nv50_instobj_acquire around the same time, and Thread A hits the refcount_set line, and in lockstep thread     B succeeds at refcount_inc_not_zero, there is a chance the ptrs value won't have been stored since     refcount_set is unordered. Force a memory barrier here, I picked smp_mb, since we want it on all CPUs and     it's write followed by a read. v2: use paired smp_rmb/smp_wmb. (CVE-2024-26984)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs     caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing,     timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be     deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs     will happen. The root cause is shown below: Cleanup Thread | Worker Thread sco_sock_release |     sco_sock_close | __sco_sock_close | sco_sock_set_timer | schedule_delayed_work | sco_sock_kill | (wait a     time) sock_put(sk) //FREE | sco_sock_timeout | sock_hold(sk) //USE The KASAN report triggered by POC is     shown below: [ 95.890016] ================================================================== [ 95.890496]     BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr     ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755]     Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755]     print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ?
    __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755]     kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ?     sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755]     sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755]     worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [     95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755]     ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [     95.890755] </TASK> [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755]     kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [     95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0     [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755]
    __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [     95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [     95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755]     kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755]
    __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [     95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770     [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755]     arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755]     do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755]     The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache     kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed     1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs     to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000     index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0     pincount:0 [ 95.890755] ano ---truncated--- (CVE-2024-27398)

  - In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is     taken into account when fetching packet contents Ensure that packet_buffer_get respects the user_length     provided. If the length of the head packet exceeds the user_length, packet_buffer_get will now return 0 to     signify to the user that no data were read and a larger buffer size is required. Helps prevent user space     overflows. (CVE-2024-27401)

  - In the Linux kernel, the following vulnerability has been resolved: riscv: process: Fix kernel gp leakage     childregs represents the registers which are active for the new thread in user context. For a kernel     thread, childregs->gp is never used since the kernel gp is not touched by switch_to. For a user mode     helper, the gp value can be observed in user space after execve or possibly by other means. [From the     email thread] The /* Kernel thread */ comment is somewhat inaccurate in that it is also used for     user_mode_helper threads, which exec a user process, e.g. /sbin/init or when /proc/sys/kernel/core_pattern     is a pipe. Such threads do not have PF_KTHREAD set and are valid targets for ptrace etc. even before they     exec. childregs is the *user* context during syscall execution and it is observable from userspace in at     least five ways: 1. kernel_execve does not currently clear integer registers, so the starting register     state for PID 1 and other user processes started by the kernel has sp = user stack, gp = kernel
    __global_pointer$, all other integer registers zeroed by the memset in the patch comment. This is a bug in     its own right, but I'm unwilling to bet that it is the only way to exploit the issue addressed by this     patch. 2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread before it execs,     but ptrace requires SIGSTOP to be delivered which can only happen at user/kernel boundaries. 3.
    /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for user_mode_helpers before the exec     completes, but gp is not one of the registers it returns. 4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally     prevents access to kernel addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses are     also exposed via PERF_SAMPLE_REGS_USER which is permitted under LOCKDOWN_PERF. I have not attempted to     write exploit code. 5. Much of the tracing infrastructure allows access to user registers. I have not     attempted to determine which forms of tracing allow access to user registers without already allowing     access to kernel registers. (CVE-2024-35871)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
205163	SUSE SLED15: cluster-md-kmp-64kb / cluster-md-kmp-default / dlm-kmp-64kb / etc (SUSE-SU-2024:2802-1)	Nessus	SuSE Local Security Checks	8/8/2024	6/25/2026	high
332215	Photon OS 5.0: Linux PHSA-2024-5.0-91-0305	Nessus	PhotonOS Local Security Checks	8/5/2026	11/2/2026	high
202458	Debian dsa-5730 : affs-modules-5.10.0-29-4kc-malta-di - security update	Nessus	Debian Local Security Checks	7/16/2024	10/28/2025	high
207235	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-7008-1)	Nessus	Ubuntu Local Security Checks	9/13/2024	9/24/2025	high
207597	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-7007-3)	Nessus	Ubuntu Local Security Checks	9/23/2024	2/3/2026	high
238008	NewStart CGSL MAIN 7.02 : kernel Multiple Vulnerabilities (NS-SA-2025-0084)	Nessus	NewStart CGSL Local Security Checks	6/9/2025	6/18/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high