The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6311-1 advisory.

    William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly     handle network packet retransmission in certain situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2022-4269)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly check     buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker     could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

    Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu     memory management structure. A local attacker could use this to expose sensitive information (kernel     memory) or in conjunction with another kernel vulnerability. (CVE-2023-0597)

    It was discovered that a race condition existed in the btrfs file system implementation in the Linux     kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

    It was discovered that the APM X-Gene SoC hardware monitoring driver in the Linux kernel contained a race     condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1855)

    It was discovered that the ST NCI NFC driver did not properly handle device removal events. A physically     proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-1990)

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the XFS file system implementation in the Linux kernel did not properly perform     metadata validation when mounting certain images. An attacker could use this to specially craft a file     system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124)

    Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF     verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations,     leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

    It was discovered that the SLIMpro I2C device driver in the Linux kernel did not properly validate user-     supplied data in some situations, leading to an out-of-bounds write vulnerability. A privileged attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-2194)

    It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A     privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-2235)

    Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle     locking during table_clear() operations. A local attacker could use this to cause a denial of service     (kernel deadlock). (CVE-2023-2269)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    It was discovered that a race condition existed in the TLS subsystem in the Linux kernel, leading to a     use-after-free or a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-28466)

    It was discovered that the DA9150 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-30772)

    It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a     race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly validate     pointers in some situations, leading to a null pointer dereference vulnerability. A remote attacker could     use this to cause a denial of service (system crash). (CVE-2023-32248)

    It was discovered that the kernel->user space relay implementation in the Linux kernel did not properly     perform certain buffer calculations, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash) or expose sensitive information (kernel     memory). (CVE-2023-3268)

    It was discovered that the Qualcomm EMAC ethernet driver in the Linux kernel did not properly handle     device removal, leading to a user-after free vulnerability. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33203)

    It was discovered that the BQ24190 charger driver in the Linux kernel did not properly handle device     removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33288)

    It was discovered that the video4linux driver for Philips based TV cards in the Linux kernel contained a     race condition during device removal, leading to a use-after-free vulnerability. A physically proximate     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-35823)

    It was discovered that the SDMC DM1105 PCI device driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35824)

    It was discovered that the Renesas USB controller driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35828)

    It was discovered that the Rockchip Video Decoder IP driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35829)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2004 advisory.

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-2 advisory.

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could     potentially use this to expose sensitive information. (CVE-2023-3006)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly     handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A     physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3508 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3508-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     July 27, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 4.19.289-1     CVE ID         : CVE-2023-1380 CVE-2023-2002 CVE-2023-2007 CVE-2023-2269                      CVE-2023-3090 CVE-2023-3111 CVE-2023-3141 CVE-2023-3268                      CVE-2023-3338 CVE-2023-20593 CVE-2023-31084 CVE-2023-32233                      CVE-2023-34256 CVE-2023-35788 CVE-2023-35823 CVE-2023-35824                      CVE-2023-35828

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2023-1380

        Jisoo Jang reported a heap out-of-bounds read in the brcmfmac         Wi-Fi driver.  On systems using this driver, a local user could         exploit this to read sensitive information or to cause a denial of         service (crash).

    CVE-2023-2002

        Ruiahn Li reported an incorrect permissions check in the Bluetooth         subsystem.  A local user could exploit this to reconfigure local         Bluetooth interfaces, resulting in information leaks, spoofing, or         denial of service (loss of connection).

    CVE-2023-2007

        Lucas Leong (@_wmliang_) and Reno Robert of Trend Micro Zero Day         Initiative discovered a time-of-check-to-time-of-use flaw in the         dpt_i2o SCSI controller driver.  A local user with access to a         SCSI device using this driver could exploit this for privilege         escalation.

        This flaw has been mitigated by removing support for the I2OUSRCMD         operation.

    CVE-2023-2269

        Zheng Zhang reported that improper handling of locking in the         device mapper implementation may result in denial of service.

    CVE-2023-3090

        It was discovered that missing initialization in ipvlan networking         may lead to an out-of-bounds write vulnerability, resulting in         denial of service or potentially the execution of arbitrary code.

    CVE-2023-3111

        The TOTE Robot tool found a flaw in the Btrfs filesystem driver         that can lead to a use-after-free.  It's unclear whether an         unprivileged user can exploit this.

    CVE-2023-3141

        A flaw was discovered in the r592 memstick driver that could lead         to a use-after-free after the driver is removed or unbound from a         device.  The security impact of this is unclear.

    CVE-2023-3268

        It was discovered that an out-of-bounds memory access in relayfs         could result in denial of service or an information leak.

    CVE-2023-3338

        Ornaghi Davide discovered a flaw in the DECnet protocol         implementation which could lead to a null pointer dereference or         use-after-free.  A local user can exploit this to cause a denial         of service (crash or memory corruption) and probably for privilege         escalation.

        This flaw has been mitigated by removing the DECnet protocol         implementation.

    CVE-2023-20593

        Tavis Ormandy discovered that under specific microarchitectural         circumstances, a vector register in AMD Zen 2 CPUs may not be         written to 0 correctly.  This flaw allows an attacker to leak         sensitive information across concurrent processes, hyper threads         and virtualized guests.

        For details please refer to         <https://lock.cmpxchg8b.com/zenbleed.html> and         <https://github.com/google/security-research/security/advisories/GHSA-v6wh-rxpg-cmm8>.

        This issue can also be mitigated by a microcode update through the         amd64-microcode package or a system firmware (BIOS/UEFI) update.
        However, the initial microcode release by AMD only provides         updates for second generation EPYC CPUs.  Various Ryzen CPUs are         also affected, but no updates are available yet.

    CVE-2023-31084

        It was discovered that the DVB Core driver does not properly         handle locking of certain events, allowing a local user to cause a         denial of service.

    CVE-2023-32233

        Patryk Sondej and Piotr Krysiuk discovered a use-after-free flaw         in the Netfilter nf_tables implementation when processing batch         requests, which may result in local privilege escalation for a         user with the CAP_NET_ADMIN capability in any user or network         namespace.

    CVE-2023-34256

        The syzbot tool found a time-of-check-to-time-of-use flaw in the         ext4 filesystem driver.  An attacker able to mount a disk image or         device that they can also write to directly could exploit this to         cause an out-of-bounds read, possibly resulting in a leak of         sensitive information or denial of service (crash).

    CVE-2023-35788

        Hangyu Hua discovered an out-of-bounds write vulnerability in the         Flower classifier which may result in denial of service or the         execution of arbitrary code.

    CVE-2023-35823

        A flaw was discovered in the saa7134 media driver that could lead         to a use-after-free after the driver is removed or unbound from a         device.  The security impact of this is unclear.

    CVE-2023-35824

        A flaw was discovered in the dm1105 media driver that could lead         to a use-after-free after the driver is removed or unbound from a         device.  The security impact of this is unclear.

    CVE-2023-35828

        A flaw was discovered in the renesas_udc USB device-mode driver         that could lead to a use-after-free after the driver is removed or         unbound from a device.  The security impact of this is unclear.

        This driver is not enabled in Debian's official kernel         configurations.

    For Debian 10 buster, these problems have been fixed in version     4.19.289-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
180226	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6311-1)	Nessus	Ubuntu Local Security Checks	8/29/2023	6/3/2026	high
193956	CentOS 7 : kernel (RHSA-2024:2004)	Nessus	CentOS Local Security Checks	4/26/2024	10/10/2024	critical
226065	Linux Distros Unpatched Vulnerability : CVE-2023-2002	Nessus	Misc.	3/5/2025	7/17/2026	medium
192318	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (GCP) vulnerabilities (USN-6701-2)	Nessus	Ubuntu Local Security Checks	3/20/2024	9/18/2024	critical
178958	Debian dla-3508 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	7/28/2023	1/22/2025	critical

Detections

Analytics

Plugins Search

high

critical

medium

critical

critical