The version of kernel installed on the remote host is prior to 5.10.218-206.860. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-062 advisory.

    2024-07-03: CVE-2024-36889 was added to this advisory.

    2024-07-03: CVE-2023-52585 was added to this advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: flower: protect fl_walk() with rcu (CVE-2021-47402)

    A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks. (CVE-2022-0480)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() (CVE-2023-52585)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Fix use-after-free in ep_remove_wait_queue() (CVE-2023-52707)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks. (CVE-2022-0480)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2394 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133,     CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085,     CVE-2024-26582)

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915,     CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)

    * kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)

    * kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)

    * kernel: GC's deletion of an SKB races with unix_stream_read_generic()  leading to UAF (CVE-2023-6531)

    * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size     (CVE-2023-6931)

    * kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)

    * kernel: irdma: Improper access control (CVE-2023-25775)

    * Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)

    * kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)

    * kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl     (CVE-2023-31083)

    * kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193,     CVE-2023-6121, CVE-2023-39194)

    * kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)

    * kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)

    * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)

    * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)

    * kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)

    * kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)

    * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

    * kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)

    * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

    * kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in     function receive_encrypted_standard of client (CVE-2024-0565)

    * kernel: tls: race between async notify and socket close (CVE-2024-26583)

    * kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)

    * kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)

    * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)

    * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

    * kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)

    * kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)

    * kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)

    * kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)

    * kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0145 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2021-46972:
    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix leaked dentry

    Since commit 6815f479ca90 (ovl: use only uppermetacopy state in     ovl_lookup()), overlayfs doesn't put temporary dentry when there is a     metacopy error, which leads to dentry leaks when shutting down the related     superblock:

    overlayfs: refusing to follow metacopy origin for (/file0)     ...
    BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]     ...
    WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d     CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1     ...
    RIP: 0010:umount_check.cold+0x107/0x14d     ...
    Call Trace:
     d_walk+0x28c/0x950      ? dentry_lru_isolate+0x2b0/0x2b0      ? __kasan_slab_free+0x12/0x20      do_one_tree+0x33/0x60      shrink_dcache_for_umount+0x78/0x1d0      generic_shutdown_super+0x70/0x440      kill_anon_super+0x3e/0x70      deactivate_locked_super+0xc4/0x160      deactivate_super+0xfa/0x140      cleanup_mnt+0x22e/0x370
     __cleanup_mnt+0x1a/0x30      task_work_run+0x139/0x210      do_exit+0xb0c/0x2820      ? __kasan_check_read+0x1d/0x30      ? find_held_lock+0x35/0x160      ? lock_release+0x1b6/0x660      ? mm_update_next_owner+0xa20/0xa20      ? reacquire_held_locks+0x3f0/0x3f0      ? __sanitizer_cov_trace_const_cmp4+0x22/0x30      do_group_exit+0x135/0x380
     __do_sys_exit_group.isra.0+0x20/0x20
     __x64_sys_exit_group+0x3c/0x50      do_syscall_64+0x45/0x70      entry_SYSCALL_64_after_hwframe+0x44/0xae     ...
    VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

    This fix has been tested with a syzkaller reproducer.

    CVE-2021-3739:
    A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the     Linux Kernel, where triggering the bug requires CAP_SYS_ADMIN. This flaw allows a local attacker to     crash the system or leak kernel internal information. The highest threat from this vulnerability is to     system availability.

    CVE-2021-4083:
    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4.

    CVE-2023-1611:
    A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This     flaw allows an attacker to crash the system and possibly cause a kernel information lea

    CVE-2022-0480:
    A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks.

    CVE-2022-3606:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.

    CVE-2023-52583:
    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix deadlock or deadcode of misusing dget()

    The lock order is incorrect between denty and its parent, we should     always make sure that the parent get the lock first.

    But since this deadcode is never used and the parent dir will always     be set from the callers, let's just remove it.

    CVE-2023-52590:
    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change ocfs2 rename code to avoid touching renamed directory if     its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52591:
    In the Linux kernel, the following vulnerability has been resolved:

    reiserfs: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change reiserfs rename code to avoid touching renamed directory     if its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52599:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix array-index-out-of-bounds in diNewExt

    [Syz report]     UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2     index -878706688 is out of range for type 'struct iagctl[128]'     CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106      ubsan_epilogue lib/ubsan.c:217 [inline]
     __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348      diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360      diAllocExt fs/jfs/jfs_imap.c:1949 [inline]      diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666      diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587      ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56      jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225      vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106      do_mkdirat+0x264/0x3a0 fs/namei.c:4129
     __do_sys_mkdir fs/namei.c:4149 [inline]
     __se_sys_mkdir fs/namei.c:4147 [inline]
     __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147      do_syscall_x64 arch/x86/entry/common.c:51 [inline]      do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82      entry_SYSCALL_64_after_hwframe+0x63/0x6b     RIP: 0033:0x7fcb7e6a0b57     Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053     RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57     RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140     RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

    [Analysis]     When the agstart is too large, it can cause agno overflow.

    [Fix]     After obtaining agno, if the value is invalid, exit the subsequent process.


    Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next     report by kernel test robot (Dan Carpenter).

    CVE-2023-52600:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix uaf in jfs_evict_inode

    When the execution of diMount(ipimap) fails, the object ipimap that has been     released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs     when rcu_core() calls jfs_free_node().

    Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as     ipimap.

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.

    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2023-6121:
    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.



    CVE-2022-45886:
    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.

    CVE-2022-45919:
    An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

    CVE-2022-20423:
    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel

    CVE-2023-6606:
    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6610:
    An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2024-0565:
    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.

    CVE-2023-26607:
    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

    CVE-2022-42328:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2022-42329:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2023-42754:
    A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1304 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    Bug Fix(es):

    * [RHEL9] Add various *.peak control files to cgroup v2 (JIRA:RHEL-22850)

    * RHEL9 Guest on Google Cloud panics on reading pvpanic device capabilities (JIRA:RHEL-23858)

    * raid5: read data is wrong when recovery happens  (JIRA:RHEL-23882)

    * md/raid5: release batch_last before waiting for another stripe_head (JIRA:RHEL-24512)

    * [regression][ext4][xfstests generic/094] Error reading from file with invalid argument (JIRA:RHEL-25436)

    * bpf: Fix elem_size not being set for inner maps (JIRA:RHEL-25764)

    * Backport crypto: rsa - allow only odd e and restrict value in FIPS mode (JIRA:RHEL-26078)

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (JIRA:RHEL-8911)

    * [HPEMC RHEL 9.3 BUG] tools/power/x86 intel-speed-select crashes on systems with more than 8 sockets     (JIRA:RHEL-17907)

    * IPoIB: fix PKEY creation (JIRA:RHEL-22221)

    * Memory corruption when using dm-crypt or dm-verity on RHEL-9 (JIRA:RHEL-26095)

    * backport smartpqi: fix disable_managed_interrupts (JIRA:RHEL-26143)

    * ffdhe* algortihms introduced in 0a2e5b909023 as .fips_allowed=1 lack pairwise consistency tests     (JIRA:RHEL-27007)

    Enhancement(s):

    * s390/qeth: Fix vipa deletion (JIRA:RHEL-25813)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1303 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    Bug Fix(es):

    * kernel-rt: kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion     (JIRA:RHEL-8998)

    * kernel-rt: update RT source tree to the latest RHEL-9.2.z7 Batch (JIRA:RHEL-26863)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1026 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.

    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2024-0565:
    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.



    CVE-2023-6610:
    An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6606:
    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6121:
    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).

    CVE-2023-52600:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix uaf in jfs_evict_inode

    When the execution of diMount(ipimap) fails, the object ipimap that has been     released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs     when rcu_core() calls jfs_free_node().

    Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as     ipimap.

    CVE-2023-52599:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix array-index-out-of-bounds in diNewExt

    [Syz report]     UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2     index -878706688 is out of range for type 'struct iagctl[128]'     CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106      ubsan_epilogue lib/ubsan.c:217 [inline]
     __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348      diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360      diAllocExt fs/jfs/jfs_imap.c:1949 [inline]      diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666      diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587      ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56      jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225      vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106      do_mkdirat+0x264/0x3a0 fs/namei.c:4129
     __do_sys_mkdir fs/namei.c:4149 [inline]
     __se_sys_mkdir fs/namei.c:4147 [inline]
     __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147      do_syscall_x64 arch/x86/entry/common.c:51 [inline]      do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82      entry_SYSCALL_64_after_hwframe+0x63/0x6b     RIP: 0033:0x7fcb7e6a0b57     Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053     RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57     RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140     RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

    [Analysis]     When the agstart is too large, it can cause agno overflow.

    [Fix]     After obtaining agno, if the value is invalid, exit the subsequent process.


    Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next     report by kernel test robot (Dan Carpenter).

    CVE-2023-52591:
    In the Linux kernel, the following vulnerability has been resolved:

    reiserfs: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change reiserfs rename code to avoid touching renamed directory     if its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52590:
    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change ocfs2 rename code to avoid touching renamed directory if     its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52583:
    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix deadlock or deadcode of misusing dget()

    The lock order is incorrect between denty and its parent, we should     always make sure that the parent get the lock first.

    But since this deadcode is never used and the parent dir will always     be set from the callers, let's just remove it.

    CVE-2023-26607:
    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

    CVE-2023-1611:
    A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This     flaw allows an attacker to crash the system and possibly cause a kernel information lea

    CVE-2022-45919:
    An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

    CVE-2022-45886:
    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.

    CVE-2022-42329:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2022-3606:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.

    CVE-2022-20423:
    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel

    CVE-2022-0480:
    A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks.

    CVE-2021-46972:
    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix leaked dentry

    Since commit 6815f479ca90 (ovl: use only uppermetacopy state in     ovl_lookup()), overlayfs doesn't put temporary dentry when there is a     metacopy error, which leads to dentry leaks when shutting down the related     superblock:

    overlayfs: refusing to follow metacopy origin for (/file0)     ...
    BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]     ...
    WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d     CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1     ...
    RIP: 0010:umount_check.cold+0x107/0x14d     ...
    Call Trace:
     d_walk+0x28c/0x950      ? dentry_lru_isolate+0x2b0/0x2b0      ? __kasan_slab_free+0x12/0x20      do_one_tree+0x33/0x60      shrink_dcache_for_umount+0x78/0x1d0      generic_shutdown_super+0x70/0x440      kill_anon_super+0x3e/0x70      deactivate_locked_super+0xc4/0x160      deactivate_super+0xfa/0x140      cleanup_mnt+0x22e/0x370
     __cleanup_mnt+0x1a/0x30      task_work_run+0x139/0x210      do_exit+0xb0c/0x2820      ? __kasan_check_read+0x1d/0x30      ? find_held_lock+0x35/0x160      ? lock_release+0x1b6/0x660      ? mm_update_next_owner+0xa20/0xa20      ? reacquire_held_locks+0x3f0/0x3f0      ? __sanitizer_cov_trace_const_cmp4+0x22/0x30      do_group_exit+0x135/0x380
     __do_sys_exit_group.isra.0+0x20/0x20
     __x64_sys_exit_group+0x3c/0x50      do_syscall_64+0x45/0x70      entry_SYSCALL_64_after_hwframe+0x44/0xae     ...
    VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

    This fix has been tested with a syzkaller reproducer.

    CVE-2021-4083:
    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4.

    CVE-2021-3739:
    A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the     Linux Kernel, where triggering the bug requires CAP_SYS_ADMIN. This flaw allows a local attacker to     crash the system or leak kernel internal information. The highest threat from this vulnerability is to     system availability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0144 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2021-46972:
    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix leaked dentry

    Since commit 6815f479ca90 (ovl: use only uppermetacopy state in     ovl_lookup()), overlayfs doesn't put temporary dentry when there is a     metacopy error, which leads to dentry leaks when shutting down the related     superblock:

    overlayfs: refusing to follow metacopy origin for (/file0)     ...
    BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]     ...
    WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d     CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1     ...
    RIP: 0010:umount_check.cold+0x107/0x14d     ...
    Call Trace:
     d_walk+0x28c/0x950      ? dentry_lru_isolate+0x2b0/0x2b0      ? __kasan_slab_free+0x12/0x20      do_one_tree+0x33/0x60      shrink_dcache_for_umount+0x78/0x1d0      generic_shutdown_super+0x70/0x440      kill_anon_super+0x3e/0x70      deactivate_locked_super+0xc4/0x160      deactivate_super+0xfa/0x140      cleanup_mnt+0x22e/0x370
     __cleanup_mnt+0x1a/0x30      task_work_run+0x139/0x210      do_exit+0xb0c/0x2820      ? __kasan_check_read+0x1d/0x30      ? find_held_lock+0x35/0x160      ? lock_release+0x1b6/0x660      ? mm_update_next_owner+0xa20/0xa20      ? reacquire_held_locks+0x3f0/0x3f0      ? __sanitizer_cov_trace_const_cmp4+0x22/0x30      do_group_exit+0x135/0x380
     __do_sys_exit_group.isra.0+0x20/0x20
     __x64_sys_exit_group+0x3c/0x50      do_syscall_64+0x45/0x70      entry_SYSCALL_64_after_hwframe+0x44/0xae     ...
    VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

    This fix has been tested with a syzkaller reproducer.

    CVE-2021-3739:
    A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the     Linux Kernel, where triggering the bug requires CAP_SYS_ADMIN. This flaw allows a local attacker to     crash the system or leak kernel internal information. The highest threat from this vulnerability is to     system availability.

    CVE-2021-4083:
    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4.

    CVE-2023-1611:
    A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This     flaw allows an attacker to crash the system and possibly cause a kernel information lea

    CVE-2022-0480:
    A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks.

    CVE-2022-3606:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.

    CVE-2023-52583:
    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix deadlock or deadcode of misusing dget()

    The lock order is incorrect between denty and its parent, we should     always make sure that the parent get the lock first.

    But since this deadcode is never used and the parent dir will always     be set from the callers, let's just remove it.

    CVE-2023-52590:
    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change ocfs2 rename code to avoid touching renamed directory if     its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52591:
    In the Linux kernel, the following vulnerability has been resolved:

    reiserfs: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change reiserfs rename code to avoid touching renamed directory     if its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52599:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix array-index-out-of-bounds in diNewExt

    [Syz report]     UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2     index -878706688 is out of range for type 'struct iagctl[128]'     CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106      ubsan_epilogue lib/ubsan.c:217 [inline]
     __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348      diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360      diAllocExt fs/jfs/jfs_imap.c:1949 [inline]      diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666      diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587      ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56      jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225      vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106      do_mkdirat+0x264/0x3a0 fs/namei.c:4129
     __do_sys_mkdir fs/namei.c:4149 [inline]
     __se_sys_mkdir fs/namei.c:4147 [inline]
     __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147      do_syscall_x64 arch/x86/entry/common.c:51 [inline]      do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82      entry_SYSCALL_64_after_hwframe+0x63/0x6b     RIP: 0033:0x7fcb7e6a0b57     Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053     RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57     RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140     RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

    [Analysis]     When the agstart is too large, it can cause agno overflow.

    [Fix]     After obtaining agno, if the value is invalid, exit the subsequent process.


    Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next     report by kernel test robot (Dan Carpenter).

    CVE-2023-52600:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix uaf in jfs_evict_inode

    When the execution of diMount(ipimap) fails, the object ipimap that has been     released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs     when rcu_core() calls jfs_free_node().

    Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as     ipimap.

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.

    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2023-6121:
    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.



    CVE-2022-45886:
    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.

    CVE-2022-45919:
    An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

    CVE-2022-20423:
    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel

    CVE-2023-6606:
    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6610:
    An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2024-0565:
    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.

    CVE-2023-26607:
    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

    CVE-2022-42328:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2022-42329:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2023-42754:
    A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1306 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch     requests (CVE-2023-3390)

    * out-of-bounds access in relay_file_read (CVE-2023-3268)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982,Downfall)

    * net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (CVE-2023-38409)

    * Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue ()

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * use after free in unix_stream_sendpage (CVE-2023-4622)

    * bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its     child's sibling_list (CVE-2023-5717)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

    * use-after-free in IPv4 IGMP (CVE-2023-6932)

    * GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)

    * refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (JIRA:RHEL-1107)

    * out-of-bounds access in relay_file_read (JIRA:RHEL-1749)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18085)

    * NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19524)

    * update RT source tree to the latest RHEL-9.0.z Batch 15 (JIRA:RHEL-21555)

    * Gather Data Sampling (GDS) side channel vulnerability (JIRA:RHEL-9285)

    * A heap out-of-bounds write (JIRA:RHEL-18011)

    * Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19398)

    * A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19534)

    * Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe (JIRA:RHEL-8980)

    * various flaws (JIRA:RHEL-16150)

    * refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20311)

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-20502)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (JIRA:RHEL-22095)

    * use-after-free in smb2_is_status_io_timeout() (JIRA:RHEL-15171)

    * use-after-free in IPv4 IGMP (JIRA:RHEL-21658)

    * memcg does not limit the number of POSIX file locks allowing memory exhaustion (JIRA:RHEL-8996)

    * GSM multiplexing race condition leads to privilege escalation (JIRA:RHEL-19968)

    * NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:RHEL-22751)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier     (JIRA:RHEL-26381)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1250 advisory.

    Security Fix(es):

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982,Downfall)

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue ()

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (JIRA:RHEL-1104)

    * [SanityOnly][kernel]BUG: sleeping function called from invalid context at     kernel/locking/spinlock_rt.c:35 at: sock_map_update_elem_sys+0x85/0x2a0 (JIRA:RHEL-17572)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18084)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19463)

    * kernel: hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (JIRA:RHEL-8592)

    * kernel: A heap out-of-bounds write (JIRA:RHEL-18008)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19356)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19454)

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (JIRA:RHEL-8978)

    * kernel: use-after-free in smb2_is_status_io_timeout() (JIRA:RHEL-15167)

    * kernel: various flaws (JIRA:RHEL-16148)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-19001)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20307)

    * RHEL9.0 - s390/qeth: recovery and set offline lose routes and IPv6 addr (JIRA:RHEL-17885)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22092)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19103)

    * 5.14.0-70.87.1.el9_0: aarch64 BUG: arch topology borken / the CLS domain not a subset of the MC domain     (JIRA:RHEL-22501)

    * RHEL-9.0 TEST-17-Setup-struct-perf-event-attr / bz1308907 test failure on Ice Lake (JIRA:RHEL-23085)

    * Unbounded memory usage by TCP for receive buffers (JIRA:RHEL-16127)

    * kernel: use-after-free in IPv4 IGMP (JIRA:RHEL-21648)

    * rbd: don't move requests to the running list on errors (JIRA:RHEL-23861)

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1031 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.

    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2024-0565:
    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.



    CVE-2023-6610:
    An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6606:
    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6121:
    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).

    CVE-2023-52600:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix uaf in jfs_evict_inode

    When the execution of diMount(ipimap) fails, the object ipimap that has been     released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs     when rcu_core() calls jfs_free_node().

    Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as     ipimap.

    CVE-2023-52599:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix array-index-out-of-bounds in diNewExt

    [Syz report]     UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2     index -878706688 is out of range for type 'struct iagctl[128]'     CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106      ubsan_epilogue lib/ubsan.c:217 [inline]
     __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348      diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360      diAllocExt fs/jfs/jfs_imap.c:1949 [inline]      diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666      diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587      ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56      jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225      vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106      do_mkdirat+0x264/0x3a0 fs/namei.c:4129
     __do_sys_mkdir fs/namei.c:4149 [inline]
     __se_sys_mkdir fs/namei.c:4147 [inline]
     __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147      do_syscall_x64 arch/x86/entry/common.c:51 [inline]      do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82      entry_SYSCALL_64_after_hwframe+0x63/0x6b     RIP: 0033:0x7fcb7e6a0b57     Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053     RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57     RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140     RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

    [Analysis]     When the agstart is too large, it can cause agno overflow.

    [Fix]     After obtaining agno, if the value is invalid, exit the subsequent process.


    Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next     report by kernel test robot (Dan Carpenter).

    CVE-2023-52591:
    In the Linux kernel, the following vulnerability has been resolved:

    reiserfs: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change reiserfs rename code to avoid touching renamed directory     if its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52590:
    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change ocfs2 rename code to avoid touching renamed directory if     its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52583:
    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix deadlock or deadcode of misusing dget()

    The lock order is incorrect between denty and its parent, we should     always make sure that the parent get the lock first.

    But since this deadcode is never used and the parent dir will always     be set from the callers, let's just remove it.

    CVE-2023-26607:
    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

    CVE-2023-1611:
    A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This     flaw allows an attacker to crash the system and possibly cause a kernel information lea

    CVE-2022-45919:
    An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

    CVE-2022-45886:
    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.

    CVE-2022-42329:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2022-3606:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.

    CVE-2022-20423:
    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel

    CVE-2022-0480:
    A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks.

    CVE-2021-46972:
    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix leaked dentry

    Since commit 6815f479ca90 (ovl: use only uppermetacopy state in     ovl_lookup()), overlayfs doesn't put temporary dentry when there is a     metacopy error, which leads to dentry leaks when shutting down the related     superblock:

    overlayfs: refusing to follow metacopy origin for (/file0)     ...
    BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]     ...
    WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d     CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1     ...
    RIP: 0010:umount_check.cold+0x107/0x14d     ...
    Call Trace:
     d_walk+0x28c/0x950      ? dentry_lru_isolate+0x2b0/0x2b0      ? __kasan_slab_free+0x12/0x20      do_one_tree+0x33/0x60      shrink_dcache_for_umount+0x78/0x1d0      generic_shutdown_super+0x70/0x440      kill_anon_super+0x3e/0x70      deactivate_locked_super+0xc4/0x160      deactivate_super+0xfa/0x140      cleanup_mnt+0x22e/0x370
     __cleanup_mnt+0x1a/0x30      task_work_run+0x139/0x210      do_exit+0xb0c/0x2820      ? __kasan_check_read+0x1d/0x30      ? find_held_lock+0x35/0x160      ? lock_release+0x1b6/0x660      ? mm_update_next_owner+0xa20/0xa20      ? reacquire_held_locks+0x3f0/0x3f0      ? __sanitizer_cov_trace_const_cmp4+0x22/0x30      do_group_exit+0x135/0x380
     __do_sys_exit_group.isra.0+0x20/0x20
     __x64_sys_exit_group+0x3c/0x50      do_syscall_64+0x45/0x70      entry_SYSCALL_64_after_hwframe+0x44/0xae     ...
    VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

    This fix has been tested with a syzkaller reproducer.

    CVE-2021-4083:
    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4.

    CVE-2021-3739:
    A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the     Linux Kernel, where triggering the bug requires CAP_SYS_ADMIN. This flaw allows a local attacker to     crash the system or leak kernel internal information. The highest threat from this vulnerability is to     system availability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2394 advisory.

    - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28877 RHEL-28878]     {CVE-2023-52489}
    - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26463 RHEL-26465] {CVE-2024-26586}
    - i2c: i801: Fix block process call transactions (David Arcari) [RHEL-26479 RHEL-26481] {CVE-2024-26593}
    - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23428     RHEL-23429] {CVE-2024-26602}
    - tls: fix use-after-free on failed backlog decryption (Sabrina Dubroca) [RHEL-26410 RHEL-26415]     {CVE-2024-26584}
    - tls: separate no-async decryption request handling from async (Sabrina Dubroca) [RHEL-26410 RHEL-26415]     {CVE-2024-26584}
    - tls: decrement decrypt_pending if no async completion will be called (Sabrina Dubroca) [RHEL-26416     RHEL-26421] {CVE-2024-26583}
    - net: tls: fix use-after-free with partial reads and async decrypt (Sabrina Dubroca) [RHEL-26398     RHEL-26401] {CVE-2024-26582}
    - net: tls: handle backlogging of crypto requests (Sabrina Dubroca) [RHEL-26410 RHEL-26415]     {CVE-2024-26584}
    - tls: fix race between tx work scheduling and socket close (Sabrina Dubroca) [RHEL-26361 RHEL-26363]     {CVE-2024-26585}
    - tls: fix race between async notify and socket close (Sabrina Dubroca) [RHEL-26416 RHEL-26421]     {CVE-2024-26583}
    - net: tls: factor out tls_*crypt_async_wait() (Sabrina Dubroca) [RHEL-26416 RHEL-26421] {CVE-2024-26583}
    - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26500 RHEL-26502]     {CVE-2023-52448}
    - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21687 RHEL-21688]     {CVE-2024-0565}
    - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841} (Audra Mitchell)     [RHEL-20615 RHEL-20617] {CVE-2024-0841}
    - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26242 RHEL-26244]     {CVE-2023-52434}
    - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26242 RHEL-26244]     {CVE-2023-52434}
    - tty: n_gsm: initialize more members at gsm_alloc_mux() (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix race condition in gsmld_write() (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix resource allocation order in gsm_activate_mux() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix race condition in status line change on dead connections (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix flow control handling in tx path (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Debug output allocation must use GFP_ATOMIC (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output() (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix NULL pointer access due to DLCI release (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: name the debug bits (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: replace use of gsm_read_ea() with gsm_read_ea_val() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix missing tty wakeup in convergence layer type 2 (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix wrong signal octets encoding in MSC (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix buffer over-read in gsm_dlci_data() (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong modem processing in convergence layer type 2 (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix user open not possible at responder until initiator open (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: Delete gsmtty open SABM frame when config requester (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix deadlock and link starvation in outgoing data path (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix non flow control frames during mux flow off (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix reset fifo race condition (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix missing explicit ldisc flush (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix deadlock in gsmtty_open() (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: Modify CR,PF bit printk info when config requester (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix SW flow control encoding/handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: add parameters used with parameter negotiation (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix wrong command retry handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: introduce macro for minimal unit size (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix insufficient txframe size (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: introduce gsm_control_command() function (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix invalid use of MSC in advanced option (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong command frame length field encoding (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong tty control line for flow control (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix missing timer to handle stalled links (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: add parameter negotiation support (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix tty registration before control channel open (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix software flow control handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Fix packet data hex dump output (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Don't ignore write return value in gsmld_output() (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: name gsm tty device minors (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: stop using alloc_tty_driver (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: don't store semi-state into tty drivers (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - hvsi: don't panic on tty_register_driver failure (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - amiserial: switch rs_table to a single state (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - amiserial: expand 'custom' (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - amiserial: remove serial_* strings (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - amiserial: use memset to zero serial_state (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - Revert 'tty: n_gsm: fix UAF in gsm_cleanup_mux' (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix encoding of command/response bit (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix broken virtual tty handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix missing update of modem controls after DLCI open (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix frame reception handling (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: clean up indenting in gsm_queue() (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Save dlci address open status when config requester (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: Modify CR,PF bit when config requester (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19959     RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix UAF in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix wrong DLCI release order (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix mux cleanup after unregister tty device (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: fix decoupled mux resource (Wander Lairson Costa) [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - tty: n_gsm: fix restart handling via CLD command (Wander Lairson Costa) [RHEL-19959 RHEL-19971]     {CVE-2023-6546}
    - tty: n_gsm: Modify gsmtty driver register method when config requester (Wander Lairson Costa)     [RHEL-19959 RHEL-19971] {CVE-2023-6546}
    - netfilter: nf_tables: bail out on mismatching dynset and set expressions (Florian Westphal) [RHEL-19016     RHEL-19017] {CVE-2023-6622}
    - netfilter: nf_tables: check if catch-all set element is active in next generation (Florian Westphal)     [RHEL-23505 RHEL-23511] {CVE-2024-1085}
    - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-23502 RHEL-23508]     {CVE-2024-1086}
    - Bluetooth: Add more enc key size check (Bastien Nocera) [RHEL-19668 RHEL-19669] {CVE-2023-24023}
    - ida: Fix crash in ida_free when the bitmap is empty (Wander Lairson Costa) [RHEL-19683 RHEL-19684]     {CVE-2023-6915}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
200921	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-062)	Nessus	Amazon Linux Local Security Checks	6/24/2024	1/7/2025	high
229741	Linux Distros Unpatched Vulnerability : CVE-2022-0480	Nessus	Misc.	3/5/2025	11/25/2025	medium
194794	RHEL 9 : kernel (RHSA-2024:2394)	Nessus	Red Hat Local Security Checks	4/30/2024	10/29/2025	critical
239807	TencentOS Server 3: kernel (TSSA-2024:0145)	Nessus	Tencent Local Security Checks	6/16/2025	11/23/2025	high
192008	RHEL 9 : kernel (RHSA-2024:1304)	Nessus	Red Hat Local Security Checks	3/13/2024	11/7/2024	medium
192009	RHEL 9 : kernel-rt (RHSA-2024:1303)	Nessus	Red Hat Local Security Checks	3/13/2024	11/7/2024	medium
203977	Photon OS 3.0: Linux PHSA-2023-3.0-0538	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	high
276182	TencentOS Server 3: kernel (TSSA-2024:1026)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	high
239077	TencentOS Server 2: kernel (TSSA-2024:0144)	Nessus	Tencent Local Security Checks	6/16/2025	11/23/2025	high
192035	RHEL 9 : kernel-rt (RHSA-2024:1306)	Nessus	Red Hat Local Security Checks	3/13/2024	3/6/2025	critical
191901	RHEL 9 : kernel (RHSA-2024:1250)	Nessus	Red Hat Local Security Checks	3/12/2024	3/6/2025	critical
239850	TencentOS Server 4: kernel (TSSA-2024:0980)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
240010	TencentOS Server 2: kernel (TSSA-2024:1031)	Nessus	Tencent Local Security Checks	6/16/2025	11/23/2025	high
195036	Oracle Linux 9 : kernel (ELSA-2024-2394)	Nessus	Oracle Linux Local Security Checks	5/6/2024	9/11/2025	critical

Detections

Analytics

Plugins Search

high

medium

critical

high

medium

medium

high

high

high

critical

critical

high

high

critical