The version of kernel installed on the remote host is prior to 5.4.217-126.408. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-037 advisory.

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. (CVE-2022-39842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.73-48.135. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-009 advisory.

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

  - A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to     ensure the size of the device config space is in line with the features advertised by the VDUSE userspace     application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory     indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could     cause undefined behavior or data leaks in Virtio drivers. (CVE-2022-2308)

  - A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function     security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use     this flaw to crash the system or potentially escalate their privileges on the system. (CVE-2022-2978)

  - Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238177383References:
    Upstream kernel (CVE-2022-20409)

  - In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race     condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-237540956References: Upstream kernel (CVE-2022-20422)

  - In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel (CVE-2022-20423)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020. (CVE-2022-3523)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

  - A vulnerability classified as critical has been found in Linux Kernel. Affected is the function     btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to     use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability     is VDB-211032. (CVE-2022-3534)

  - A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability. (CVE-2022-3545)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - An out-of-bounds memory write flaw was found in the Linux kernel's Kid-friendly Wired Controller driver.
    This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in     bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have     inputs. However, malicious devices can break this assumption, leaking to out-of-bound write.
    (CVE-2022-3577)

  - A flaw was found in the Linux kernel's networking code. A use-after-free was found in the way the sch_sfb     enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed)     into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of     service. (CVE-2022-3586)

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability. (CVE-2022-3606)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects     the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. It     is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this     vulnerability. (CVE-2022-3629)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

  - roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a     report->value is in progress. (CVE-2022-41850)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-23816)     (CVE-2022-2602)

  - ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided. (CVE-2022-42432)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of kernel installed on the remote host is prior to 5.10.147-133.644. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-021 advisory.

    2024-05-23: CVE-2022-3544 was added to this advisory.

    A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not.  This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

    A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

    A use-after-free flaw was found in the Linux kernel's Unix socket Garbage Collection and io_uring. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2602)

    Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

    A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function     damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to     memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is     VDB-211044. (CVE-2022-3544)

    An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. (CVE-2022-39842)

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the     target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval     function. The issue results from the lack of proper initialization of memory prior to accessing it. An     attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the     context of the kernel. Was ZDI-CAN-18540. (CVE-2022-42432)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
166494	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-037)	Nessus	Amazon Linux Local Security Checks	10/25/2022	1/16/2024	high
166501	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-009)	Nessus	Amazon Linux Local Security Checks	10/25/2022	1/15/2024	high
169569	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-1012)	Nessus	Huawei Local Security Checks	1/5/2023	9/11/2023	high
169573	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-1037)	Nessus	Huawei Local Security Checks	1/5/2023	9/11/2023	high
166495	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-021)	Nessus	Amazon Linux Local Security Checks	10/25/2022	5/27/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high