The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1297-1 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has swtpm packages installed that are affected by a vulnerability:

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9240 advisory.

  - A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets     containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is     marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system     availability. (CVE-2021-3623)

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7472 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number     of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or     malicious actor. (CVE-2022-2211)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:8100 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7472 advisory.

  - QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)

  - libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

  - libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211)

  - swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8100 advisory.

  - swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8100 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7472 advisory.

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

  - A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number     of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or     malicious actor. (CVE-2022-2211)

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7472 advisory.

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

  - A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number     of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or     malicious actor. (CVE-2022-2211)

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the swtpm-0.7.0-2.20211109gitb79fd91.el9 build changelog.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7472 advisory.

  - QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)

  - libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

  - libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211)

  - swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
160069	SUSE SLES15 Security Update : swtpm (SUSE-SU-2022:1297-1)	Nessus	SuSE Local Security Checks	4/22/2022	7/13/2023	medium
167468	NewStart CGSL MAIN 6.02 : swtpm Vulnerability (NS-SA-2022-0101)	Nessus	NewStart CGSL Local Security Checks	11/15/2022	11/15/2022	medium
159123	Oracle Linux 7 : libtpms (ELSA-2022-9240)	Nessus	Oracle Linux Local Security Checks	3/22/2022	12/12/2022	medium
167524	Oracle Linux 8 : virt:ol / and / virt-devel:ol (ELSA-2022-7472)	Nessus	Oracle Linux Local Security Checks	11/15/2022	10/3/2023	medium
167955	AlmaLinux 9 : swtpm (ALSA-2022:8100)	Nessus	Alma Linux Local Security Checks	11/19/2022	11/19/2022	medium
167183	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2022:7472)	Nessus	CentOS Local Security Checks	11/9/2022	10/5/2023	medium
167568	RHEL 9 : swtpm (RHSA-2022:8100)	Nessus	Red Hat Local Security Checks	11/15/2022	4/28/2024	medium
168120	Oracle Linux 9 : swtpm (ELSA-2022-8100)	Nessus	Oracle Linux Local Security Checks	11/22/2022	11/22/2022	medium
167461	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2022:7472)	Nessus	Alma Linux Local Security Checks	11/15/2022	10/4/2023	medium
184779	Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2022:7472)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	medium
191172	CentOS 9 : swtpm-0.7.0-2.20211109gitb79fd91.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	medium
167145	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2022:7472)	Nessus	Red Hat Local Security Checks	11/9/2022	4/28/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium