The version of kernel installed on the remote host is prior to 5.4.91-41.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-019 advisory.

    A flaw was found in the JFS filesystem code. This flaw allows a local attacker with the ability to set     extended attributes to panic the system, causing memory corruption or escalating privileges. The highest     threat from this vulnerability is to confidentiality, integrity, as well as system availability.
    (CVE-2020-27815)

    A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an     authenticated attacker could write to any block on the exported SCSI device backing store. This flaw     allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on the     backing store. The highest threat from this vulnerability is to integrity. In addition, this flaw affects     the tcmu-runner package, where the affected SCSI command is called. (CVE-2020-28374)

    An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are     processing watch events using a single thread. If the events are received faster than the thread is able     to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the     backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable. (CVE-2020-29568)

    An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux     kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped.
    However, the handler may not have time to run if the frontend quickly toggles between the states connect     and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving     guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege     escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.
    (CVE-2020-29569)

    A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel. A local user could     use this flaw to read numerical value from memory after free. (CVE-2020-29660)

    A locking vulnerability was found in the tty subsystem of the Linux kernel in drivers/tty/tty_jobctrl.c.
    This flaw allows a local attacker to possibly corrupt memory or escalate privileges. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-29661)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0362-1 advisory.

    The SUSE Linux Enterprise 12 SP3 LTSS kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
    - CVE-2019-0136: Fixed insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver     that may have allowed an unauthenticated user to potentially enable denial of service via adjacent access     (bnc#1193157).
    - CVE-2020-35519: Fixed out-of-bounds memory access in x25_bind in net/x25/af_x25.c. A bounds check     failure allowed a local attacker with a user account on the system to gain access to out-of-bounds memory,     leading to a system crash or a leak of internal kernel information (bnc#1183696).
    - CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free.
    This could lead to local escalation of privilege with System execution privileges needed. User interaction     is not needed for exploitation (bnc#1192032).
    - CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392)     (bsc#1193442).
    - CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that may have     allowed an authenticated user to potentially cause denial of service via local access (bnc#1192877).
    - CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization     subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could     use this flaw to crash the system (bnc#1186207).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
    - CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket     file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race     condition (bnc#1193727).
    - CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
    - CVE-2021-4155: Fixed XFS map issue when unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate     (bsc#1194272).
    - CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
    - CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
    - CVE-2021-43976: Fixed insufficient access control in drivers/net/wireless/marvell/mwifiex/usb.c that     allowed an attacker who connect a crafted USB device to cause denial of service (bnc#1192847).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2021-45485: Fixed information leak in the IPv6 implementation in net/ipv6/output_core.c     (bnc#1194094).
    - CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table     (bnc#1194087).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5343-1 advisory.

    Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly     restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain     administrative privileges. (CVE-2022-0492)

    It was discovered that the aufs file system in the Linux kernel did not properly restrict mount     namespaces, when mounted with the non-default allow_userns option set. A local attacker could use this to     gain administrative privileges. (CVE-2016-2853)

    It was discovered that the aufs file system in the Linux kernel did not properly maintain POSIX ACL xattr     data, when mounted with the non-default allow_userns option. A local attacker could possibly use this to     gain elevated privileges. (CVE-2016-2854)

    It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some     situations. An attacker could use this to construct a malicious f2fs image that, when mounted and operated     on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-19449)

    It was discovered that the XFS file system implementation in the Linux kernel did not properly validate     meta data in some circumstances. An attacker could use this to construct a malicious XFS image that, when     mounted, could cause a denial of service. (CVE-2020-12655)

    Kiyin () discovered that the NFC LLCP protocol implementation in the Linux kernel contained a     reference counting error. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2020-25670)

    Kiyin () discovered that the NFC LLCP protocol implementation in the Linux kernel did not properly     deallocate memory in certain error situations. A local attacker could use this to cause a denial of     service (memory exhaustion). (CVE-2020-25671, CVE-2020-25672)

    Kiyin () discovered that the NFC LLCP protocol implementation in the Linux kernel did not properly     handle error conditions in some situations, leading to an infinite loop. A local attacker could use this     to cause a denial of service. (CVE-2020-25673)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled EAPOL frames     from unauthenticated senders. A physically proximate attacker could inject malicious packets to cause a     denial of service (system crash). (CVE-2020-26139)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation could reassemble mixed encrypted     and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets     or exfiltrate selected fragments. (CVE-2020-26147)

    It was discovered that the BR/EDR pin-code pairing procedure in the Linux kernel was vulnerable to an     impersonation attack. A physically proximate attacker could possibly use this to pair to a device without     knowledge of the pin-code. (CVE-2020-26555)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access     control. An authenticated attacker could possibly use this to expose sensitive information.
    (CVE-2020-26558, CVE-2021-0129)

    It was discovered that the FUSE user space file system implementation in the Linux kernel did not properly     handle bad inodes in some situations. A local attacker could possibly use this to cause a denial of     service. (CVE-2020-36322)

    It was discovered that the Infiniband RDMA userspace connection manager implementation in the Linux kernel     contained a race condition leading to a use-after-free vulnerability. A local attacker could use this to     cause a denial of service (system crash) or possible execute arbitrary code. (CVE-2020-36385)

    It was discovered that the DRM subsystem in the Linux kernel contained double-free vulnerabilities. A     privileged attacker could possibly use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2021-20292)

    It was discovered that a race condition existed in the timer implementation in the Linux kernel. A     privileged attacker could use this to cause a denial of service. (CVE-2021-20317)

    Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the nfc implementation in the Linux     kernel. A privileged local attacker could use this issue to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-23134)

    It was discovered that the Xen paravirtualization backend in the Linux kernel did not properly deallocate     memory in some situations. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2021-28688)

    It was discovered that the RPA PCI Hotplug driver implementation in the Linux kernel did not properly     handle device name writes via sysfs, leading to a buffer overflow. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-28972)

    It was discovered that a race condition existed in the netfilter subsystem of the Linux kernel when     replacing tables. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2021-29650)

    It was discovered that a race condition in the kernel Bluetooth subsystem could lead to use-after-free of     slab objects. An attacker could use this issue to possibly execute arbitrary code. (CVE-2021-32399)

    It was discovered that the CIPSO implementation in the Linux kernel did not properly perform reference     counting in some situations, leading to use- after-free vulnerabilities. An attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33033)

    It was discovered that a use-after-free existed in the Bluetooth HCI driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-33034)

    Asaf Modelevsky discovered that the Intel(R) Ethernet ixgbe driver for the Linux kernel did not properly     validate large MTU requests from Virtual Function (VF) devices. A local attacker could possibly use this     to cause a denial of service. (CVE-2021-33098)

    Norbert Slusarek discovered that the CAN broadcast manger (bcm) protocol implementation in the Linux     kernel did not properly initialize memory in some situations. A local attacker could use this to expose     sensitive information (kernel memory). (CVE-2021-34693)

     discovered that the IEEE 1394 (Firewire) nosy packet sniffer driver in the Linux kernel did not     properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-3483)

    It was discovered that an out-of-bounds (OOB) memory access flaw existed in the f2fs module of the Linux     kernel. A local attacker could use this issue to cause a denial of service (system crash). (CVE-2021-3506)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-3564)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2021-3573)

    Murray McAllister discovered that the joystick device interface in the Linux kernel did not properly     validate data passed via an ioctl(). A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code on systems with a joystick device registered. (CVE-2021-3612)

    It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu     ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

    It was discovered that the Virtio console implementation in the Linux kernel did not properly validate     input lengths in some situations. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2021-38160)

    It was discovered that the KVM hypervisor implementation in the Linux kernel did not properly compute the     access permissions for shadow pages in some situations. A local attacker could use this to cause a denial     of service. (CVE-2021-38198)

    It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle     device removal events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2021-38204)

    It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect     events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of     service. (CVE-2021-38208)

    It was discovered that the configfs interface for USB gadgets in the Linux kernel contained a race     condition. A local attacker could possibly use this to expose sensitive information (kernel memory).
    (CVE-2021-39648)

    It was discovered that the ext4 file system in the Linux kernel contained a race condition when writing     xattrs to an inode. A local attacker could use this to cause a denial of service or possibly gain     administrative privileges. (CVE-2021-40490)

    It was discovered that the 6pack network protocol driver in the Linux kernel did not properly perform     validation checks. A privileged attacker could use this to cause a denial of service (system crash) or     execute arbitrary code. (CVE-2021-42008)

    It was discovered that the ISDN CAPI implementation in the Linux kernel contained a race condition in     certain situations that could trigger an array out-of-bounds bug. A privileged local attacker could     possibly use this to cause a denial of service or execute arbitrary code. (CVE-2021-43389)

    It was discovered that the Phone Network protocol (PhoNet) implementation in the Linux kernel did not     properly perform reference counting in some error conditions. A local attacker could possibly use this to     cause a denial of service (memory exhaustion). (CVE-2021-45095)

    Wenqing Liu discovered that the f2fs file system in the Linux kernel did not properly validate the last     xattr entry in an inode. An attacker could use this to construct a malicious f2fs image that, when mounted     and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-45469)

    Amit Klein discovered that the IPv6 implementation in the Linux kernel could disclose internal state in     some situations. An attacker could possibly use this to expose sensitive information. (CVE-2021-45485)

    It was discovered that the per cpu memory allocator in the Linux kernel could report kernel pointers via     dmesg. An attacker could use this to expose sensitive information or in conjunction with another kernel     vulnerability. (CVE-2018-5995)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0365-1 advisory.

    The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195254).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
    - CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have     been exploited by a local user through crafted syscalls to escalate privileges or deny service     (bnc#1195184).
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0544-1 advisory.

  - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through     crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected     versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

  - In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-194696049References: Upstream kernel (CVE-2021-39657)

  - pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
    (CVE-2021-45095)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0477-1 advisory.

  - The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c.
    (CVE-2018-25020)

  - Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may     allow an unauthenticated user to potentially enable denial of service via adjacent access. (CVE-2019-0136)

  - An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel     version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to     gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information.
    The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-35519)

  - In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could     lead to local escalation of privilege with System execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168607263References:
    Upstream kernel (CVE-2021-0935)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]     Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing. (CVE-2021-28714) (CVE-2021-28715)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

  - In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-194696049References: Upstream kernel (CVE-2021-39657)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an     improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of     service (DOS) due to a deadlock problem. (CVE-2021-4149)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in     the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem     while the device is getting removed, leading to a privilege escalation problem. (CVE-2021-4202)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
    (CVE-2021-45095)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0366-1 advisory.

  - The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c.
    (CVE-2018-25020)

  - An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can     cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi     encryption with a consequent possibility of information disclosure over the air for a discrete set of     traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
    (CVE-2019-15126)

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could     lead to local escalation of privilege with System execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168607263References:
    Upstream kernel (CVE-2021-0935)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]     Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing. (CVE-2021-28714) (CVE-2021-28714, CVE-2021-28715)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

  - In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-194696049References: Upstream kernel (CVE-2021-39657)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device     driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A     local user could use this flaw to get unauthorized access to some data. (CVE-2021-4135)

  - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an     improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of     service (DOS) due to a deadlock problem. (CVE-2021-4149)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in     the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem     while the device is getting removed, leading to a privilege escalation problem. (CVE-2021-4202)

  - In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a     crafted device) to trigger an out-of-bounds write via a crafted length value. (CVE-2021-43975)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
    (CVE-2021-45095)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network     protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more     buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). (CVE-2022-0322)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
160430	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-019)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2026/2/26	high
157900	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0362-1)	Nessus	SuSE Local Security Checks	2022/2/11	2026/6/26	high
159160	Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-5343-1)	Nessus	Ubuntu Local Security Checks	2022/3/22	2026/6/3	high
243660	Linux Distros Unpatched Vulnerability : CVE-2021-39648	Nessus	Misc.	2025/8/5	2026/7/17	medium
157897	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0365-1)	Nessus	SuSE Local Security Checks	2022/2/11	2026/6/26	high
158238	SUSE SLES15 Security Update : the Linux RT Kernel (SUSE-SU-2022:0544-1)	Nessus	SuSE Local Security Checks	2022/2/22	2023/12/13	high
158152	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:0477-1)	Nessus	SuSE Local Security Checks	2022/2/18	2023/7/13	high
157894	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:0366-1)	Nessus	SuSE Local Security Checks	2022/2/11	2023/7/13	high

検出

プラグインの検索

high

high

high

medium

high

high

high

high