The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2393-1 advisory.

  - In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and     unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c. (CVE-2019-19377)

  - The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database     (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.
    (CVE-2020-26541)

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition     between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN     privilege to leak kernel information. (CVE-2022-1974)

  - There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by     simulating a nfc device from user-space. (CVE-2022-1975)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2629-1 advisory.

  - In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and     unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c. (CVE-2019-19377)

  - The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database     (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.
    (CVE-2020-26541)

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to Incorrect Size     Value. This could lead to local information disclosure with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-154175781References: Upstream kernel (CVE-2021-39711)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition     between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN     privilege to leak kernel information. (CVE-2022-1974)

  - There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by     simulating a nfc device from user-space. (CVE-2022-1975)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21127)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially     cause a denial of service via local access. (CVE-2022-21180)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2615-1 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input     Validation. This flaw allows a local attacker with a special privilege to crash the system or leak     internal information. (CVE-2021-4204)

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not     properly update bounds while handling the mov32 instruction, which allows local users to obtain     potentially sensitive address information, aka a pointer leak. (CVE-2021-45402)

  - A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace. A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6 (CVE-2022-0264)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an     attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
    (CVE-2022-1198)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

  - An out-of-bounds read flaw was found in the Linux kernel's io_uring module in the way a user triggers the     io_read() function with some special parameters. This flaw allows a local user to read some memory out of     bounds. (CVE-2022-1508)

  - A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function     in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to     leak unauthorized kernel information, causing a denial of service. (CVE-2022-1651)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux     kernel. This flaw allows a local attacker to crash the system or leak internal kernel information.
    (CVE-2022-1671)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

  - A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition     between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN     privilege to leak kernel information. (CVE-2022-1974)

  - A use after free in the Linux kernel File System notify functionality was found in the way user triggers     copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to     crash the system or potentially escalate their privileges on the system. (CVE-2022-1998)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21127)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially     cause a denial of service via local access. (CVE-2022-21180)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of     the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3131 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3131-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     October 01, 2022                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 4.19.260-1     CVE ID         : CVE-2021-4159 CVE-2021-33655 CVE-2021-33656 CVE-2022-1462                      CVE-2022-1679 CVE-2022-2153 CVE-2022-2318 CVE-2022-2586                      CVE-2022-2588 CVE-2022-2663 CVE-2022-3028 CVE-2022-26365                      CVE-2022-26373 CVE-2022-33740 CVE-2022-33741 CVE-2022-33742                      CVE-2022-33744 CVE-2022-36879 CVE-2022-36946 CVE-2022-39188                      CVE-2022-39842 CVE-2022-40307     Debian Bug     : 1018752

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to privilege escalation, denial of service or information     leaks.

    CVE-2021-4159

        A flaw was found in the eBPF verifier which could lead to an         out-of-bounds read.  If unprivileged use of eBPF is enabled, this         could leak sensitive information.  This was already disabled by         default, which would fully mitigate the vulnerability.

    CVE-2021-33655

        A user with access to a framebuffer console device could cause a         memory out-of-bounds write via the FBIOPUT_VSCREENINFO ioctl.

    CVE-2021-33656

        A user with access to a framebuffer console device could cause a         memory out-of-bounds write via some font setting ioctls.  These         obsolete ioctls have been removed.

    CVE-2022-1462

         reported a race condition in the pty (pseudo-terminal)         subsystem that can lead to a slab out-of-bounds write.  A local         user could exploit this to cause a denial of service (crash or         memory corruption) or possibly for privilege escalation.

    CVE-2022-1679

        The syzbot tool found a race condition in the ath9k_htc driver         which can lead to a use-after-free.  This might be exploitable to         cause a denial service (crash or memory corruption) or possibly         for privilege escalation.

    CVE-2022-2153

        kangel reported a flaw in the KVM implementation for x86         processors which could lead to a null pointer dereference. A local         user permitted to access /dev/kvm could exploit this to cause a         denial of service (crash).

    CVE-2022-2318

        A use-after-free in the Amateur Radio X.25 PLP (Rose) support may         result in denial of service.

    CVE-2022-2586

        A use-after-free in the Netfilter subsystem may result in local         privilege escalation for a user with the CAP_NET_ADMIN capability         in any user or network namespace.

    CVE-2022-2588

        Zhenpeng Lin discovered a use-after-free flaw in the cls_route         filter implementation which may result in local privilege         escalation for a user with the CAP_NET_ADMIN capability in any         user or network namespace.

    CVE-2022-2663

        David Leadbeater reported flaws in the nf_conntrack_irc         connection-tracking protocol module.  When this module is enabled         on a firewall, an external user on the same IRC network as an         internal user could exploit its lax parsing to open arbitrary TCP         ports in the firewall, to reveal their public IP address, or to         block their IRC connection at the firewall.

    CVE-2022-3028

        Abhishek Shah reported a race condition in the AF_KEY subsystem,         which could lead to an out-of-bounds write or read.  A local user         could exploit this to cause a denial of service (crash or memory         corruption), to obtain sensitive information, or possibly for         privilege escalation.

    CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742

        Roger Pau Monne discovered that Xen block and network PV device         frontends don't zero out memory regions before sharing them with         the backend, which may result in information disclosure.
        Additionally it was discovered that the granularity of the grant         table doesn't permit sharing less than a 4k page, which may also         result in information disclosure.

    CVE-2022-26373

        It was discovered that on certain processors with Intel's Enhanced         Indirect Branch Restricted Speculation (eIBRS) capabilities there         are exceptions to the documented properties in some situations,         which may result in information disclosure.

        Intel's explanation of the issue can be found at         https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-     guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html

    CVE-2022-33744

        Oleksandr Tyshchenko discovered that ARM Xen guests can cause a         denial of service to the Dom0 via paravirtual devices.

    CVE-2022-36879

        A flaw was discovered in xfrm_expand_policies in the xfrm         subsystem which can cause a reference count to be dropped twice.

    CVE-2022-36946

        Domingo Dirutigliano and Nicola Guerrera reported a memory         corruption flaw in the Netfilter subsystem which may result in         denial of service.

    CVE-2022-39188

        Jann Horn reported a race condition in the kernel's handling of         unmapping of certain memory ranges.  When a driver created a         memory mapping with the VM_PFNMAP flag, which many GPU drivers do,         the memory mapping could be removed and freed before it was         flushed from the CPU TLBs.  This could result in a page use-after-         free.  A local user with access to such a device could exploit         this to cause a denial of service (crash or memory corruption) or         possibly for privilege escalation.

    CVE-2022-39842

        An integer overflow was discovered in the pxa3xx-gcu video driver         which could lead to a heap out-of-bounds write.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-40307

        A race condition was discovered in the EFI capsule-loader driver,         which could lead to use-after-free.  A local user permitted to         access this device (/dev/efi_capsule_loader) could exploit this to         cause a denial of service (crash or memory corruption) or possibly         for privilege escalation.  However, this device is normally only         accessible by the root user.

    For Debian 10 buster, these problems have been fixed in version     4.19.260-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by     simulating a nfc device from user-space. (CVE-2022-1975)

  - In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing     bounds check. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-213172319References: Upstream kernel (CVE-2022-20009)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 ('Double-Hash Port Selection Algorithm') of RFC 6056.
    (CVE-2022-32296)

  - An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

  - Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree     to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the     related lock held, resulting in a small race window, which can be used by unprivileged guests via PV     devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS)     of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory     pages. (CVE-2022-33744)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6014-1 advisory.

    Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux     kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of     service (connection termination) or inject forged data. (CVE-2020-36516)

    Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira     Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient     in some situations. A local attacker could possibly use this to expose sensitive information.
    (CVE-2021-26401)

    Jrgen Gro discovered that the Xen subsystem within the Linux kernel did not adequately limit the     number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a     driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28711,     CVE-2021-28712, CVE-2021-28713)

    Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an     integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious     ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

    It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly     handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

    It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large     shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2021-3669)

    Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private     clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

    It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs     in some situations. A remote attacker could possibly use this to cause a denial of service (connection     disassociation). (CVE-2021-3772)

    It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle     locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel     deadlock). (CVE-2021-4149)

    Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when     handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly expose sensitive information.
    (CVE-2021-4203)

    It was discovered that the file system quotas implementation in the Linux kernel did not properly validate     the quota block number. An attacker could use this to construct a malicious file system image that, when     mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

    Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device     removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-0487)

    It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in     some situations. A privileged local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-0494)

    It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference     a null pointer in some situations. An attacker could use this to construct a malicious UDF image that,     when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

    David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some     situations. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2022-1016)

    It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not     handle detach events properly in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the tty subsystem in the Linux kernel contained a race condition in certain     situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to     cause a denial of service (system crash) or expose sensitive information. (CVE-2022-1462)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-     free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-1974)

    Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context     switches from occurring during certain atomic context operations. A privileged local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1975)

    It was discovered that the HID subsystem in the Linux kernel did not properly validate inputs in certain     conditions. A local attacker with physical access could plug in a specially crafted USB device to expose     sensitive information. (CVE-2022-20132)

    It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly     verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20572, CVE-2022-2503)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly     handle very small reads. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-2380)

    David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel     incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this     to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

    Lucas Leong discovered that the LightNVM subsystem in the Linux kernel did not properly handle data     lengths in certain situations. A privileged attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2022-2991)

    It was discovered that the Intel 740 frame buffer driver in the Linux kernel contained a divide by zero     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-3061)

    Jiasheng Jiang discovered that the wm8350 charger driver in the Linux kernel did not properly deallocate     memory, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash). (CVE-2022-3111)

    It was discovered that the sound subsystem in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3303)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. An attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2022-3646)

    It was discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a     reference counting error. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36879)

    It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A     local attacker with physical access could plug in a specially crafted USB device to cause a denial of     service (memory exhaustion). (CVE-2022-3903)

    Jann Horn discovered a race condition existed in the Linux kernel when unmapping VMAs in certain     situations, resulting in possible use-after-free vulnerabilities. A local attacker could possibly use this     to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-39188)

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference     counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    It was discovered that the USB core subsystem in the Linux kernel did not properly handle nested reset     events. A local attacker with physical access could plug in a specially crafted USB device to cause a     denial of service (kernel deadlock). (CVE-2022-4662)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly initialize a data     structure, leading to a null pointer dereference vulnerability. An attacker could use this to cause a     denial of service (system crash). (CVE-2023-1095)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
163241	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:2393-1)	Nessus	SuSE Local Security Checks	2022/7/15	2023/7/13	high
163752	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:2629-1)	Nessus	SuSE Local Security Checks	2022/8/3	2024/1/16	high
163692	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2615-1)	Nessus	SuSE Local Security Checks	2022/8/2	2024/1/16	high
165623	Debian dla-3131 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	2022/10/2	2025/1/22	high
165829	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2415)	Nessus	Huawei Local Security Checks	2022/10/8	2023/1/13	high
249011	Linux Distros Unpatched Vulnerability : CVE-2022-2318	Nessus	Misc.	2025/8/12	2025/9/2	medium
174228	Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-6014-1)	Nessus	Ubuntu Local Security Checks	2023/4/13	2024/8/27	high

検出

プラグインの検索

high

high

high

high

high

medium

high