The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5173 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2021-4197 Eric Biederman reported that incorrect permission     checks in the cgroup process migration implementation can allow a local attacker to escalate privileges.
    CVE-2022-0494 The scsi_ioctl() was susceptible to an information leak only exploitable by users with     CAP_SYS_ADMIN or CAP_SYS_RAWIO capabilities. CVE-2022-0812 It was discovered that the RDMA transport for     NFS (xprtrdma) miscalculated the size of message headers, which could lead to a leak of sensitive     information between NFS servers and clients. CVE-2022-0854 Ali Haider discovered a potential information     leak in the DMA subsystem. On systems where the swiotlb feature is needed, this might allow a local user     to read sensitive information. CVE-2022-1011 Jann Horn discovered a flaw in the FUSE (Filesystem in User-     Space) implementation. A local user permitted to mount FUSE filesystems could exploit this to cause a use-     after-free and read sensitive information. CVE-2022-1012, CVE-2022-32296 Moshe Kol, Amit Klein, and Yossi     Gilad discovered a weakness in randomisation of TCP source port selection. CVE-2022-1016 David Bouman     discovered a flaw in the netfilter subsystem where the nft_do_chain function did not initialize register     data that nf_tables expressions can read from and write to. A local attacker can take advantage of this to     read sensitive information. CVE-2022-1048 Hu Jiahui discovered a race condition in the sound subsystem     that can result in a use-after-free. A local user permitted to access a PCM sound device can take     advantage of this flaw to crash the system or potentially for privilege escalation. CVE-2022-1184 A flaw     was discovered in the ext4 filesystem driver which can lead to a use-after-free. A local user permitted to     mount arbitrary filesystems could exploit this to cause a denial of service (crash or memory corruption)     or possibly for privilege escalation. CVE-2022-1195 Lin Ma discovered race conditions in the 6pack and     mkiss hamradio drivers, which could lead to a use-after-free. A local user could exploit these to cause a     denial of service (memory corruption or crash) or possibly for privilege escalation. CVE-2022-1198 Duoming     Zhou discovered a race condition in the 6pack hamradio driver, which could lead to a use-after-free. A     local user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2022-1199, CVE-2022-1204, CVE-2022-1205 Duoming Zhou discovered race conditions     in the AX.25 hamradio protocol, which could lead to a use-after-free or null pointer dereference. A local     user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2022-1353 The TCS Robot tool found an information leak in the PF_KEY subsystem.
    A local user can receive a netlink message when an IPsec daemon registers with the kernel, and this could     include sensitive information. CVE-2022-1419 Minh Yuan discovered a race condition in the vgem virtual GPU     driver that can lead to a use-after-free. A local user permitted to access the GPU device can exploit this     to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2022-1516 A NULL pointer dereference flaw in the implementation of the X.25 set of standardized     network protocols, which can result in denial of service. This driver is not enabled in Debian's official     kernel configurations. CVE-2022-1652 Minh Yuan discovered a race condition in the floppy driver that can     lead to a use-after-free. A local user permitted to access a floppy drive device can exploit this to cause     a denial of service (crash or memory corruption) or possibly for privilege escalation. CVE-2022-1729     Norbert Slusarek discovered a race condition in the perf subsystem which could result in local privilege     escalation to root. The default settings in Debian prevent exploitation unless more permissive settings     have been applied in the kernel.perf_event_paranoid sysctl. CVE-2022-1734 Duoming Zhou discovered race     conditions in the nfcmrvl NFC driver that could lead to a use-after-free, double-free or null pointer     dereference. A local user might be able to exploit these for denial of service (crash or memory     corruption) or possibly for privilege escalation. This driver is not enabled in Debian's official kernel     configurations. CVE-2022-1974, CVE-2022-1975 Duoming Zhou discovered that the NFC netlink interface was     suspectible to denial of service. CVE-2022-2153 kangel reported a flaw in the KVM implementation for x86     processors which could lead to a null pointer dereference. A local user permitted to access /dev/kvm could     exploit this to cause a denial of service (crash). CVE-2022-21123, CVE-2022-21125, CVE-2022-21166 Various     researchers discovered flaws in Intel x86 processors, collectively referred to as MMIO Stale Data     vulnerabilities. These are similar to the previously published Microarchitectural Data Sampling (MDS)     issues and could be exploited by local users to leak sensitive information. For some CPUs, the mitigations     for these issues require updated microcode. An updated intel-microcode package may be provided at a later     date. The updated CPU microcode may also be available as part of a system firmware (BIOS) update.
    Further information on the mitigation can be found at https://www.kernel.org/doc/html/latest/admin-     guide/hw-vuln/processor_mmio_stale_data.html or in the linux-doc-4.19 package. CVE-2022-23960 Researchers     at VUSec discovered that the Branch History Buffer in Arm processors can be exploited to create     information side channels with speculative execution. This issue is similar to Spectre variant 2, but     requires additional mitigations on some processors. This was previously mitigated for 32-bit Arm (armel     and armhf) architectures and is now also mitigated for 64-bit Arm (arm64). This can be exploited to obtain     sensitive information from a different security context, such as from user-space to the kernel, or from a     KVM guest to the kernel. CVE-2022-26490 Buffer overflows in the STMicroelectronics ST21NFCA core driver     can result in denial of service or privilege escalation. This driver is not enabled in Debian's official     kernel configurations. CVE-2022-27666 valis reported a possible buffer overflow in the IPsec ESP     transformation code. A local user can take advantage of this flaw to cause a denial of service or for     privilege escalation. CVE-2022-28356 Beraphin discovered that the ANSI/IEEE 802.2 LLC type 2 driver did     not properly perform reference counting on some error paths. A local attacker can take advantage of this     flaw to cause a denial of service. CVE-2022-28388 A double free vulnerability was discovered in the 8     devices USB2CAN interface driver. CVE-2022-28389 A double free vulnerability was discovered in the     Microchip CAN BUS Analyzer interface driver. CVE-2022-28390 A double free vulnerability was discovered in     the EMS CPC-USB/ARM7 CAN/USB interface driver. CVE-2022-29581 Kyle Zeng discovered a reference-counting     bug in the cls_u32 network classifier which can lead to a use-after-free. A local user can exploit this to     cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2022-30594 Jann Horn discovered a flaw in the interaction between ptrace and seccomp subsystems. A     process sandboxed using seccomp() but still permitted to use ptrace() could exploit this to remove the     seccomp restrictions. CVE-2022-32250 Aaron Adams discovered a use-after-free in Netfilter which may result     in local privilege escalation to root. CVE-2022-33981 Yuan Ming from Tsinghua University reported a race     condition in the floppy driver involving use of the FDRAWCMD ioctl, which could lead to a use-after-free.
    A local user with access to a floppy drive device could exploit this to cause a denial of service (crash     or memory corruption) or possibly for privilege escalation. This ioctl is now disabled by default. For the     oldstable distribution (buster), these problems have been fixed in version 4.19.249-2. Due to an issue in     the signing service (Cf. Debian bug #1012741), the vport-vxlan module cannot be loaded for the signed     kernel for amd64 in this update. This update also corrects a regression in the network scheduler subsystem     (bug #1013299). For the 32-bit Arm (armel and armhf) architectures, this update enables optimised     implementations of several cryptographic and CRC algorithms. For at least AES, this should remove a timing     sidechannel that could lead to a leak of sensitive information. This update includes many more bug fixes     from stable updates 4.19.236-4.19.249 inclusive, including for bug #1006346. The random driver has been     backported from Linux 5.19, fixing numerous performance and correctness issues. Some changes will be     visible: The entropy pool size is now 256 bits instead of 4096. You may need to adjust the configuration     of system monitoring or user-space entropy gathering services to allow for this. On systems without a     hardware RNG, the kernel may log more uses of /dev/urandom before it is fully initialised. These uses were     previously under-counted and this is not a regression. We recommend that you upgrade your linux packages.
    For the detailed security status of linux please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2023:1683229770 advisory.

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.112-108.499. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-036 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (CVE-2021-47634)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert Revert block, bfq: honor already-setup queue merges (CVE-2021-47646)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: soc-compress: prevent the potentially use of null pointer (CVE-2021-47650)

    A denial of service (DOS) issue was found in the Linux kernel's smb2_ioctl_query_info function in     the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user     function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
    (CVE-2022-0168)

    When the KVM updates the guest's page table entry, it will first use get_user_pages_fast() to pin the     page, and when it fails (e.g. the vma->flags has VM_IO or VM_PFNMAP), it will get corresponding VMA where     the page lies in through find_vma_intersection(), calculate the physical address, and map the page to the     kernel virtual address through memremap(), and finally, write the update.The problem is that when we get     the vma through find_vma_intersection(), only VM_PFNMAP is checked, not both VM_IO and VM_PFNMAP. In the     reproducer below, after the KVM_SET_USER_MEMORY_REGION is completed, we replace the guest's memory mapping     with the kernel-user shared region of io_uring and then perform the KVM_TRANSLATE operation, which finally     triggers the page table entry update. Now, memremap() will return page_offset_base (direct mapping of all     physical memory) + vaddr (the linear address of KVM_TRANSLATE) + vm_pgoff (the offset when io_uring     performs mmap(2)), and use the return value as the base address for CMPXCHG (write 0x21 in this case).
    Since both vaddr and vm_pgoff are controllable by the user-mode process, writing may exceed the previously     mapped guest memory space and trigger exceptions such as UAF. The vulnerability shares similarities with     CVE-2021-22543. (CVE-2022-1158)

    A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

    A use-after-free flaw was found in the Linux kernel's io_uring interface subsystem in the way a user     triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or     escalate their privileges on the system. (CVE-2022-29582)

    A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

    In the Linux kernel, the following vulnerability has been resolved:

    swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-48853)

    In the Linux kernel, the following vulnerability has been resolved:

    dm integrity: fix memory corruption when tag_size is less than digest size (CVE-2022-49044)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix panic when forwarding a pkt with no in6 dev (CVE-2022-49048)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: fix unexpected zeroed page mapping with zram swap (CVE-2022-49052)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcmu: Fix possible page UAF (CVE-2022-49053)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: potential buffer overflow in handling symlinks (CVE-2022-49058)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix the svc_deferred_event trace class (CVE-2022-49065)

    In the Linux kernel, the following vulnerability has been resolved:

    veth: Ensure eth header is in skb's linear part (CVE-2022-49066)

    In the Linux kernel, the following vulnerability has been resolved:

    gpio: Restrict usage of GPIO chip irq members before initialization (CVE-2022-49072)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: sata_dwc_460ex: Fix crash due to OOB write (CVE-2022-49073)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Fix GICR_CTLR.RWP polling (CVE-2022-49074)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix qgroup reserve overflow the qgroup limit (CVE-2022-49075)

    In the Linux kernel, the following vulnerability has been resolved:

    mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) (CVE-2022-49077)

    In the Linux kernel, the following vulnerability has been resolved:

    lz4: fix LZ4_decompress_safe_partial read out of bound (CVE-2022-49078)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/mempolicy: fix mpol_new leak in shared_policy_replace (CVE-2022-49080)

    In the Linux kernel, the following vulnerability has been resolved:

    qede: confirm skb is allocated before using (CVE-2022-49084)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: Fix five use after free bugs in get_initial_state (CVE-2022-49085)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix leak of nested actions (CVE-2022-49086)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix a race in rxrpc_exit_net() (CVE-2022-49087)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix route with nexthop object delete warning (CVE-2022-49092)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix slab-out-of-bounds bug in decrypt_internal (CVE-2022-49094)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Avoid writeback threads getting stuck in mempool_alloc() (CVE-2022-49097)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Fix potential crash on module unload (CVE-2022-49098)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_console: eliminate anonymous module_init & module_exit (CVE-2022-49100)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() (CVE-2022-49103)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (CVE-2022-49107)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix use after free in fc_exch_abts_resp() (CVE-2022-49114)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: prevent potential spectre v1 gadget (CVE-2022-49122)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix memory leak of uid in files registration (CVE-2022-49144)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (CVE-2022-49145)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: Free the page array when watch_queue is dismantled (CVE-2022-49148)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix call timer start racing with call destruction (CVE-2022-49149)

    In the Linux kernel, the following vulnerability has been resolved:

    wireguard: socket: free skb in send6 when ipv6 is disabled (CVE-2022-49153)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: fix panic on out-of-bounds guest IRQ (CVE-2022-49154)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (CVE-2022-49155)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix scheduling while atomic (CVE-2022-49156)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't BUG if someone dirty pages without asking ext4 first (CVE-2022-49171)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit (CVE-2022-49174)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: core: keep irq flags in device_pm_check_callbacks() (CVE-2022-49175)

    In the Linux kernel, the following vulnerability has been resolved:

    bfq: fix use-after-free in bfq_dispatch_request (CVE-2022-49176)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: don't move oom_bfqq (CVE-2022-49179)

    In the Linux kernel, the following vulnerability has been resolved:

    LSM: general protection fault in legacy_parse_param (CVE-2022-49180)

    In the Linux kernel, the following vulnerability has been resolved:

    af_netlink: Fix shift out of bounds in group mask calculation (CVE-2022-49197)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix more uncharged while msg has more_data (CVE-2022-49204)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix double uncharge the mem of sk_msg (CVE-2022-49205)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix memory leak in error flow for subscribe event routine (CVE-2022-49206)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (CVE-2022-49209)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: pgalloc: fix memory leak caused by pgd_free() (CVE-2022-49210)

    In the Linux kernel, the following vulnerability has been resolved:

    dax: make sure inodes are flushed before destroy cache (CVE-2022-49220)

    In the Linux kernel, the following vulnerability has been resolved:

    power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init (CVE-2022-49224)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: Actually free the watch (CVE-2022-49256)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: Fix NULL dereference in error cleanup (CVE-2022-49257)

    In the Linux kernel, the following vulnerability has been resolved:

    block: don't delete queue kobject before its children (CVE-2022-49259)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gem: add missing boundary check in vm_access (CVE-2022-49261)

    In the Linux kernel, the following vulnerability has been resolved:

    exec: Force single empty string when argv is empty (CVE-2022-49264)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: prevent bad output lengths in smb2_ioctl_query_info() (CVE-2022-49271)

    In the Linux kernel, the following vulnerability has been resolved:

    ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock (CVE-2022-49272)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: prevent integer overflow on 32 bit systems (CVE-2022-49279)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: prevent underflow in nfssvc_decode_writeargs() (CVE-2022-49280)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: fix reference counting for struct tpm_chip (CVE-2022-49287)

    A use-after-free flaw was found in the Linux kernel's core dump subsystem. This flaw could allow a local     user to crash the system. (CVE-2023-1249)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

    Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics     drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2023-28410)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 5.15.38 / 5.15.38_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-129-01 advisory.

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local     user to crash or escalate their privileges on the system. (CVE-2022-0500)

  - Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making     it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit     2d3916f3189172d5c69d33065c3c21119fe539fc. (CVE-2022-0742)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - An out-of-bounds (OOB) memory write flaw was found in the Linux kernel's watch_queue event notification     subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain     privileged access or cause a denial of service on the system. (CVE-2022-0995)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of     the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
    (CVE-2022-24958)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
162703	Debian DSA-5173-1 : linux - security update	Nessus	Debian Local Security Checks	2022/7/4	2025/1/24	high
173106	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2026/6/3	high
366948	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2023:1683229770)	Nessus	CentOS Local Security Checks	2026/10/18	2026/10/19	high
180564	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-036)	Nessus	Amazon Linux Local Security Checks	2023/9/6	2026/2/26	high
160874	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2022-129-01)	Nessus	Slackware Local Security Checks	2022/5/10	2026/10/9	high

検出

プラグインの検索

high

high

high

high

high