The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3318-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service problem. (CVE-2023-2985)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - ** REJECT ** Duplicate of CVE-2023-3390. (CVE-2023-3117)

  - Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in     how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows     a local user to crash or potentially escalate their privileges on the system. (CVE-2023-3812)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6250-1 advisory.

    Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux     kernel did not properly perform permission checks in certain situations. A local attacker could possibly     use this to gain elevated privileges. (CVE-2023-2640)

    It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory     in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status     of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-31248)

    Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did     not properly perform permission checks in certain situations. A local attacker could possibly use this to     gain elevated privileges. (CVE-2023-32629)

    Ruihan Li discovered that the memory management subsystem in the Linux kernel contained a race condition     when accessing VMAs in certain conditions, leading to a use-after-free vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash) or execute arbitrary code.
    (CVE-2023-3269)

    Querijn Voet discovered that a race condition existed in the io_uring subsystem in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-3389)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3390)

    Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain     pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35001)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3710 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3710-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     January 10, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 4.19.304-1     CVE ID         : CVE-2021-44879 CVE-2023-0590 CVE-2023-1077 CVE-2023-1206                      CVE-2023-1989 CVE-2023-3212 CVE-2023-3390 CVE-2023-3609                      CVE-2023-3611 CVE-2023-3772 CVE-2023-3776 CVE-2023-4206                      CVE-2023-4207 CVE-2023-4208 CVE-2023-4244 CVE-2023-4622                      CVE-2023-4623 CVE-2023-4921 CVE-2023-5717 CVE-2023-6606                      CVE-2023-6931 CVE-2023-6932 CVE-2023-25775 CVE-2023-34319                      CVE-2023-34324 CVE-2023-35001 CVE-2023-39189 CVE-2023-39192                      CVE-2023-39193 CVE-2023-39194 CVE-2023-40283 CVE-2023-42753                      CVE-2023-42754 CVE-2023-42755 CVE-2023-45863 CVE-2023-45871                      CVE-2023-51780 CVE-2023-51781 CVE-2023-51782

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2021-44879

        Wenqing Liu reported a NULL pointer dereference in the f2fs         implementation. An attacker able to mount a specially crafted image         can take advantage of this flaw for denial of service.

    CVE-2023-0590

        Dmitry Vyukov discovered a race condition in the network scheduler         core that that can lead to a use-after-free.  A local user with         the CAP_NET_ADMIN capability in any user or network namespace         could exploit this to cause a denial of service (crash or memory         corruption) or possibly for privilege escalation.

    CVE-2023-1077

        Pietro Borrello reported a type confusion flaw in the task         scheduler.  A local user might be able to exploit this to cause a         denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2023-1206

        It was discovered that the networking stack permits attackers to         force hash collisions in the IPv6 connection lookup table, which         may result in denial of service (significant increase in the cost         of lookups, increased CPU utilization).

    CVE-2023-1989

        Zheng Wang reported a race condition in the btsdio Bluetooth         adapter driver that can lead to a use-after-free.  An attacker         able to insert and remove SDIO devices can use this to cause a         denial of service (crash or memory corruption) or possibly to run         arbitrary code in the kernel.

    CVE-2023-3212

        Yang Lan discovered that missing validation in the GFS2 filesystem         could result in denial of service via a NULL pointer dereference         when mounting a malformed GFS2 filesystem.

    CVE-2023-3390

        A use-after-free flaw in the netfilter subsystem caused by         incorrect error path handling may result in denial of service or         privilege escalation.

    CVE-2023-3609, CVE-2023-3776, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208

        It was discovered that a use-after-free in the cls_fw, cls_u32,         cls_route and network classifiers may result in denial of service         or potential local privilege escalation.

    CVE-2023-3611

        It was discovered that an out-of-bounds write in the traffic         control subsystem for the Quick Fair Queueing scheduler (QFQ) may         result in denial of service or privilege escalation.

    CVE-2023-3772

        Lin Ma discovered a NULL pointer dereference flaw in the XFRM         subsystem which may result in denial of service.

    CVE-2023-4244

        A race condition was found in the nftables subsystem that could         lead to a use-after-free.  A local user could exploit this to         cause a denial of service (crash), information leak, or possibly         for privilege escalation.

    CVE-2023-4622

        Bing-Jhong Billy Jheng discovered a use-after-free within the Unix         domain sockets component, which may result in local privilege         escalation.

    CVE-2023-4623

        Budimir Markovic reported a missing configuration check in the         sch_hfsc network scheduler that could lead to a use-after-free or         other problems.  A local user with the CAP_NET_ADMIN capability in         any user or network namespace could exploit this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-4921

        valis reported flaws in the sch_qfq network scheduler that could         lead to a use-after-free.  A local user with the CAP_NET_ADMIN         capability in any user or network namespace could exploit this to         cause a denial of service (crash or memory corruption) or possibly         for privilege escalation.

    CVE-2023-5717

        Budimir Markovic reported a heap out-of-bounds write vulnerability         in the Linux kernel's Performance Events system caused by improper         handling of event groups, which may result in denial of service or         privilege escalation. The default settings in Debian prevent         exploitation unless more permissive settings have been applied in         the kernel.perf_event_paranoid sysctl.

    CVE-2023-6606

        j51569436 reported a potential out-of-bounds read in the CIFS         filesystem implementation.  If a CIFS filesystem is mounted from a         malicious server, the server could possibly exploit this to cause         a denial of service (crash).

    CVE-2023-6931

        Budimir Markovic reported a heap out-of-bounds write vulnerability         in the Linux kernel's Performance Events system which may result in         denial of service or privilege escalation. The default settings in         Debian prevent exploitation unless more permissive settings have         been applied in the kernel.perf_event_paranoid sysctl.

    CVE-2023-6932

        A use-after-free vulnerability in the IPv4 IGMP implementation may         result in denial of service or privilege escalation.

    CVE-2023-25775

        Ivan D Barrera, Christopher Bednarz, Mustafa Ismail and Shiraz         Saleem discovered that improper access control in the Intel Ethernet         Controller RDMA driver may result in privilege escalation.

    CVE-2023-34319

        Ross Lagerwall discovered a buffer overrun in Xen's netback driver         which may allow a Xen guest to cause denial of service to the         virtualisation host by sending malformed packets.

    CVE-2023-34324

        Marek Marczykowski-Gorecki reported a possible deadlock in the Xen         guests event channel code which may allow a malicious guest         administrator to cause a denial of service.

    CVE-2023-35001

        Tanguy DUBROCA discovered an out-of-bounds reads and write flaw in         the Netfilter nf_tables implementation when processing an         nft_byteorder expression, which may result in local privilege         escalation for a user with the CAP_NET_ADMIN capability in any         user or network namespace.

    CVE-2023-39189, CVE-2023-39192, CVE-2023-39193

        Lucas Leong of Trend Micro Zero Day Initiative reported missing         bounds checks in the nfnetlink_osf, xt_u32, and xt_sctp netfilter         modules.  A local user with the CAP_NET_ADMIN capability in any         user or network namespace could exploit these to leak sensitive         information from the kernel or for denial of service (crash).

    CVE-2023-39194

        Lucas Leong of Trend Micro Zero Day Initiative reported a missing         bounds check in the xfrm (IPsec) subsystem.  A local user with the         CAP_NET_ADMIN capability in any user or network namespace could         exploit this to leak sensitive information from the kernel or for         denial of service (crash).

    CVE-2023-40283

        A use-after-free was discovered in Bluetooth L2CAP socket         handling.

    CVE-2023-42753

        Kyle Zeng discovered an off-by-one error in the netfilter ipset         subsystem which could lead to out-of-bounds memory access.  A         local user with the CAP_NET_ADMIN capability in any user or         network namespace could exploit this to cause a denial of service         (memory corruption or crash) and possibly for privilege         escalation.

    CVE-2023-42754

        Kyle Zeng discovered a flaw in the IPv4 implementation which could         lead to a null pointer deference.  A local user could exploit this         for denial of service (crash).

    CVE-2023-42755

        Kyle Zeng discovered missing configuration validation in the         cls_rsvp network classifier which could lead to out-of-bounds         reads.  A local user with the CAP_NET_ADMIN capability in any user         or network namespace could exploit this to cause a denial of         service (crash) or to leak sensitive information.

        This flaw has been mitigated by removing the cls_rsvp classifier.

    CVE-2023-45863

        A race condition in library routines for handling generic kernel         objects may result in an out-of-bounds write in the         fill_kobj_path() function.

    CVE-2023-45871

        Manfred Rudigier reported a flaw in the igb network driver for         Intel Gigabit Ethernet interfaces.  When the rx-all feature was         enabled on such a network interface, an attacker on the same         network segment could send packets that would overflow a receive         buffer, leading to a denial of service (crash or memory         corruption) or possibly remote code execution.

    CVE-2023-51780

        It was discovered that a race condition in the ATM (Asynchronous         Transfer Mode) subsystem may lead to a use-after-free.

    CVE-2023-51781

        It was discovered that a race condition in the Appletalk subsystem         may lead to a use-after-free.

    CVE-2023-51782

        It was discovered that a race condition in the Amateur Radio X.25         PLP (Rose) support may lead to a use-after-free. This module is not         auto-loaded on Debian systems, so this issue only affects systems         where it is explicitly loaded.

    For Debian 10 buster, these problems have been fixed in version     4.19.304-1.  This update additionally includes many more bug fixes     from stable updates 4.19.290-4.19.304 inclusive.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1268 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001,ZDI-CAN-20721)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982,Downfall)

    * kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip   (CVE-2022-41858)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    Bug Fix(es):

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (JIRA:RHEL-1203)

    * How to reduce or prevent thousands of kworker/events_freezable_power_efficient threads being created     every time multipath -ll is run (JIRA:RHEL-15054)

    * kernel: net/sched: sch_hfsc UAF (JIRA:RHEL-16461)

    * [SanityOnly][kernel]BUG: sleeping function called from invalid context at     kernel/locking/spinlock_rt.c:35 at: sock_map_update_elem_sys+0x85/0x2a0 (JIRA:RHEL-6126)

    * kernel: hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (JIRA:RHEL-9246)

    * ipoib mcast lockup fix (JIRA:RHEL-19695)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1269 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch     requests (CVE-2023-3390)

    * net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead     (CVE-2023-3611)

    * net/sched: sch_hfsc UAF (CVE-2023-4623)

    * use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

    * IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

    * nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (CVE-2023-38409)

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation. (CVE-2023-21255)

  - A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible. (CVE-2023-3006)

  - An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in     drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the     NULL Pointer Dereference. (CVE-2023-3220)

  - A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue     could allow a remote user to crash the system. (CVE-2023-3338)

  - A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue     could allow a local user to crash the system. (CVE-2023-3358)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a     way such that not all of the headers would come in one piece. Unfortunately the logic introduced there     didn't account for the extreme case of the entire packet being split into as many pieces as permitted by     the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible)     headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver.
    (CVE-2023-34319)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in     renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. (CVE-2023-35828)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition. (CVE-2023-4132)

  - A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 ('tun: tun_chr_open(): correctly initialize socket uid'), - 66b2c338adce ('tap: tap_open():
    correctly initialize socket uid'), pass 'inode->i_uid' to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

  - A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system     (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing     sanity check. (CVE-2023-4385)

  - A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem. (CVE-2023-4387)

  - A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
    (CVE-2023-4459)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation. (CVE-2023-21255)

  - A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue     could allow a remote user to crash the system. (CVE-2023-3338)

  - A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue     could allow a local user to crash the system. (CVE-2023-3358)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a     way such that not all of the headers would come in one piece. Unfortunately the logic introduced there     didn't account for the extreme case of the entire packet being split into as many pieces as permitted by     the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible)     headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver.
    (CVE-2023-34319)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition. (CVE-2023-4132)

  - A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 ('tun: tun_chr_open(): correctly initialize socket uid'), - 66b2c338adce ('tap: tap_open():
    correctly initialize socket uid'), pass 'inode->i_uid' to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

  - A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system     (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing     sanity check. (CVE-2023-4385)

  - A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem. (CVE-2023-4387)

  - A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
    (CVE-2023-4459)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5448 advisory.

  - An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

  - distros-[DirtyVMA] Privilege escalation via non-RCU-protected VMA traversal [fedora-all] (CVE-2023-3269)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
179882	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3318-1)	Nessus	SuSE Local Security Checks	2023/8/16	2025/3/31	high
203724	Photon OS 3.0: Linux PHSA-2023-3.0-0644	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/21	high
178797	Ubuntu 23.04 : Linux kernel vulnerabilities (USN-6250-1)	Nessus	Ubuntu Local Security Checks	2023/7/26	2024/9/19	critical
189094	Debian dla-3710 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	2024/1/16	2025/3/31	critical
191910	RHEL 8 : kernel (RHSA-2024:1268)	Nessus	Red Hat Local Security Checks	2024/3/12	2025/3/31	critical
191911	RHEL 8 : kernel-rt (RHSA-2024:1269)	Nessus	Red Hat Local Security Checks	2024/3/12	2025/3/31	critical
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	2021/7/22	2025/8/21	high
188715	EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2023-3085)	Nessus	Huawei Local Security Checks	2024/1/16	2025/3/31	high
188789	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-2898)	Nessus	Huawei Local Security Checks	2024/1/16	2025/3/31	high
178003	Debian DSA-5448-1 : linux - security update	Nessus	Debian Local Security Checks	2023/7/6	2024/3/27	high

検出

プラグインの検索

high

high

critical

critical

critical

critical

high

high

high

high