The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3433-1 advisory.

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel (CVE-2021-39686)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients. (CVE-2022-1678)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-33981. Reason: This candidate is a     reservation duplicate of CVE-2022-33981. Notes: All CVE users should reference CVE-2022-33981 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2022-1836)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7444 advisory.

  - kernel: off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

  - kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer     dereference (CVE-2020-36558)

  - kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

  - kernel: memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c     (CVE-2021-30002)

  - kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

  - kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

  - kernel: swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

  - kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM     (CVE-2022-1016)

  - kernel: race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

  - kernel: use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

  - kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region (CVE-2022-1158)

  - kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

  - kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c (CVE-2022-1263)

  - kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

  - kernel: buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

  - kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (CVE-2022-2153)

  - kernel: LoadPin bypass via dm-verity table reload (CVE-2022-2503)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

  - kernel: use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

  - kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats() (CVE-2022-3107)

  - kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

  - kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c     (CVE-2022-20572)

  - kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

  - kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

  - hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

  - kernel: memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

  - kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

  - kernel: use after free in SUNRPC subsystem (CVE-2022-28893)

  - kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

  - kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7683 advisory.

  - kernel: off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

  - kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer     dereference (CVE-2020-36558)

  - kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

  - kernel: memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c     (CVE-2021-30002)

  - kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

  - kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

  - kernel: swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

  - kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM     (CVE-2022-1016)

  - kernel: race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

  - kernel: use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

  - kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region (CVE-2022-1158)

  - kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

  - kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c (CVE-2022-1263)

  - kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

  - kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

  - kernel: buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

  - kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (CVE-2022-2153)

  - kernel: LoadPin bypass via dm-verity table reload (CVE-2022-2503)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

  - kernel: use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

  - kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats() (CVE-2022-3107)

  - kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

  - kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c     (CVE-2022-20572)

  - kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

  - hw: cpu: arm64: Spectre-BHB (CVE-2022-23960)

  - kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

  - hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

  - kernel: memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

  - kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

  - kernel: use after free in SUNRPC subsystem (CVE-2022-28893)

  - kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

  - kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5442-1 advisory.

  - Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause     memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to     5.4.189; version 5.4.24 and later versions. (CVE-2022-1116)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5444-1 advisory.

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23037)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel (CVE-2021-39686)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients. (CVE-2022-1678)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-33981. Reason: This candidate is a     reservation duplicate of CVE-2022-33981. Notes: All CVE users should reference CVE-2022-33981 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2022-1836)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2875-1 advisory.

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of     ttys could lead to a use-after-free. (CVE-2020-36557)

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause     memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to     5.4.189; version 5.4.24 and later versions. (CVE-2022-1116)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505) (CVE-2022-21505)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - Due to the small table perturb size, a memory leak flaw was found in the Linux kernel's TCP source port     generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and     may cause a denial of service. (CVE-2022-1012)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel.This flaw     allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of     internal kernel information. (CVE-2022-1353)

  - Kernel-headers includes the C header files that specify the interfacebetween the Linux kernel and     userspace libraries and programs.  Theheader files define structures and constants that are needed     forbuilding most standard programs and are also needed for rebuilding theglibc package. (CVE-2022-1729)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation. (CVE-2022-20132)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23037)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7683 advisory.

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in     drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
    (CVE-2021-30002)

  - A denial of service (DOS) issue was found in the Linux kernel's smb2_ioctl_query_info function in the     fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user     function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
    (CVE-2022-0168)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

  - A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is     disabled by default, it could allow an attacker to crash the system or have other memory-corruption side     effects. (CVE-2022-2938)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the     O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a     regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file     descriptor. (CVE-2022-24448)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse     error condition. (CVE-2022-27950)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets     are in the intended state. (CVE-2022-28893)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3450-1 advisory.

  - The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to     simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI     error injection through EINJ when securelevel is set. (CVE-2016-3695)

  - A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free(). (CVE-2020-27784)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8267 advisory.

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets     are in the intended state. (CVE-2022-28893)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A denial of service (DOS) issue was found in the Linux kernel's smb2_ioctl_query_info function in the     fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user     function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
    (CVE-2022-0168)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A use after free in the Linux kernel File System notify functionality was found in the way user triggers     copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to     crash the system or potentially escalate their privileges on the system. (CVE-2022-1998)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the     O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a     regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file     descriptor. (CVE-2022-24448)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
165575	SUSE SLES15 Security Update : kernel (Live Patch 11 for SLE 15 SP3) (SUSE-SU-2022:3433-1)	Nessus	SuSE Local Security Checks	2022/9/29	2023/7/14	high
164244	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2257)	Nessus	Huawei Local Security Checks	2022/8/17	2024/1/16	high
167095	RHEL 8 : kernel-rt (RHSA-2022:7444)	Nessus	Red Hat Local Security Checks	2022/11/8	2024/6/26	high
167155	RHEL 8 : kernel (RHSA-2022:7683)	Nessus	Red Hat Local Security Checks	2022/11/9	2024/6/26	high
161810	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5442-1)	Nessus	Ubuntu Local Security Checks	2022/6/3	2024/1/9	high
161874	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerability (USN-5444-1)	Nessus	Ubuntu Local Security Checks	2022/6/6	2024/1/9	high
162908	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2022-1999)	Nessus	Huawei Local Security Checks	2022/7/8	2023/1/6	high
164207	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2244)	Nessus	Huawei Local Security Checks	2022/8/17	2024/1/16	high
164373	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:2875-1)	Nessus	SuSE Local Security Checks	2022/8/24	2023/7/14	high
165388	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2022-2384)	Nessus	Huawei Local Security Checks	2022/9/23	2023/1/13	high
178888	EulerOS Virtualization 3.0.6.6 : kernel (EulerOS-SA-2023-2444)	Nessus	Huawei Local Security Checks	2023/7/26	2024/1/16	critical
173106	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/6/27	high
167447	AlmaLinux 8 : kernel (ALSA-2022:7683)	Nessus	Alma Linux Local Security Checks	2022/11/14	2024/6/26	high
165564	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3450-1)	Nessus	SuSE Local Security Checks	2022/9/29	2023/7/14	high
168085	Oracle Linux 9 : kernel (ELSA-2022-8267)	Nessus	Oracle Linux Local Security Checks	2022/11/22	2024/6/26	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high