The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0056-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated.

    The following security bugs were fixed:

    - CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source     addresses. (bsc#1194094)
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c.
    (bnc#1194087).
    - CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
    - CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by do not queueing unlimited number of packages.  (bsc#1193442)
    - CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by fixing rx queue stall detection. (bsc#1193442)
    - CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening hvc_xen against event channel storms. (bsc#1193440)
    - CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening netfront against event channel storms. (bsc#1193440)
    - CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening blkfront against event channel storms. (bsc#1193440)
    - CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter     drivers that may have allowed an authenticated user to potentially enable denial of service via local     access. (bnc#1182404)
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)
    - CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bnc#1179599)
    - CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper     input validation. (bnc#1192877)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat     fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets,     independent of the network configuration. (CVE-2020-26142)

  - An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26143)

  - A flaw was found in the Linux kernel, where the WiFi implementations accept plaintext A-MSDU frames as     long as the first 8 bytes correspond to a valid RFC1042 (ex., LLC/SNAP) header for EAPOL. The highest     threat from this vulnerability is to integrity. (CVE-2020-26144)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - A vulnerability was found in Linux kernel, where the WiFi implementation reassemble fragments with non-     consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This     vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-     confidentiality protocol is used. Note that WEP is vulnerable to this attack by design. (CVE-2020-26146)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to     uninitialized data. This could lead to local information disclosure with no additional execution     privileges needed. User interaction is not needed for exploitation. (CVE-2021-0938)

  - In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References:
    Upstream kernel (CVE-2021-0941)

  - A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users     do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
    (CVE-2021-20321)

  - A denial-of-service (DoS) flaw was identified in the Linux kernel due to an incorrect memory barrier in     xt_replace_table in net/netfilter/x_tables.c in the netfilter subsystem. (CVE-2021-29650)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects     the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store     operation does not necessarily occur before a store operation that has an attacker-controlled value.
    (CVE-2021-35477)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A flaw was found in the Linux kernel. A memory leak in the ccp-ops crypto driver can allow attackers to     cause a denial of service. This vulnerability is similar with the older CVE-2019-18808. The highest threat     from this vulnerability is to system availability. (CVE-2021-3744)

  - A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker     to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat     from this vulnerability is to system availability. (CVE-2021-3764)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in     any net namespace because these changes are leaked into all other net namespaces. This is related to the     NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. (CVE-2021-38209)

  - In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel (CVE-2021-39633)

  - In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-204450605References: Upstream kernel (CVE-2021-39634)

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation. (CVE-2021-39698)

  - A use-after-free flaw was found in the Linux kernel's network scheduling subsystem due to a race     condition.This flaw allows a local user to cause a denial of service (memory corruption or crash) or     privilege escalation. (CVE-2021-39713)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

  - A read-after-free memory flaw was found in the Linux kernel s garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges o     (CVE-2021-4083)

  - A flaw memory leak in the Linux kernel's eBPF for the Simulated networking device driver in the way user     uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this     flaw to get unauthorized access to some data. (CVE-2021-4135)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace. A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. (CVE-2021-4159)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A flaw use after free in the Linux kernel FUSE filesystem was found in the way user triggers write(). A     local user could use this flaw to get some unauthorized access to some data from the FUSE filesystem and     as result potentially privilege escalation too. (CVE-2022-1011)

  - Due to the small table perturb size, a memory leak flaw was found in the Linux kernel's TCP source port     generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and     may cause a denial of service. (CVE-2022-1012)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain,which can cause a use-     after-free.This issue needs to handle return with proper preconditions,as it can lead to a kernel     information leak problem caused by a local,unprivileged attacker. (CVE-2022-1016)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel.This flaw     allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of     internal kernel information. (CVE-2022-1353)

  - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients. (CVE-2022-1678)

  - Kernel-headers includes the C header files that specify the interfacebetween the Linux kernel and     userspace libraries and programs.  Theheader files define structures and constants that are needed     forbuilding most standard programs and are also needed for rebuilding theglibc package. (CVE-2022-1729)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.
    (CVE-2022-20008)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation. (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation. (CVE-2022-20141)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB.An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches.Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the     O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a     regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file     descriptor. (CVE-2022-24448)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux     kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped.
    However, the handler may not have time to run if the frontend quickly toggles between the states connect     and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving     guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege     escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.
    (CVE-2020-29569)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel (CVE-2021-39633)

  - In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an     incorrect flag check. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-210292376References: Upstream kernel (CVE-2021-39685)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network     protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more     buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). (CVE-2022-0322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0367-1 advisory.

    The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195254).
    - CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization     subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could     use this flaw to crash the system (bnc#1186207).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could     have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object (bnc#1193767).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
    - CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
    - CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
    - CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
    - CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket     file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race     condition (bnc#1193727).
    - CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c     (bnc#1194087).
    - CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).
    - CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).
    - CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392)     (bsc#1193442).
    - CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
    - CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free.
    This could lead to local escalation of privilege with System execution privileges needed. User interaction     is not needed for exploitation (bnc#1192032).
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device (bsc#1179599).
    - CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
    - CVE-2021-43975: hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c     allowed an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted     length value (bnc#1192845).
    - CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version     3.17.3 may have allowed an authenticated user to potentially enable denial of service via local access     (bnc#1192877).
    - CVE-2021-43976: mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allowed an attacker (who     can connect a crafted USB device) to cause a denial of service (skb_over_panic) (bnc#1192847).
    - CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices     aka 'Kr00k' (bsc#1167162).
    - CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0371-1 advisory.

    The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195254).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
    - CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
    - CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table     (bnc#1194087).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could     have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object (bnc#1193767).
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
    - CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
    - CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
    - CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).
    - CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
    - CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket     file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race     condition (bnc#1193727).
    - CVE-2021-4002: Fixed a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization     subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could     use this flaw to crash the system (bnc#1186207).
    - CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper     input validation. (bsc#1192877)
    - CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392)     (bsc#1193442).
    - CVE-2021-28714: Fixed issue with xen/netback to add rx queue stall detection (XSA-392) (bsc#1193442).
    - CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free.
    This could lead to local escalation of privilege with System execution privileges needed. User interaction     is not needed for exploitation (bnc#1192032).
    - CVE-2021-0920: Fixed use after free bug due to a race condition in unix_scm_to_skb of af_unix.c. This     could have led to local escalation of privilege with System execution privileges needed (bnc#1193731).
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bsc#1179599)
    - CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices     aka 'Kr00k'. (bsc#1167162)
    - CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0056-1 advisory.

  - Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version     1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
    (CVE-2020-24504)

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]     Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing. (CVE-2021-28714) (CVE-2021-28714, CVE-2021-28715)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640) (CVE-2021-4002)

  - In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a     crafted device) to trigger an out-of-bounds write via a crafted length value. (CVE-2021-43975)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0181-1 advisory.

    The SUSE MicroOS 5.0 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
    - CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening blkfront against event channel storms. (bsc#1193440)
    - CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening netfront against event channel storms. (bsc#1193440)
    - CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening hvc_xen against event channel storms. (bsc#1193440)
    - CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by fixing rx queue stall detection. (bsc#1193442)
    - CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by do not queueing unlimited number of packages.  (bsc#1193442)
    - CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that could allow     an authenticate user to cause a denial of service (bnc#1192877).
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the     group key handshake, allowing an attacker within radio range to replay frames from access points to     clients. (CVE-2017-13080)

  - It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable     to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on     network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph     service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. (CVE-2018-1128)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat     fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets,     independent of the network configuration. (CVE-2020-26142)

  - An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26143)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042     (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26144)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations     reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate     selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the     WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by     design. (CVE-2020-26146)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - A flaw was found in the Linux kernel's implementation of MIDI, where an attacker with a local account and     the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to     this specific memory while freed and before use causes the flow of execution to change and possibly allow     for memory corruption or privilege escalation. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-27786)

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users     do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
    (CVE-2021-20321)

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process's     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in     drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
    (CVE-2021-30002)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to     the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the     system or escalate their privileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-3752)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in     any net namespace because these changes are leaked into all other net namespaces. This is related to the     NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. (CVE-2021-38209)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an     improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of     service (DOS) due to a deadlock problem. (CVE-2021-4149)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds     memory access when an inode has an invalid last xattr entry. (CVE-2021-45469)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0068-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated.

    The following security bugs were fixed:

    - CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices     aka 'Kr00k'. (bsc#1167162)
    - CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper     input validation. (bsc#1192877)
    - CVE-2021-0935: Fixed out of bounds write due to a use after free which could lead to local escalation of     privilege with System execution privileges needed in ip6_xmit. (bsc#1192032)
    - CVE-2018-25020: Fixed an issue in the BPF subsystem in the Linux kernel mishandled situations with a     long jump over an instruction sequence where inner instructions require substantial expansions into     multiple BPF instructions, leading to an overflow. (bsc#1193575)
    - CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc. (bsc#1193731)
    - CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source     addresses. (bsc#1194094)
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c.
    (bsc#1194087)
    - CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
    - CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by fixing rx queue stall detection. (bsc#1193442)
    - CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening hvc_xen against event channel storms. (bsc#1193440)
    - CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening netfront against event channel storms. (bsc#1193440)
    - CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening blkfront against event channel storms. (bsc#1193440)
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bsc#1192847)
    - CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bsc#1179599)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0080-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated.

    The following security bugs were fixed:

    - CVE-2021-4083: Fixed a race condition with Unix domain socket garbage collection that can lead to read     memory after free. (bsc#1193727)
    - CVE-2021-4149: Fixed an improper lock operation in btrfs which allows users to crash the kernel or     deadlock the system. (bsc#1194001)
    - CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source     addresses. (bsc#1194094)
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c.
    (bsc#1194087)
    - CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc. (bsc#1193731)
    - CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
    - CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by fixing rx queue stall detection. (bsc#1193442)
    - CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening hvc_xen against event channel storms. (bsc#1193440)
    - CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening netfront against event channel storms. (bsc#1193440)
    - CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening blkfront against event channel storms. (bsc#1193440)
    - CVE-2018-25020: Fixed an issue in the BPF subsystem in the Linux kernel mishandled situations with a     long jump over an instruction sequence where inner instructions require substantial expansions into     multiple BPF instructions, leading to an overflow. (bsc#1193575)
    - CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2021-0935: Fixed out of bounds write due to a use after free which could lead to local escalation of     privilege with System execution privileges needed in ip6_xmit. (bsc#1192032)
    - CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices     aka 'Kr00k'. (bsc#1167162)
    - CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper     input validation. (bsc#1192877)
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bsc#1192847)
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bsc#1179599)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0079-1 advisory.

    The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter     drivers that may have allowed an authenticated user to potentially enable denial of service via local     access. (bnc#1182404)
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bnc#1179599)
    - CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
    - CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening blkfront against event channel storms. (bsc#1193440)
    - CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening netfront against event channel storms. (bsc#1193440)
    - CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening hvc_xen against event channel storms. (bsc#1193440)
    - CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by fixing rx queue stall detection. (bsc#1193442)
    - CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by do not queueing unlimited number of packages.  (bsc#1193442)
    - CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that could allow     an authenticate user to cause a denial of service (bnc#1192877).
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)
    - CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source     addresses. (bsc#1194094)
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c.
    (bnc#1194087).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0197-1 advisory.

    The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local     privilege escalation (bsc#1194517).
    - CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
    - CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux     kernel that occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared     memory object (bnc#1193767).
    - CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower     privileged ones that could lead to privilege escalation (bsc#1194302).
    - CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
    - CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free     memory corruption (bsc#1194529)
    - CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix     domain socket file handlers in the way users call close() and fget() simultaneously and can potentially     trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges     on the system. (bnc#1193727).
    - CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
    - CVE-2021-45485: The IPv6 implementation in net/ipv6/output_core.c had an information leak because of     certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can     typically choose among many IPv6 source addresses (bnc#1194094).
    - CVE-2021-45486: The IPv4 implementation in net/ipv4/route.c had an information leak because the hash     table is very small (bnc#1194087).
    - CVE-2021-4001: A race condition was found in the Linux kernel's ebpf verifier between     bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a     local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space.
    (bnc#1192990).
    - CVE-2021-28715: Guest can force Linux netback driver to hog large amounts of kernel memory. Incoming     data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to     process them. There are some measures taken for avoiding to pile up too much data, but those can be     bypassed by the guest: There was a timeout how long the client side of an interface can stop consuming new     packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing. ()
    - CVE-2021-28714: Guest can force Linux netback driver to hog large amounts of kernel memory. Incoming     data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to     process them. There are some measures taken for avoiding to pile up too much data, but those can be     bypassed by the guest: There was a timeout how long the client side of an interface can stop consuming new     packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing (bnc#1193442).
    - CVE-2021-28713: Rogue backends can cause DoS of guests via high frequency events. Xen offers the ability     to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'. Running PV     backends in driver domains has one primary security advantage: if a driver domain gets compromised, it     doesn't have the privileges to take over the system. However, a malicious driver domain could try to     attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due     to trying to service interrupts for elongated amounts of time. (bsc#1193440)
    - CVE-2021-28712: Rogue backends can cause DoS of guests via high frequency events. Xen offers the ability     to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'. Running PV     backends in driver domains has one primary security advantage: if a driver domain gets compromised, it     doesn't have the privileges to take over the system. However, a malicious driver domain could try to     attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due     to trying to service interrupts for elongated amounts of time. (bsc#1193440)
    - CVE-2021-28711: Rogue backends can cause DoS of guests via high frequency events. Xen offers the ability     to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'. Running PV     backends in driver domains has one primary security advantage: if a driver domain gets compromised, it     doesn't have the privileges to take over the system. However, a malicious driver domain could try to     attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due     to trying to service interrupts for elongated amounts of time (bnc#1193440).
    - CVE-2020-27825: A use-after-free flaw was found in kernel/trace/ring_buffer.c. There was a race problem     in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service     problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel     information leak threat (bnc#1179960).
    - CVE-2021-43975: hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c     allowed an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted     length value (bnc#1192845).
    - CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version     3.17.3 may have allowed an authenticated user to potentially enable denial of service via local access     (bnc#1192877).
    - CVE-2021-43976: mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allowed an attacker (who     can connect a crafted USB device) to cause a denial of service (skb_over_panic) (bnc#1192847).
    - CVE-2021-4002: Incorrect TLBs flushing after huge_pmd_unshare could lead to exposing hugepages to other     users (bsc#1192946).
    - CVE-2020-27820: A use-after-frees in nouveau's postclose() handler could happen if removing device (that     is not common to remove video card physically without power-off, but same happens if 'unbind' the driver)     (bnc#1179599).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
156646	SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2022:0056-1)	Nessus	SuSE Local Security Checks	2022/1/12	2026/6/26	high
165936	EulerOS Virtualization 3.0.6.0 : kernel (EulerOS-SA-2022-2566)	Nessus	Huawei Local Security Checks	2022/10/10	2026/6/3	high
160118	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2022-1523)	Nessus	Huawei Local Security Checks	2022/4/25	2026/6/3	high
159983	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-1508)	Nessus	Huawei Local Security Checks	2022/4/20	2023/11/1	high
157895	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0367-1)	Nessus	SuSE Local Security Checks	2022/2/11	2026/6/26	high
157939	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0371-1)	Nessus	SuSE Local Security Checks	2022/2/12	2026/6/26	high
156648	openSUSE 15 Security Update : kernel (openSUSE-SU-2022:0056-1)	Nessus	SuSE Local Security Checks	2022/1/12	2023/11/21	high
157076	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:0181-1)	Nessus	SuSE Local Security Checks	2022/1/26	2026/6/26	medium
161565	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2022-1735)	Nessus	Huawei Local Security Checks	2022/5/26	2026/6/3	high
152388	Photon OS 3.0: Linux PHSA-2021-3.0-0278	Nessus	PhotonOS Local Security Checks	2021/8/10	2025/8/22	high
156748	SUSE SLED12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0068-1)	Nessus	SuSE Local Security Checks	2022/1/14	2026/6/25	high
156759	SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2022:0080-1)	Nessus	SuSE Local Security Checks	2022/1/15	2026/6/26	high
156760	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:0079-1)	Nessus	SuSE Local Security Checks	2022/1/15	2026/6/26	high
157144	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0197-1)	Nessus	SuSE Local Security Checks	2022/1/27	2026/6/26	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

medium

high

high

high

high

high

high