According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of     transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is     partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or     IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under     some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in
    __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800
    __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is     used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger     than the amount of data in the message iterator. This is because the requested length includes the     transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6,     SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100,     MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the     write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks     like it won't suffer from this problem as it builds the UDP packet itself.(CVE-2023-52527)

    In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in     shinker's callback The mmap read lock is used during the shrinker's callback, which means that using     alloc-vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ('mm: mmap: zap     pages with read mmap_sem in munmap') the mmap lock is downgraded after the vma has been isolated. I was     able to reproduce this issue by manually adding some delays and triggering page reclaiming through the     shrinker's debug sysfs.(CVE-2023-52438)

    A flaw in the routing table size was found in the ICMPv6 handling of  Packet Too Big . The size of the     routing table is regulated by periodic garbage collection. However, with  Packet Too Big Messages  it is     possible to exceed the routing table size and garbage collector threshold. A user located in the local     network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6     connections up to 95%.(CVE-2023-52340)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT.(CVE-2024-1086)

    A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel     hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or     potentially escalate their privileges on the system.(CVE-2024-0841)

    In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload.(CVE-2023-51043)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval()     function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes     are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every     iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local     user to cause a denial of service or potentially break NetFilter functionality.(CVE-2024-0607)

    A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernels SCTP subsystem. This flaw allows guests with local user     privileges to trigger a deadlock and potentially crash the system.(CVE-2024-0639)

    A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may     allow an attacker using this library to cause a denial of service problem due to a missing check at a     function return.(CVE-2023-6915)

    Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0.(CVE-2021-33631)

    A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernels TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system.(CVE-2024-0641)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued     on.(CVE-2023-6531)

    An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access.(CVE-2023-6040)

    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.(CVE-2024-0565)

    An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap.(CVE-2022-48619)

    A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file.(CVE-2024-0340)

    A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow.(CVE-2023-7192)

    A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system.(CVE-2024-0193)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer     (dmesg).(CVE-2023-6121)

    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel     information.(CVE-2023-6606)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group().(CVE-2023-6931)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6652-1 advisory.

    Marek Marczykowski-Grecki discovered that the Xen event channel infrastructure implementation in the     Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a     denial of service (paravirtualized device unavailability). (CVE-2023-34324)

    Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during     device removal. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-35827)

    Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors     in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV     guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-46813)

    It was discovered that the io_uring subsystem in the Linux kernel contained a race condition, leading to a     null pointer dereference vulnerability. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-46862)

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly validate inner tunnel     netlink attributes, leading to a null pointer dereference vulnerability. A local attacker could use this     to cause a denial of service (system crash). (CVE-2023-5972)

    It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic     operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

    Jann Horn discovered that a race condition existed in the Linux kernel when handling io_uring over     sockets, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-6531)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset     expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2023-6622)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the io_uring subsystem in the Linux kernel did not properly handle the release     of certain buffer rings. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2024-0582)

    It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle     locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of     service (kernel deadlock). (CVE-2024-0641)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0514-1 advisory.

  - Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0. (CVE-2021-33631)

  - Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really     useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides     a certain initial portion of the to be transferred data, these parts are directly translated into what     Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of     length zero, lead to a de-reference of NULL in core networking code. (CVE-2023-46838)

  - The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in     the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local     access, this could be exploited in a real world scenario. This is related to     brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.
    (CVE-2023-47233)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has     a fence use-after-free. (CVE-2023-51042)

  - In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

  - An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-     free because of a vcc_recvmsg race condition. (CVE-2023-51780)

  - An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-     after-free because of a rose_accept race condition. (CVE-2023-51782)

  - An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access. (CVE-2023-6040)

  - A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious     actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL     pointer dereference in the NVMe driver and causing kernel panic and a denial of service. (CVE-2023-6356)

  - A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

  - A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious     actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL     pointer dereference in the NVMe driver, causing kernel panic and a denial of service. (CVE-2023-6535,     CVE-2023-6536)

  - A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may     allow an attacker using this library to cause a denial of service problem due to a missing check at a     function return. (CVE-2023-6915)

  - A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file. (CVE-2024-0340)

  - An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service. (CVE-2024-0565)

  - A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

  - A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the     catch-all set element is active in the current generation instead of the next generation before freeing     it, but only flags it inactive in the next generation, making it possible to free the element multiple     times, leading to a double free vulnerability. We recommend upgrading past commit     b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7. (CVE-2024-1085)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit     f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)

  - A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue. (CVE-2024-24860)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6626-1 advisory.

    Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel     when handling sessions operations. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

    Marek Marczykowski-Grecki discovered that the Xen event channel infrastructure implementation in the     Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a     denial of service (paravirtualized device unavailability). (CVE-2023-34324)

    Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during     device removal. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-35827)

    Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors     in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV     guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-46813)

    It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash). (CVE-2023-6039)

    It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic     operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset     expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2023-6622)

    It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle     locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of     service (kernel deadlock). (CVE-2024-0641)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-422 advisory.

    2024-07-03: CVE-2023-52522 was added to this advisory.

    2024-07-03: CVE-2023-52559 was added to this advisory.

    2024-07-03: CVE-2023-52523 was added to this advisory.

    2024-06-06: CVE-2023-52481 was added to this advisory.

    2024-06-06: CVE-2023-52476 was added to this advisory.

    2024-06-06: CVE-2023-52477 was added to this advisory.

    2024-02-01: CVE-2024-0641 was added to this advisory.

    A flaw in the kernel Xen event handler can cause a deadlock with Xen console handling in unprivileged Xen     guests. (CVE-2023-34324)

    An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs     due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to     executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-39191)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: errata: Add Cortex-A520 speculative unprivileged load workaround (CVE-2023-52481)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets (CVE-2023-52523)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Avoid memory allocation in iommu_suspend() (CVE-2023-52559)

    A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程 20.04 LTS / 22.04 LTS 主机上安装的程序包受到 USN-6626-1 公告中提及的多个漏洞的影响。

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32250)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_LOGOFF 命令时存在特定缺陷。出现此问题的原因是在访问指针之前缺少正确的验证。攻击者可利用此漏洞在系统中造成拒绝服务情况。(CVE-2023-32252)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 和 SMB2_LOGOFF 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32257)

  - Linux 内核中的事件通道关闭会导致死锁。如果在执行关闭操作的同时还执行不相关的 Xen 控制台操作以及处理非特权客户机中的 Xen 控制台中断问题，则会发生这种情况。例如，事件通道关闭因另一端的半虚拟化设备被删除而触发。由于此操作将导致控制台消息在另一端频繁发出，因此不能忽略触发死锁的可能性。请注意，32 位 Arm 客户机不受影响，因为 Arm 上的 32 位 Linux 内核不使用触发该问题所需的 queued-RW-locks（在 Arm32 上，等待的写入程序不会阻止更多读取程序获取锁定）。(CVE-2023-34324)

  - 在 Linux 内核 6.3.8 及之前的版本中发现问题。在 drivers/net/ethernet/renesas/ravb_main.c 的 ravb_remove 中发现了释放后使用漏洞。(CVE-2023-35827)

  - 在 6.5.9 版之前在 Linux 内核中发现了一个问题，具有对 MMIO 寄存器的用户空间访问权限的本地用户可利用此漏洞。#VC 处理程序中的不正确访问检查和 MMIO 访问的 SEV-ES 模拟的指令模拟可能会导致对内核内存的任意写入访问（从而导致特权提升）。此问题依赖于竞争条件触发，通过该竞争条件，用户空间可以在 #VC 处理程序读取指令之前替换该指令。(CVE-2023-46813)

  - 在 Linux 内核的网络子组件 net/usb/lan78xx 的 drivers/net/usb/lan78xx.c 的 lan78xx_disconnect 中发现释放后使用缺陷。当 LAN78XX USB 设备分离时，此缺陷允许本地攻击者使系统崩溃。(CVE-2023-6039)

  - 在用于加密算法 scatterwalk 功能的 Linux 内核 API 中发现了空指针取消引用缺陷。当用户使用特定套接字配置构造恶意数据包时，就会出现此问题，这可能允许本地用户崩溃系统或提升其在系统上的权限。(CVE-2023-6176)

  - 在 Linux 内核中，在 nf_tables 的 net/netfilter/nft_dynset.c 中的 nft_dynset_init() 中发现一个空指针取消引用漏洞。具有 CAP_NET_ADMIN 用户权限的本地攻击者可利用此问题触发拒绝服务。(CVE-2023-6622)

  - 在 Linux 内核的 TIPC 子系统中，在 net/tipc/crypto.c 的 tipc_crypto_key_revoke 中发现一个拒绝服务漏洞。此缺陷允许具有本地用户权限的客户机触发死锁，并可能导致系统崩溃。(CVE-2024-0641)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

因此，它受到 ALAS2023-2023-422 公告中提及的多个漏洞影响。

    2024-07-03：已将 CVE-2023-52522 添加到此公告中。

    2024-07-03：已将 CVE-2023-52559 添加到此公告中。

    2024-07-03：已将 CVE-2023-52523 添加到此公告中。

    2024-06-06：已将 CVE-2023-52481 添加到此公告中。

    2024-06-06：已将 CVE-2023-52476 添加到此公告中。

    2024-06-06：已将 CVE-2023-52477 添加到此公告中。

    2024-02-01：已将 CVE-2024-0641 添加到此公告中。

    内核 Xen 事件处理程序中存在的一个缺陷可造成非特权 Xen 客户机中 Xen 控制台处理出现死锁问题。(CVE-2023-34324)

    Linux 内核的 eBPF 子系统中发现不正确的输入验证缺陷。此问题是在执行用户提供的 eBPF 程序之前，未对其进行正确的动态指针验证所致。具有 CAP_BPF 权限的攻击者可利用此缺陷在内核环境中提升权限和执行任意代码。(CVE-2023-39191)

    在 Linux 内核中，以下漏洞已修复：

    perf/x86/lbr：筛选 vsyscall 地址 (CVE-2023-52476)

    在 Linux 内核中，以下漏洞已修复：

    usb: hub：防止访问未初始化的 BOS 描述符 (CVE-2023-52477)

    在 Linux 内核中，以下漏洞已修复：

    arm64：erratas：添加 Cortex-A520 推测非特权加载变通方案 (CVE-2023-52481)

    在 Linux 内核中，以下漏洞已修复：

    net：修复 neigh_periodic_work() 中可能存在的存储拆分问题 (CVE-2023-52522)

    在 Linux 内核中，以下漏洞已修复：

    bpf、sockmap：拒绝重定向到非 TCP 套接字的 sk_msg 出口（CVE-2023-52523）

    在 Linux 内核中，以下漏洞已修复：

    iommu/vt-d：避免 iommu_suspend() 中的内存分配 (CVE-2023-52559)

    在 Linux 内核的 TIPC 子系统中，在 net/tipc/crypto.c 的 tipc_crypto_key_revoke 中发现了一个拒绝服务漏洞。此缺陷允许具有本地用户权限的客户机触发死锁，并可能导致系统崩溃。(CVE-2024-0641)

Tenable 已直接从测试产品的安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Ubuntu 23.10 主机上安装的程序包受到 USN-6652-1 公告中提及的多个漏洞的影响。

  - Linux 内核中的事件通道关闭会导致死锁。如果在执行关闭操作的同时还执行不相关的 Xen 控制台操作以及处理非特权客户机中的 Xen 控制台中断问题，则会发生这种情况。例如，事件通道关闭因另一端的半虚拟化设备被删除而触发。由于此操作将导致控制台消息在另一端频繁发出，因此不能忽略触发死锁的可能性。请注意，32 位 Arm 客户机不受影响，因为 Arm 上的 32 位 Linux 内核不使用触发该问题所需的 queued-RW-locks（在 Arm32 上，等待的写入程序不会阻止更多读取程序获取锁定）。(CVE-2023-34324)

  - 在 Linux 内核 6.3.8 及之前的版本中发现问题。在 drivers/net/ethernet/renesas/ravb_main.c 的 ravb_remove 中发现了释放后使用漏洞。(CVE-2023-35827)

  - 在 6.5.9 版之前在 Linux 内核中发现了一个问题，具有对 MMIO 寄存器的用户空间访问权限的本地用户可利用此漏洞。#VC 处理程序中的不正确访问检查和 MMIO 访问的 SEV-ES 模拟的指令模拟可能会导致对内核内存的任意写入访问（从而导致特权提升）。此问题依赖于竞争条件触发，通过该竞争条件，用户空间可以在 #VC 处理程序读取指令之前替换该指令。(CVE-2023-46813)

  - 在 Linux 内核 6.5.9 及之前的版本中发现问题。在 SQ 线程退出的竞争中，可能会发生 io_uring/fdinfo.c io_uring_show_fdinfo 空指针取消引用。(CVE-2023-46862)

  - 在 6.6.8 之前的 Linux 内核中发现了一个问题。因 vcc_recvmsg 争用条件，net/atm/ioctl.c 中的 do_vcc_ioctl 存在释放后使用漏洞。(CVE-2023-51780)

  - 在 6.6.8 之前的 Linux 内核中发现了一个问题。因 atalk_recvmsg 争用条件，net/appletalk/ddp.c 中的 atalk_ioctl 存在释放后使用漏洞。(CVE-2023-51781)

  - 在 Linux 内核 netfilter 的 nft_inner.c 功能中发现一个空指针取消引用缺陷。本地用户可以利用此问题造成系统崩溃，或提升其在系统中的权限。(CVE-2023-5972)

  - 在用于加密算法 scatterwalk 功能的 Linux 内核 API 中发现了空指针取消引用缺陷。当用户使用特定套接字配置构造恶意数据包时，就会出现此问题，这可能允许本地用户崩溃系统或提升其在系统上的权限。(CVE-2023-6176)

  - 在 Linux 内核中发现了一个释放后使用缺陷，原因是 Unix 垃圾回收器在删除 SKB 时与 unix_stream_read_generic() 函数在套接字上存在竞争问题，而该 SKB 正在该套接字上排队。
    (CVE-2023-6531)

  - 在 Linux 内核中，在 nf_tables 的 net/netfilter/nft_dynset.c 中的 nft_dynset_init() 中发现一个空指针取消引用漏洞。具有 CAP_NET_ADMIN 用户权限的本地攻击者可利用此问题触发拒绝服务。(CVE-2023-6622)

  - 在 Linux 内核中，在 lib/idr.c 的 ida_free 中发现一个空指针取消引用问题。此问题可能会允许使用此库的攻击者因缺少函数返回检查而造成拒绝服务问题。(CVE-2023-6915)

  - 在 Linux 内核的 SMB 客户端子组件中，在 fs/smb/client/smb2ops.c 的 receive_encrypted_standard 中发现越界内存读取缺陷。出现此问题的原因是 memcpy 长度存在整数下溢，从而导致拒绝服务。(CVE-2024-0565)

  - 在用户使用 IORING_REGISTER_PBUF_RING 注册缓冲区环、对其进行 mmap() 处理，然后释放时，在 Linux 内核的 io_uring 功能中发现内存泄漏缺陷。本地用户可利用此缺陷导致系统崩溃或可能升级其系统权限。(CVE-2024-0582)

  - 在 Linux 内核的 TIPC 子系统中，在 net/tipc/crypto.c 的 tipc_crypto_key_revoke 中发现一个拒绝服务漏洞。此缺陷允许具有本地用户权限的客户机触发死锁，并可能导致系统崩溃。(CVE-2024-0641)

  - 当用户调用以 ktls 套接字作为目标的函数 splice 时，在 Linux 内核的传输层安全功能中发现一个越界内存写入缺陷。本地用户可利用此缺陷导致系统崩溃或可能升级其系统权限。(CVE-2024-0646)

请注意，Nessus 尚未测试这些问题，而是只依靠应用程序自我报告的版本号来判断。

因此，會受到 ALAS2023-2023-422 公告中所提及的多個弱點影響。

    2024-07-03：已將 CVE-2023-52522 新增至此公告。

    2024-07-03：已將 CVE-2023-52559 新增至此公告。

    2024-07-03：已將 CVE-2023-52523 新增至此公告。

    2024-06-06：已將 CVE-2023-52481 新增至此公告。

    2024-06-06：已將 CVE-2023-52476 新增至此公告。

    2024-06-06：已將 CVE-2023-52477 新增至此公告。

    2024-02-01：已將 CVE-2024-0641 新增至此公告。

    核心 Xen 事件處置程式中的一個瑕疵可在非特權 Xen 來賓中造成 Xen 主控台處理鎖死。(CVE-2023-34324)

    在 Linux 核心的 eBPF 子系統中發現不當輸入驗證瑕疵。此問題是由於在執行使用者提供的 eBPF 程式之前，對於動態指針的正確驗證不足所導致的。具有 CAP_BPF 權限的攻擊者可利用此弱點，在核心的環境中提升權限並執行任意程式碼。(CVE-2023-39191)

    在 Linux 核心中，下列弱點已解決：

    perf/x86/lbr：篩選 vsyscall 位址 (CVE-2023-52476)

    在 Linux 核心中，下列弱點已解決：

    usb：hub：防止存取未初始化的 BOS 描述符號 (CVE-2023-52477)

    在 Linux 核心中，下列弱點已解決：

    arm64：errata：新增 Cortex-A520 推測性非特權載入因應措施 (CVE-2023-52481)

    在 Linux 核心中，下列弱點已解決：

    net：修正 neigh_periodic_work() 中潛在的儲存區中斷弱點 (CVE-2023-52522)

    在 Linux 核心中，下列弱點已解決：

    bpf、sockmap：拒絕 sk_msg Egress 重新導向至非 TCP 通訊端 (CVE-2023-52523)

    在 Linux 核心中，下列弱點已解決：

    iommu/vt-d：避免 iommu_suspend() 中的記憶體配置 (CVE-2023-52559)

    在 Linux 核心的 TIPC 子系統中，發現 net/tipc/crypto.c 的 tipc_crypto_key_revoke 存在拒絕服務弱點。此瑕疵允許具有本機使用者權限的來賓觸發鎖死，並可能造成系統當機。(CVE-2024-0641)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 20.04 LTS/22.04 LTS 主機上安裝的一個套件受到 USN-6626-1 公告中所提及的多個弱點影響。

  - 在 Linux 核心的 ksmbd (一種高效能核心內 SMB 伺服器) 中發現一個瑕疵。處理 SMB2_SESSION_SETUP 命令的過程中存在特定瑕疵。此問題的原因在於，在物件上執行作業時缺少適當的鎖定。攻擊者可利用此弱點，在核心環境中執行程式碼。(CVE-2023-32250)

  - 在 Linux 核心的 ksmbd (一種高效能核心內 SMB 伺服器) 中發現一個瑕疵。處理 SMB2_LOGOFF 命令的過程中存在特定瑕疵。產生此問題的原因是，在存取指標之前未正確執行驗證。攻擊者可利用此弱點，在系統中造成拒絕服務情形。(CVE-2023-32252)

  - 在 Linux 核心的 ksmbd (一種高效能核心內 SMB 伺服器) 中發現一個瑕疵。處理 SMB2_SESSION_SETUP 和 SMB2_LOGOFF 命令的過程中存在特定瑕疵。此問題的原因在於，在物件上執行作業時缺少適當的鎖定。攻擊者可利用此弱點，在核心環境中執行程式碼。(CVE-2023-32257)

  - 關閉 Linux 核心中的事件通道可導致鎖死。在非特權來賓中處理 Xen 主控台中斷的同時並行關閉不相關的 Xen 主控台動作時，會發生此情況。例如，藉由移除另一端的半虛擬裝置來觸發事件通道關閉。此動作會造成另一端經常發出主控台訊息，因此觸發鎖死的機會不可忽略。請注意，32 位元 Arm 來賓不會受到影響，這是因為 Arm 上的 32 位元 Linux 核心未使用觸發問題所需的 queued-RW-locks (在 Arm32 上，等待寫入器不會封鎖其他讀取器取得鎖定)。(CVE-2023-34324)

  - 在 Linux 核心 6.3.8 及之前版本中發現一個問題。在 drivers/net/ethernet/renesas/ravb_main.c 的 ravb_remove 中發現一個釋放後使用問題。(CVE-2023-35827)

  - 在 6.5.9 之前的 Linux 核心中發現一個問題，對 MMIO 暫存器有使用者空間存取權的本機使用者可惡意利用此問題。#VC 處置程式中的錯誤存取檢查以及對 MMIO 存取的 SEV-ES 模擬的指令模擬，可導致核心記憶體被任意寫入存取 (並因此造成權限提升)。這取決於爭用情形，使用者空間可透過爭用情形在 #VC 處置程式讀取指令之前將其替換。(CVE-2023-46813)

  - 在 Linux 核心網路子元件 net/usb/lan78xx 的 drivers/net/usb/lan78xx.c 中的 lan78xx_disconnect 中發現一個釋放後使用瑕疵。此瑕疵允許本機攻擊者在 LAN78XX USB 裝置卸離時造成系統當機。(CVE-2023-6039)

  - 在密碼編譯演算法 scatterwalk 功能的 Linux 核心 API 中發現一個 null 指標解除參照瑕疵。當使用者建構具有特定通訊端組態的惡意封包時，會發生此問題，其可允許本機使用者造成系統當機或提升其在系統上的權限。(CVE-2023-6176)

  - 在 Linux 核心的 nf_tables 中，發現 net/netfilter/nft_dynset.c 的 nft_dynset_init() 存在 Null 指標解除參照弱點。具有 CAP_NET_ADMIN 使用者特權的本機攻擊者可藉由此問題造成拒絕服務。(CVE-2023-6622)

  - 在 Linux 核心的 TIPC 子系統中，在 net/tipc/crypto.c 的 tipc_crypto_key_revoke 中發現一個拒絕服務弱點。此瑕疵允許具有本機使用者權限的來賓觸發鎖死，並可能造成系統當機。(CVE-2024-0641)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 23.10 主機上安裝的套件受到 USN-6652-1 公告中所提及的多個弱點影響。

  - 關閉 Linux 核心中的事件通道可導致鎖死。在非特權來賓中處理 Xen 主控台中斷的同時並行關閉不相關的 Xen 主控台動作時，會發生此情況。例如，藉由移除另一端的半虛擬裝置來觸發事件通道關閉。此動作會造成另一端經常發出主控台訊息，因此觸發鎖死的機會不可忽略。請注意，32 位元 Arm 來賓不會受到影響，這是因為 Arm 上的 32 位元 Linux 核心未使用觸發問題所需的 queued-RW-locks (在 Arm32 上，等待寫入器不會封鎖其他讀取器取得鎖定)。(CVE-2023-34324)

  - 在 Linux 核心 6.3.8 及之前版本中發現一個問題。在 drivers/net/ethernet/renesas/ravb_main.c 的 ravb_remove 中發現一個釋放後使用問題。(CVE-2023-35827)

  - 在 6.5.9 之前的 Linux 核心中發現一個問題，對 MMIO 暫存器有使用者空間存取權的本機使用者可惡意利用此問題。#VC 處置程式中的錯誤存取檢查以及對 MMIO 存取的 SEV-ES 模擬的指令模擬，可導致核心記憶體被任意寫入存取 (並因此造成權限提升)。這取決於爭用情形，使用者空間可透過爭用情形在 #VC 處置程式讀取指令之前將其替換。(CVE-2023-46813)

  - 在 6.5.9 版之前的 Linux 核心中發現一個問題。在爭用 SQ 執行緒時，可發生 io_uring/fdinfo.c io_uring_show_fdinfo NULL 指標解除參照。(CVE-2023-46862)

  - 在 6.6.8 之前的 Linux 核心中發現一個問題。由於 vcc_recvmsg 爭用情形，net/atm/ioctl.c 中的 do_vcc_ioctl 有釋放後使用情形弱點。(CVE-2023-51780)

  - 在 6.6.8 之前的 Linux 核心中發現一個問題。由於 atalk_recvmsg 爭用情形，net/appletalk/ddp.c 中的 atalk_ioctl 有釋放後使用情形弱點。(CVE-2023-51781)

  - 在 Linux 核心之 netfilter 的 nft_inner. 功能中，發現 NULL 指標解除參照缺陷。本機使用者可利用此問題使系統當機，或提升其在系統中的權限。(CVE-2023-5972)

  - 在密碼編譯演算法 scatterwalk 功能的 Linux 核心 API 中發現一個 null 指標解除參照瑕疵。當使用者建構具有特定通訊端組態的惡意封包時，會發生此問題，其可允許本機使用者造成系統當機或提升其在系統上的權限。(CVE-2023-6176)

  - 在 Linux 核心中發現釋放後使用瑕疵，這是 unix 記憶體回收行程在刪除 SKB 與 SKB 佇列所在通訊端上的 unix_stream_read_generic() 爭用時發生爭用問題所導致。
    (CVE-2023-6531)

  - 在 Linux 核心的 nf_tables 中，發現 net/netfilter/nft_dynset.c 的 nft_dynset_init() 存在 Null 指標解除參照弱點。具有 CAP_NET_ADMIN 使用者特權的本機攻擊者可藉由此問題造成拒絕服務。(CVE-2023-6622)

  - 在 Linux 核心中，在 lib/idr.c 的 ida_free 中發現一個 NULL 指標解除參照問題。此問題可能允許使用此程式庫的攻擊者因函式傳回時遺漏檢查而造成拒絕服務弱點。(CVE-2023-6915)

  - 在 Linux Kernel 的 SMB Client 子元件中，fs/smb/client/smb2ops.c 的 receive_encrypted_standard 有一個超出邊界記憶體讀取瑕疵。發生此問題的原因是 memcpy 長度存在整數反向溢位弱點，這會導致拒絕服務。(CVE-2024-0565)

  - 在使用者使用 IORING_REGISTER_PBUF_RING 註冊緩衝區環、對其進行 mmap() 操作並釋放時，在 Linux 核心的 io_uring 功能中發現一個記憶體洩漏瑕疵。本機使用者可利用此缺陷造成系統當機，或可能提升自己的系統權限。(CVE-2024-0582)

  - 在 Linux 核心的 TIPC 子系統中，在 net/tipc/crypto.c 的 tipc_crypto_key_revoke 中發現一個拒絕服務弱點。此瑕疵允許具有本機使用者權限的來賓觸發鎖死，並可能造成系統當機。(CVE-2024-0641)

  - 當使用者呼叫以 ktls 通訊端作為目標的 splice 函式時，Linux 核心的傳輸層安全性功能中存在一個超出邊界記憶體寫入瑕疵。本機使用者可利用此缺陷造成系統當機，或可能提升自己的系統權限。(CVE-2024-0646)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名稱	產品	系列	已發布	已更新	嚴重性
198188	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-1741)	Nessus	Huawei Local Security Checks	2024/5/30	2024/6/4	high
190941	Ubuntu 23.10 : Linux kernel (Azure) vulnerabilities (USN-6652-1)	Nessus	Ubuntu Local Security Checks	2024/2/23	2024/8/27	high
190627	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:0514-1)	Nessus	SuSE Local Security Checks	2024/2/17	2024/5/30	high
203657	Photon OS 5.0: Linux PHSA-2023-5.0-0130	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/11/27	high
190122	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6626-1)	Nessus	Ubuntu Local Security Checks	2024/2/8	2024/8/27	high
184420	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-422)	Nessus	Amazon Linux Local Security Checks	2023/11/4	2024/12/11	high
190122	Ubuntu 20.04 LTS / 22.04 LTS：Linux 内核漏洞 (USN-6626-1)	Nessus	Ubuntu Local Security Checks	2024/2/8	2024/8/27	high
184420	Amazon Linux 2023：bpftool、kernel、kernel-devel (ALAS2023-2023-422)	Nessus	Amazon Linux Local Security Checks	2023/11/4	2024/12/11	high
190941	Ubuntu 23.10：Linux kernel (Azure) 漏洞 (USN-6652-1)	Nessus	Ubuntu Local Security Checks	2024/2/23	2024/8/27	high
184420	Amazon Linux 2023：bpftool、kernel、kernel-devel (ALAS2023-2023-422)	Nessus	Amazon Linux Local Security Checks	2023/11/4	2024/12/11	high
190122	Ubuntu 20.04 LTS / 22.04 LTS：Linux 核心弱點 (USN-6626-1)	Nessus	Ubuntu Local Security Checks	2024/2/8	2024/8/27	high
190941	Ubuntu 23.10：Linux 核心 (Azure) 弱點 (USN-6652-1)	Nessus	Ubuntu Local Security Checks	2024/2/23	2024/8/27	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high