The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1402-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-28356: Fixed a refcount bug in llc_ui_bind and llc_ui_autobind which could allow an     unprivileged user to execute a DoS. (bnc#1197391)
    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel.
    (bnc#1198033)
    - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel.
    (bnc#1198032)
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel.
    (bnc#1198031)
    - CVE-2022-0812: Fixed an incorrect header size calculations which could lead to a memory leak.
    (bsc#1196639)
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock. (bsc#1197331)
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
    - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive     information from the memory via crafted frame lengths from a USB device. (bsc#1196836)
    - CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw     allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a     local privilege escalation. (bnc#1197462)
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file. (bnc#1197366)
    - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-     after-free. (bnc#1196973)
    -     CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042:
    Fixed multiple issues which could have lead to read/write access to memory pages or denial of service.
    These issues are related to the Xen PV device frontend drivers. (bsc#1196488)
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory. (bsc#1196830)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5541-1 advisory.

    Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not     perform permission checks correctly in some situations. A local attacker could possibly use this to gain     administrative privileges. (CVE-2021-4197)

    Jann Horn discovered that the FUSE file system in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2022-1011)

    Duoming Zhou discovered that the 6pack protocol implementation in the Linux kernel did not handle detach     events properly in some situations, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1198)

    Duoming Zhou discovered that the AX.25 amateur radio protocol implementation in the Linux kernel did not     handle detach events properly in some situations. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2022-1199)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel during device detach operations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2022-1204)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the PF_KEYv2 implementation in the Linux kernel did not properly initialize kernel     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-1353)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly     handle very small reads. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-2380)

    It was discovered that the 8 Devices USB2CAN interface implementation in the Linux kernel did not properly     handle certain error conditions, leading to a double-free. A local attacker could possibly use this to     cause a denial of service (system crash). (CVE-2022-28388)

    It was discovered that the Microchip CAN BUS Analyzer interface implementation in the Linux kernel did not     properly handle certain error conditions, leading to a double-free. A local attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-28389)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2727-1 advisory.

    This update for the Linux Kernel 5.3.18-150300_59_60 fixes several issues.

    The following security issues were fixed:

    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel.
    (bnc#1198033)
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel     (bnc#1198031).
    - CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker     to escalate privileges (bnc#1201171).
    - CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the     ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
    - CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu()     (bsc#1200604).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2770-1 advisory.

    This update for the Linux Kernel 5.3.18-59_19 fixes several issues.

    The following security issues were fixed:

    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel.
    (bnc#1198033)
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory. (bsc#1196830)
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel     (bnc#1198031).
    - CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker     to escalate privileges (bnc#1201171).
    - CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the     ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
    - CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu()     (bsc#1200604).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2738-1 advisory.

    This update for the Linux Kernel 5.3.18-59_40 fixes several issues.

    The following security issues were fixed:

    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel.
    (bnc#1198033)
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory. (bsc#1196830)
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel     (bnc#1198031).
    - CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker     to escalate privileges (bnc#1201171).
    - CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the     ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
    - CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu()     (bsc#1200604).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
160223	SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:1402-1)	Nessus	SuSE Local Security Checks	2022/4/27	2026/6/26	high
163545	Ubuntu 16.04 ESM : Linux kernel (Azure) vulnerabilities (USN-5541-1)	Nessus	Ubuntu Local Security Checks	2022/7/29	2024/8/28	high
164002	SUSE SLES15 Security Update : kernel (Live Patch 16 for SLE 15 SP3) (SUSE-SU-2022:2727-1)	Nessus	SuSE Local Security Checks	2022/8/10	2026/6/25	high
164055	SUSE SLES15: kernel-livepatch-5_3_18-59_19-default / etc (SUSE-SU-2022:2770-1)	Nessus	SuSE Local Security Checks	2022/8/11	2026/6/25	high
164067	SUSE SLES15 Security Update : kernel (Live Patch 11 for SLE 15 SP3) (SUSE-SU-2022:2738-1)	Nessus	SuSE Local Security Checks	2022/8/11	2026/6/25	high

偵測

搜尋 Plugin

high

high

high

high

high