远程 OracleVM 系统缺少解决关键安全更新的必要补丁：

  - 在 Linux 内核 5.18.9 及之前的版本中发现问题。本地攻击者可利用 nft_set_elem_init 中的类型混淆缺陷（可导致缓冲区溢出）来提升权限，此漏洞与 CVE-2022-32250 不同。（攻击者可获得根访问权限，但必须以非特权用户命名空间开头才能获取 CAP_NET_ADMIN 访问权限。）此问题可在 net/netfilter/nf_tables_api.c 的 nft_setelem_parse_data 中修复。(CVE-2022-34918)

  - 在 Unbreakable Enterprise 内核 (UEK) 中，UEK 的 RDS 模块中有两个不可重新进入的 setsockopt(2) 选项：RDS_CONN_RESET 和 RDS6_CONN_RESET。具有 CAP_NET_ADMIN 的恶意本地用户可利用此问题造成内核崩溃。(CVE-2023-22024)

  - Linux 内核的 ext4 文件系统在处理扩展属性的额外 inode 大小时，会产生释放后使用漏洞。具有权限的本地用户可利用此漏洞造成系统崩溃或其他未不明行为。(CVE-2023-2513)

  - Linux 内核 nftables 越界读取/写入漏洞；当 CAP_NET_ADMIN 位于任何用户或网络命名空间时，nft_byteorder 未妥善处理 vm 寄存器内容 (CVE-2023-35001)

  - Linux 内核的 net/sched: sch_qfq 组件中存在越界写入漏洞，攻击者可利用此漏洞提升本地特权。net/sched/sch_qfq.c 中的 qfq_change_agg() 函数允许越界写入，这是因为 lmax 会根据数据包大小在无边界检查的情况下更新。建议升级过去的 commit 3e337087c3b5805fe0b8a46ba622a962880b5d64。(CVE-2023-3611)

  - 在 Linux 内核的用于转换数据包的 IP 框架（XFRM 子系统）中发现一个缺陷。此问题可能允许具有 CAP_NET_ADMIN 权限的恶意用户直接取消引用 xfrm_update_ae_params() 中的空指针，从而可能导致内核崩溃和拒绝服务。(CVE-2023-3772)

  - Linux 内核的 net/sched: cls_fw 组件中存在释放后使用漏洞，攻击者可利用此漏洞提升本地特权。如果 tcf_change_indev() 失败，fw_set_parms() 将在增加或减少 tcf_bind_filter() 中的引用计数器之后立即返回错误。如果攻击者可以控制引用计数器并将其设置为零，则可导致引用被释放，从而造成释放后使用漏洞。建议升级过去的 commit 0323bce598eea038714f941ce2b22541c46d488f。
    (CVE-2023-3776)

  - Linux 内核的 net/sched: 攻击者可利用 cls_route 组件中的漏洞提升本地特权。当在现有过滤器中调用 route4_change() 时，整个 tcf_result 结构会一律复制到过滤器的新实例中。更新绑定到类的过滤器时会引发一个问题，因为 tcf_unbind_filter() 一律会在成功路径中的旧实例上调用，从而减少仍在引用的类的 filter_cnt 并允许用户将其删除，造成释放后使用情形。我们建议升级过去的提交 b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8。
    (CVE-2023-4206)

  - 在 Linux 内核的 VMware vmxnet3 以太网 NIC 驱动程序中，发现 drivers/net/vmxnet3/vmxnet3_drv.c 的 vmxnet3_rq_alloc_rx_buf 中存在释放后使用缺陷。本地攻击者可能会利用此缺陷，在清理 vmxnet3_rq_cleanup_all 时，导致系统因双重释放而崩溃，这还有可能导致内核信息泄漏问题。(CVE-2023-4387)

  - 在 Linux 内核的 vmxnet3 网络子组件中，发现 drivers/net/vmxnet3/vmxnet3_drv.c 的 vmxnet3_rq_cleanup 中存在空指针取消引用缺陷。由于清理期间缺少健全性检查，具有普通用户权限的本地攻击者可利用此问题造成拒绝服务。
    (CVE-2023-4459)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的内核版本低于 5.15.69-37.134。因此，会受到 ALAS2KERNEL-5.15-2022-008 公告中提及的多个漏洞影响。

    在 Linux 内核中，以下漏洞已修复：

    i2c：修复潜在的释放后使用漏洞

    仅在使用完 adap 结构后才将其释放。此修补程序只是稍微将 put_device() 下移，以避免释放后使用。

    [wsa：已添加注释到代码、添加了 Fixes 标签] (CVE-2019-25162)

    在用户强制 ath9k_htc_wait_for_target 函数因某些输入消息而失败的方式中，在 Linux 内核的 Atheros 无线适配器驱动程序中发现了一个释放后使用缺陷。本地用户可利用此缺陷导致系统崩溃或可能升级其系统权限。(CVE-2022-1679)

    在用户在程序的非前导线程中创建定时器然后将其删除的方法中，在 Linux 内核的 POSIX CPU 定时器功能中发现了释放后使用缺陷。本地用户可利用此缺陷导致系统崩溃或可能升级其系统权限。(CVE-2022-2585)

    发现了 nft 对象或表达式可引用不同 nft 表上的 nft 集，导致表被删除后发生释放后使用漏洞。(CVE-2022-2586)

    在 Linux 内核的 net/sched/cls_route.c 过滤器实现的 route4_change 中发现了一个释放后使用缺陷。本地用户可以利用此缺陷造成系统崩溃，并可能提升本地权限。(CVE-2022-2588)

    如果在某些 Intel(R) 处理器的上下文间不透明地共享返回预测器目标，这可能会让授权用户通过本地访问实现信息披露。(CVE-2022-26373)

    在 Linux 内核的 nf_conntrack_irc 中发现了一个问题，其中消息处理可能混淆并且未正确匹配消息。当用户使用配置有 nf_conntrack_irc 的未加密 IRC 时，可能会绕过防火墙。(CVE-2022-2663)

    在用户使用大于映射的 max_entries 的密钥调用 bpf_tail_call 函数的方式中，在 Linux 内核的 BPF 子系统中发现了一个越界内存读取缺陷。本地用户可利用此缺陷，在未经授权的情况下获取某些数据。(CVE-2022-2905)

    当同时发生多个 xfrm_probe_algs 调用时，发现 Linux 内核中用于转换数据包的 IP 框架（XFRM 子系统）存在争用情形。此缺陷让本地攻击者可通过执行越界读取并将其复制到套接字中来触发越界写入，或泄漏内核堆内存。(CVE-2022-3028)

    在 Linux 内核的 io_uring 中发现了一个释放后使用缺陷。由于缺少 io_uring POLLFREE 处理，如果使用 io_uring 轮询来轮询 signalfd 或 binder fd，则本地用户可以利用此缺陷触发问题。(CVE-2022-3176)

    在 Linux 内核声音子系统中发现了一个因不当锁定而导致的争用情形缺陷。这个缺陷可在处理 SNDCTL_DSP_SYNC ioctl 时导致空指针取消引用。本地特权用户（root 用户或“audio”群组成员）可利用此缺陷导致系统崩溃，从而发起拒绝服务攻击。(CVE-2022-3303)

    在 Linux 内核中发现一个漏洞。已将此漏洞归类为“危急”。这会影响组件 IPsec 的文件 net/core/devlink.c 的函数 devlink_param_set/devlink_param_get。操纵此漏洞可导致释放后使用。建议应用补丁修复此问题。此漏洞获派的标识符为 VDB-211929。(CVE-2022-3625)

    在 Linux 内核 5.19 之前版本的 include/asm-generic/tlb.h 中发现了一个问题。由于存在争用情形（unmap_mapping_range 与 munmap），设备驱动程序可在页面仍有过时 TLB 条目时将其释放。只有在使用 VM_PFNMAP VMA 的情况下，才会发生此问题。(CVE-2022-39188)

    在 Linux 内核中，arch/x86/kvm/x86.c 内 kvm_steal_time_set_preempted 的 x86 KVM 子系统中发现了一个缺陷。非特权客户机用户可危害客户机内核，因为在某些 KVM_VCPU_PREEMPTED 情况下未正确处理 TLB 刷新操作。 (CVE-2022-39189)

    在版本低于 5.19.6 的 Linux 内核的 net/netfilter/nf_tables_api.c 中发现了一个问题。绑定到已绑定的链时可发生拒绝服务。(CVE-2022-39190)

    发现 Linux 内核的 EFI capsule 加载程序驱动程序在 EFI capsule 的设备节点上处理写入和刷新操作的方式中存在争用情形。本地用户可能会利用此缺陷导致系统崩溃。(CVE-2022-40307)

    在 Linux 内核中，以下漏洞已修复：

    IB/core：修复 ODP 流中的嵌套死锁 (CVE-2022-48675)

    在 Linux 内核中，以下漏洞已修复：

    nvme-tcp：修复检测摘要错误时的 UAF(CVE-2022-48686)

    在 Linux 内核中，以下漏洞已修复：ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    在 Linux 内核中，以下漏洞已修复：

    tcpTX zerocopy 不应感知 pfmemalloc 状态 (CVE-2022-48689)

    在 Linux 内核中，以下漏洞已修复：

    netfilter：nf_tables：卸载标记检查失败时清理挂钩列表 (CVE-2022-48691)

    在 Linux 内核中，以下漏洞已修复：

    scsi：mpt3sas：修复释放后使用警告 (CVE-2022-48695)

    在 Linux 内核中，以下漏洞已修复：

    sched/debug：修复 update_sched_domain_debugfs 中的 dentry 泄漏 (CVE-2022-48699)

    在 Linux 内核中，以下漏洞已修复：

    vfio/type1：取消固定零页面 (CVE-2022-48700)

    在 Linux 内核中，以下漏洞已修复：

    USBcore阻止嵌套的设备重置调用 (CVE-2022-49936)

    在 Linux 内核中，以下漏洞已修复：

    cifs修复 SMB2_negotiate() 中的小型内存池泄漏 (CVE-2022-49938)

    在 Linux 内核中，以下漏洞已修复：

    vt更改字体之前清除选择 (CVE-2022-49948)

    在 Linux 内核中，以下漏洞已修复：

    arm64cacheinfo修复将已签名的错误值不正确分配给未签名的 fw_level (CVE-2022-49964)

    在 Linux 内核中，以下漏洞已修复：

    ftrace：修复当 ftrace 无效时 is_ftrace_trampoline 中的空指针取消引用 (CVE-2022-49977)

    在 Linux 内核中，以下漏洞已修复：

    net修复 sk_psock_get 中的 refcount 缺陷 (2) (CVE-2022-49979)

    在 Linux 内核中，以下漏洞已修复：

    HIDhidraw修复 hidraw_release() 中的内存泄漏 (CVE-2022-49981)

    在 Linux 内核中，以下漏洞已修复：

    HIDsteam防止 stream_{recv,send}_report 中的空指针取消引用 (CVE-2022-49984)

    在 Linux 内核中，以下漏洞已修复：

    bpf不在 poke 描述符的数组范围检查中使用 tnum_range (CVE-2022-49985)

    在 Linux 内核中，以下漏洞已修复：

    scsistorvsc从 storvsc_error_wq 删除 WQ_MEM_RECLAIM (CVE-2022-49986)

    在 Linux 内核中，以下漏洞已修复：

    md：在 md_stop 中调用 __md_stop_writes (CVE-2022-49987)

    在 Linux 内核中，以下漏洞已修复：

    xen/privcmd修复 privcmd_ioctl_dm_op() 的错误退出 (CVE-2022-49989)

    在 Linux 内核中，以下漏洞已修复：

    mm/hugetlb避免损坏 hugetlb_mcopy_atomic_pte 中的 page->mapping (CVE-2022-49991)

    在 Linux 内核中，以下漏洞已修复：

    loop：配置循环时检查溢出 (CVE-2022-49993)

    在 Linux 内核中，以下漏洞已修复：

    bootmem在 put_page_bootmem 中从 kmemleak 删除 vmemmap 页面 (CVE-2022-49994)

    在 Linux 内核中，以下漏洞已修复：

    writeback避免删除设备后的释放后使用 (CVE-2022-49995)

    在 Linux 内核中，以下漏洞已修复：

    btrfs修复 btrfs_get_dev_args_from_path() 中可能的内存泄漏 (CVE-2022-49996)

    在 Linux 内核中，以下漏洞已修复：

    rxrpc修复 rxrpc 的 sendmsg 中的锁定 (CVE-2022-49998)

    在 Linux 内核中，以下漏洞已修复：

    btrfs修复空间缓存损坏和潜在的双重分配 (CVE-2022-49999)

    在 Linux 内核中，以下漏洞已修复：

    netfilterflowtable修复因待定工作而造成的清理时卡住的流 (CVE-2022-50000)

    在 Linux 内核中，以下漏洞已修复：

    xfrmpolicy修复元数据 dst->dev xmit 空指针取消引用 (CVE-2022-50004)

    在 Linux 内核中，以下漏洞已修复：

    kprobes：不要为禁用的 kprobes 调用 disarm_kprobe() (CVE-2022-50008)

    在 Linux 内核中，以下漏洞已修复：

    drivers:md修复潜在的释放后使用缺陷 (CVE-2022-50022)

    在 Linux 内核中，以下漏洞已修复：

    netgenl修复策略转储中的错误路径内存泄漏 (CVE-2022-50042)

    在 Linux 内核中，以下漏洞已修复：

    net修复 ndisc_router_discovery() 中潜在的 refcount 泄漏 (CVE-2022-50043)

    在 Linux 内核中，以下漏洞已修复：

    netfilternf_tables错误路径中可能的模块引用下溢 (CVE-2022-50048)

    在 Linux 内核中，以下漏洞已修复：

    fs/ntfs3修复 ntfs_read_mft 中缺少的 i_op (CVE-2022-50056)

    在 Linux 内核中，以下漏洞已修复：

    fs/ntfs3修复 ntfs_update_mftmirr 中的空取消引用 (CVE-2022-50057)

    在 Linux 内核中，以下漏洞已修复：

    ceph不泄漏 handle_cap_grant 中的 snap_rwsem (CVE-2022-50059)

    在 Linux 内核中，以下漏洞已修复：

    virtio_net修复含 mergeable 的 XPD_TX 中的内存泄漏 (CVE-2022-50065)

    在 Linux 内核中，以下漏洞已修复：

    btrfs如果事务提交在 prepare_to_relocate() 中失败则未设置重定位控制 (CVE-2022-50067)

    在 Linux 内核中，以下漏洞已修复：

    drm/ttm修复虚拟的 res 空指针取消引用缺陷CVE-2022-50068

    在 Linux 内核中，以下漏洞已修复：

    BPF修复 bpf_sys_bpf() 中可能的错误指针取消引用 (CVE-2022-50069)

    在 Linux 内核中，以下漏洞已修复：

    NFSv4/pnfs修复 open 中的一个释放后使用缺陷 (CVE-2022-50072)

    在 Linux 内核中，以下漏洞已修复：

    tracing/eprobes使事件探测与 kprobes 和 uprobes 一致 (CVE-2022-50075)

    在 Linux 内核中，以下漏洞已修复：

    cifs修复延迟关闭的内存泄漏 (CVE-2022-50076)

    在 Linux 内核中，以下漏洞已修复：

    tracing/eprobes不允许 eprobes 将 $stack或 % 用于 reg(CVE-2022-50078)

    在 Linux 内核中，以下漏洞已修复：

    ext4修复 ext4_iomap_begin 中因 bmap 和 write 之间的争用而出现的警告 (CVE-2022-50082)

    在 Linux 内核中，以下漏洞已修复：

    ext4：在 xattr.h 中添加 EXT4_INODE_HAS_XATTR_SPACE 宏 (CVE-2022-50083)

    在 Linux 内核中，以下漏洞已修复：

    dm raid修复 raid_status 中的地址审查器警告 (CVE-2022-50084)

    在 Linux 内核中，以下漏洞已修复：

    dm raid修复 raid_resume 中的地址审查器警告 (CVE-2022-50085)

    在 Linux 内核中，以下漏洞已修复：

    block不允许同一类型的 rq_qos 添加一次以上 (CVE-2022-50086)

    在 Linux 内核中，以下漏洞已修复：

    firmwarearm_scpi确保探测失败时不分配 scpi_info (CVE-2022-50087)

    在 Linux 内核中，以下漏洞已修复：

    locking/csd_lock将 csdlock_debug 从 early_param 更改为 __setup (CVE-2022-50091)

    在 Linux 内核中，以下漏洞已修复：

    dm Thin修复 dm_sm_register_threshold_callback 中的释放后使用崩溃 (CVE-2022-50092)

    在 Linux 内核中，以下漏洞已修复：

    x86/kprobes单步执行后更新 kcb 状态标记 (CVE-2022-50096)

    在 Linux 内核中，以下漏洞已修复：

    video：fbdev：s3fb：在 memset_io() 前检查屏幕大小 (CVE-2022-50097)

    在 Linux 内核中，以下漏洞已修复：

    sched/core不重新排队 cpus_mask 中排除的 CPU 上的任务 (CVE-2022-50100)

    在 Linux 内核中，以下漏洞已修复：

    schedcpuset修复因空 cs->cpus_allowed 而导致的 dl_cpu_busy() 错误 (CVE-2022-50103)

    在 Linux 内核中，以下漏洞已修复：

    jbd2：修复日志中止时断言“jh->b_frozen_data == NULL”失败 (CVE-2022-50126)

    在 Linux 内核中，以下漏洞已修复：

    RDMA/irdma修复释放后使用的窗口 (CVE-2022-50137)

    在 Linux 内核中，以下漏洞已修复：

    RDMA/qedr修复 __qedr_alloc_mr() 中潜在的内存泄漏 (CVE-2022-50138)

    在 Linux 内核中，以下漏洞已修复：

    mm/mempolicy修复 get_nodes 越界访问 (CVE-2022-50147)

    在 Linux 内核中，以下漏洞已修复：

    driver 核心修复 __driver_attach 中可能的死锁 (CVE-2022-50149)

    在 Linux 内核中，以下漏洞已修复：

    usbhost修复 ehci_hcd_ppc_of_probe 中的 refcount 泄漏 (CVE-2022-50153)

    在 Linux 内核中，以下漏洞已修复：

    of根据内存边界检查之前内核的 ima-kexec-bufferCVE-2022-50159

    在 Linux 内核中，以下漏洞已修复：

    selinux：添加 put_entry() 中的边界检查 (CVE-2022-50200)

    在 Linux 内核中，以下漏洞已修复：

    PM：休眠：从休眠恢复时推迟设备探测 (CVE-2022-50202)

    在 Linux 内核中，以下漏洞已修复：

    ext2：为 inode 计数添加更多有效性检查 (CVE-2022-50205)

    在 Linux 内核中，以下漏洞已修复：

    arm64修复并发设置 insn_emulation sysctls 中的 oops (CVE-2022-50206)

    在 Linux 内核中，以下漏洞已修复：

    md-raid10：修复 KASAN 警告 (CVE-2022-50211)

    在 Linux 内核中，以下漏洞已修复：

    netfilter: nf_tables不允许 CHAIN_ID 引用其他表 (CVE-2022-50212)

    在 Linux 内核中，以下漏洞已修复：

    netfilter: nf_tables不允许 SET_ID 引用其他表 (CVE-2022-50213)

    在 Linux 内核中，以下漏洞已修复：

    scsisg允许等待命令在已删除的设备上完成 (CVE-2022-50215)

    在 Linux 内核中，以下漏洞已修复：

    bpf修复 compute_effect_progs 读取中的 KASAN 释放后使用 (CVE-2022-50219)

    在 Linux 内核中，以下漏洞已修复：

    ttyvt初始化 unicode 屏幕缓冲区 (CVE-2022-50222)

    在 Linux 内核中，以下漏洞已修复：

    KVM：SVM：如果用户空间使用 GIF=0 注入中断，则不会出现缺陷 (CVE-2022-50228)

    在 Linux 内核中，以下漏洞已修复：

    arm64在交换器页表上设置 UXN (CVE-2022-50230)

    在 Linux 内核中，以下漏洞已修复：

    cryptoarm64/poly1305 - 修复读取越界 (CVE-2022-50231)

    在 Linux 内核中，以下漏洞已修复：

    arm64在交换器页表上设置 UXN (CVE-2022-50232)

    - 在 nf_tables_updtable 中，如果 nf_tables_table_enable 返回错误，则会调用 nft_trans_destroy 以释放事务对象。nft_trans_destroy() 调用 list_del()，但事务从未放置在列表中
    -- 列表头全部为零，这将导致空指针取消引用。(CVE-2023-1095)

    在 Linux 内核的 netdevsim 设备驱动程序的事件调度中发现了一个缺陷。此问题源于不当管理引用计数。攻击者可能会利用此缺陷，在系统上造成拒绝服务情况。(CVE-2023-2019)

    Linux 内核的 ext4 文件系统在处理扩展属性的额外 inode 大小时，会产生释放后使用漏洞。本地特权用户可利用此漏洞造成系统崩溃或其他未不明行为。(CVE-2023-2513)

    上游公告对此问题的描述如下：

    本地攻击者可以利用此漏洞，在受影响的 Linux 内核安装程序上公开敏感信息。如要利用此漏洞，攻击者必须首先具备在目标系统上执行高权限代码的能力。

    此缺陷具体存在于 seg6 属性的处理进程中。此问题之所以存在，是未正确验证用户提供的数据所致，这可导致读取范围超过所分配缓冲区的末尾。
    攻击者可利用此漏洞以及其他漏洞在内核环境中提升权限并执行任意代码。(CVE-2023-2860)

    在 Linux 内核的 btrfs 内，在 fs/btrfs/relocation.c 中的 prepare_to_relocate 内发现了一个释放后使用漏洞。通过在调用 btrfs_ioctl_defrag() 之前调用 btrfs_ioctl_balance()，可触发此潜在缺陷。(CVE-2023-3111)

    在 Linux 内核的 btrfs file-system 中，fs/btrfs/volumes.c 内的 btrfs_get_dev_args_from_path 中发现释放后使用缺陷。具有特权的本地攻击者可利用此缺陷造成系统崩溃或泄露内部核心信息。(CVE-2023-4394)

    在 Linux 内核版本中发现了一个释放后使用缺陷。磁盘删除后，系统会调用 bdi_unregister 以停止进一步的回写，并等待相关延迟的工作完成。但是，wb_inode_writeback_end() 可能会将带宽估计工作安排在完成之后，这样会导致定时器尝试访问最近释放的 bdi_writeback。(CVE-2024-0562)

Tenable 已直接从测试产品的安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2023:6901 公告中提及的多个漏洞的影响。

    kernel-rt 程序包提供 Real Time Linux Kernel，支持对具有极高确定性要求的系统进行微调。

    安全修复：

    * kernel: tuntun_free_netdev 中的双重释放 (CVE-2022-4744)

    * kernelnet/schedcls_u32 组件引用计数器泄漏 (CVE-2023-3609)

    * kernelnet/schedsch_qfq 漏洞 (CVE-2023-3611)

    * kernel: net/schednet/sched 分类器cls_fw、cls_u32 和 cls_route 中存在释放后使用漏洞CVE-2023-4128、 CVE-2023-4206、 CVE-2023-4207、 CVE-2023-4208

    * kernel：qfq_change_class 函数中存在越界写入问题 (CVE-2023-31436)

    * 内核hw_atl_utils_fw_rpc_wait 中存在越界写入 (CVE-2021-43975)

    * 内核intr_callback 中 r8152 中的速率限制溢出消息 (CVE-2022-3594)

    * 内核l2cap_conn_del 和 l2cap_parse_conf_req 中的释放后使用与信息泄漏CVE-2022-3640、 CVE-2022-42895]

    * 内核usb_8dev_start_xmit 中的双重释放 (CVE-2022-28388)

    * kernel: vmwgfx多个漏洞CVE-2022-38457、 CVE-2022-40133、 CVE-2023-33951、 CVE-2023-33952]

    * hw: Intel收集数据采样 (GDS) 边信道漏洞 (CVE-2022-40982)

    * kernel: KVM多个漏洞CVE-2022-45869、 CVE-2023-4155、 CVE-2023-30456]

    * 内核ttusb_dec_exit_dvb 中的内存泄漏 (CVE-2022-45887)

    * 内核kernel/sys.c 内 do_prlimit 中的推测指针取消引用 (CVE-2023-0458)

    * kernelqdisc_graft 中的释放后使用 (CVE-2023-0590)

    - 内核：x86/mm：随机化 per-cpu 条目区域 (CVE-2023-0597)

    * 内核HID检查 hid_validate_values 中的空 report_list (CVE-2023-1073)

    * kernelsctp如果没有边界地址可用于给定范围则失败 (CVE-2023-1074)

    * kernel: hidasus_remove 中的释放后使用 (CVE-2023-1079)

    * kerneldrivers/media/rc/ene_ir.c 中的释放后使用 (CVE-2023-1118)

    * 内核IPv6 连接查找表中的哈希冲突 (CVE-2023-1206)

    * kernel：ovl：修复 ovl_aio_req 结构中的释放后使用 (CVE-2023-1252)

    * 内核tipc_conn_close 中的拒绝服务 (CVE-2023-1382)

    * 内核btsdio_remove 中的释放后使用缺陷 (CVE-2023-1989)

    * 内核：Spectre v2 SMT 缓解措施问题 (CVE-2023-1998)

    * kernel: ext4ext4_xattr_set_entry 中的释放后使用 (CVE-2023-2513)

    * kernelfbconfbcon_set_font 中的位移越界 (CVE-2023-3161)

    * 内核relay_file_read 中的越界访问 (CVE-2023-3268)

    * kernel: xfrmxfrm_update_ae_params 中空指针取消引用 (CVE-2023-3772)

    * kernel: smsusbdo_submit_urb 造成的释放后使用 (CVE-2023-4132)

    * 内核迁移页面的任务与调用 exit_mmap 以释放相同页面的其他任务之间的争用在 include/linux/swapops.h 中获得无效的 opcode 缺陷CVE-2023-4732

    * 内核atm_tc_enqueue 中的拒绝服务 (CVE-2023-23455)

    * kernel：mpls：sysctl 分配时的双重释放失败 (CVE-2023-26545)

    * 内核az6027 驱动程序中的拒绝服务问题 (CVE-2023-28328)

    * kernellib/seq_buf.c 存在 seq_buf_putmem_hex 缓冲区溢出 (CVE-2023-28772)

    * 内核dvb_frontend_get_event 和 wait_event_interruptible 中的阻断操作 (CVE-2023-31084)

    * kernel: netqcom/emac争用条件导致 emac_remove 中释放后使用 (CVE-2023-33203)

    * 内核saa7134saa7134_finidev 中的争用条件 (CVE-2023-35823)

    * kernel: dm1105dm1105_remove.c 中的争用条件 (CVE-2023-35824)

    * kernel: r592r592_remove 中的争用条件CVE-2023-35825

    * kernel: net/tlstls_is_tx_ready 检查了 list_entry (CVE-2023-1075)

    * kernel：删除函数 xgene_hwmon_remove 中的释放后使用缺陷 (CVE-2023-1855)

    * 内核r592_remove 中的释放后使用 (CVE-2023-3141)

    * kernel: gfs2gfs2_evict_inode 中的空指针取消引用 (CVE-2023-3212)

    有关此安全问题的详细信息请参阅列于“参考”部分的 CVE 页面。

    其他变更：

    如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 8.9 版本说明。

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2023:7077 公告中提及的多个漏洞的影响。

    内核程序包中包含 Linux 内核，后者是任何 Linux 操作系统的核心。

    安全修复：

    * kernel: tun避免 tun_free_netdev 中的双重释放 (CVE-2022-4744)

    * kernel: net/sched多个漏洞CVE-2023-3609、 CVE-2023-3611、 CVE-2023-4128、 CVE-2023-4206、 CVE-2023-4207、 CVE-2023-4208)

    * kernel：qfq_change_class 函数中存在越界写入问题 (CVE-2023-31436)

    * 内核hw_atl_utils_fw_rpc_wait 中存在越界写入 (CVE-2021-43975)

    * 内核intr_callback 中 r8152 中的速率限制溢出消息 (CVE-2022-3594)

    * 内核l2cap_conn_del 中的释放后使用缺陷 (CVE-2022-3640)

    * 内核usb_8dev_start_xmit 中的双重释放 (CVE-2022-28388)

    * kernel: vmwgfx多个漏洞CVE-2022-38457、 CVE-2022-40133、 CVE-2023-33951、 CVE-2023-33952]

    * hw: Intel收集数据采样 (GDS) 边信道漏洞 (CVE-2022-40982)

    * 内核l2cap_parse_conf_req 中的信息泄漏 (CVE-2022-42895)

    * kernel: KVM多个漏洞CVE-2022-45869、 CVE-2023-4155、 CVE-2023-30456]

    * 内核ttusb_dec_exit_dvb 中的内存泄漏 (CVE-2022-45887)

    * 内核do_prlimit 中的推测指针取消引用 (CVE-2023-0458)

    * 内核由于 qdisc_graft 中的争用条件导致的释放后使用 (CVE-2023-0590)

    - 内核：x86/mm：随机化 per-cpu 条目区域 (CVE-2023-0597)

    * 内核HID检查 hid_validate_values 中的空 report_list (CVE-2023-1073)

    * kernelsctp如果没有边界地址可用于给定范围则失败 (CVE-2023-1074)

    * kernel: hidasus_remove 中的释放后使用 (CVE-2023-1079)

    * kerneldrivers/media/rc/ene_ir.c 中的释放后使用 (CVE-2023-1118)

    * 内核IPv6 连接查找表中的哈希冲突 (CVE-2023-1206)

    * kernel：ovl：修复 ovl_aio_req 结构中的释放后使用 (CVE-2023-1252)

    * 内核tipc_conn_close 中的拒绝服务 (CVE-2023-1382)

    * kernel：由于争用条件，btsdio_remove 中存在释放后使用 (CVE-2023-1989)

    * 内核：Spectre v2 SMT 缓解措施问题 (CVE-2023-1998)

    * kernel: ext4ext4_xattr_set_entry 中的释放后使用 (CVE-2023-2513)

    * kernelfbconfbcon_set_font 中的位移越界 (CVE-2023-3161)

    * 内核relay_file_read 中的越界访问 (CVE-2023-3268)

    * kernel: xfrmxfrm_update_ae_params 中空指针取消引用 (CVE-2023-3772)

    * kernel: smsusbdo_submit_urb 造成的释放后使用 (CVE-2023-4132)

    * kernel迁移页面的任务与调用 exit_mmap 的其他任务之间的争用 (CVE-2023-4732)

    * 内核atm_tc_enqueue 中因类型混淆造成拒绝服务 (CVE-2023-23455)

    * kernel：mpls：sysctl 分配时的双重释放失败 (CVE-2023-26545)

    * 内核az6027 驱动程序中的拒绝服务问题 (CVE-2023-28328)

    * kernellib/seq_buf.c 存在 seq_buf_putmem_hex 缓冲区溢出 (CVE-2023-28772)

    * 内核dvb_frontend_get_event 和 wait_event_interruptible 中的阻断操作 (CVE-2023-31084)

    * kernel: netqcom/emac争用条件导致 emac_remove 中释放后使用 (CVE-2023-33203)

    * kernelsaa7134争用条件导致 saa7134_finidev 中的释放后使用 (CVE-2023-35823)

    * kernel: dm1105争用条件导致 dm1105_remove.c 中的释放后使用 (CVE-2023-35824)

    * kernelr592争用条件导致 r592_remove 中的释放后使用 (CVE-2023-35825)

    * kernel：net/tls：tls_is_tx_ready() 检查了 list_entry (CVE-2023-1075)

    * kernel：删除函数 xgene_hwmon_remove 中的释放后使用缺陷 (CVE-2023-1855)

    * kernel：r592_remove 中的释放后使用缺陷 (CVE-2023-3141)

    * kernel: gfs2gfs2_evict_inode 中的空指针取消引用 (CVE-2023-3212)

    有关上述安全问题的更多详细信息，包括其影响、CVSS 得分、致谢，以及其他相关信息，请参阅列于“参考”部分的 CVE 页面。

    其他变更：

    如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 8.9 版本说明。

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2025:15649 公告中提及的多个漏洞的影响。

    内核程序包中包含 Linux 内核，后者是任何 Linux 操作系统的核心。

    安全修复：

    * 内核ext4ext4_xattr_set_entry() 中的释放后使用 (CVE-2023-2513)

    * 内核：wifi：rtw88：修复“para”缓冲区大小以避免读取越界 (CVE-2025-38159)

    * kernel：scsi：lpfc：使用 memcpy() 处理 BIOS 版本 (CVE-2025-38332)

    * kernel: posix-cpu-timers修复 handle_posix_cpu_timers() 和 posix_cpu_timer_del() 之间的争用CVE-2025-38352]

    有关上述安全问题的更多详细信息，包括其影响、CVSS 得分、致谢，以及其他相关信息，请参阅列于“参考”部分的 CVE 页面。

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 9 主机上安装的程序包受到 RHSA-2025:15670 公告中提及的多个漏洞影响。

    内核程序包中包含 Linux 内核，后者是任何 Linux 操作系统的核心。

    安全修复：

    * 内核ext4ext4_xattr_set_entry() 中的释放后使用 (CVE-2023-2513)

    * 内核：drm/vkms：修复 init 错误引起的释放后使用和双重释放 (CVE-2025-22097)

    * 内核：udp：修复内存核算泄漏。(CVE-2025-22058)

    * kernel: crypto：algif_hash - 修复 hash_accept 中的双重释放 (CVE-2025-38079)

    * 内核：mm/hugetlb：修复 huge_pmd_unshare() 与 GUP-fast 争用 (CVE-2025-38085)

    * 内核：wifi：rtw88：修复“para”缓冲区大小以避免读取越界 (CVE-2025-38159)

    * 内核：蓝牙：hci_core：修复 vhci_flush() 中的释放后使用 (CVE-2025-38250)

    * kernel: posix-cpu-timers修复 handle_posix_cpu_timers() 和 posix_cpu_timer_del() 之间的争用CVE-2025-38352]

    * kernel：tipc：修复 tipc_conn_close() 中的释放后使用 (CVE-2025-38464)

    有关上述安全问题的更多详细信息，包括其影响、CVSS 得分、致谢，以及其他相关信息，请参阅列于“参考”部分的 CVE 页面。

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2458 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * lockdown bypass using IMA (CVE-2022-21505)

    * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * denial of service in tipc_conn_close (CVE-2023-1382)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address security updates:

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

  - In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options,     RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant. A malicious local user with CAP_NET_ADMIN can     use this to crash the kernel. (CVE-2023-22024)

  - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation. When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
    (CVE-2023-4206)

  - A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem. (CVE-2023-4387)

  - A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
    (CVE-2023-4459)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2507-1 advisory.

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-     after-free, related to dvb_register_device dynamically allocating fops. (CVE-2022-45884)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a     race condition that can cause a use-after-free when a device is disconnected. (CVE-2022-45885)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call. (CVE-2022-45887)

  - An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    (CVE-2022-45919)

  - A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur     when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading     to a denial of service. (CVE-2023-1380)

  - A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege. (CVE-2023-2176)

  - An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The     userspace data->block[0] variable was not capped to a number between 0-255 and was used as the size of a     memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to     crash the system or potentially achieve code execution. (CVE-2023-2194)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

  - do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-     after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order     for an attacker to exploit this, the system must have netrom routing configured or the attacker must have     the CAP_NET_ADMIN capability. (CVE-2023-32269)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15649 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ext4: use-after-free in ext4_xattr_set_entry() (CVE-2023-2513)

    * kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)

    * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)

    * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()     (CVE-2025-38352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15670 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ext4: use-after-free in ext4_xattr_set_entry() (CVE-2023-2513)

    * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097)

    * kernel: udp: Fix memory accounting leak. (CVE-2025-22058)

    * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)

    * kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)

    * kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)

    * kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250)

    * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()     (CVE-2025-38352)

    * kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

  - An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS). (CVE-2022-36280)

  - A double-free flaw was found in the Linux kernel's TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-4744)

  - A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or commit     739790605705ddcf18f21782b9c99ad7d53a8c11 (CVE-2023-0458)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the 'access_ok' check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A use-after-free flaw was found in the Linux kernel's core dump subsystem. This flaw allows a local user     to crash the system. Only if patch 390031c94211 ('coredump: Use the vma snapshot in fill_files_note') not     applied yet, then kernel could be affected. (CVE-2023-1249)

  - Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

  - A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak. (CVE-2023-1513)

  - A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

  - A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem. (CVE-2023-1838)

  - A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local     privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead     to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend     upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8. (CVE-2023-1872)

  - The Linux kernel allows userspace processes to enable mitigations by calling prctl with     PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed     that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to     attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be     observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened     because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that     STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection.
    However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons,     which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target     injection against which STIBP protects. (CVE-2023-1998)

  - A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault     handler. The issue results from the lack of proper validation of user-supplied data, which can result in a     memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges     and execute arbitrary code in the context of the kernel. (CVE-2023-2008)

  - An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege. (CVE-2023-2176)

  - A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of service.
    (CVE-2023-2177)

  - An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The     userspace 'data->block[0]' variable was not capped to a number between 0-255 and was used as the size of a     memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to     crash the system or potentially achieve code execution. (CVE-2023-2194)

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was     the duplicate of CVE-2023-31436. (CVE-2023-2248)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a     reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2023-2483)

  - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

  - do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

  - An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

  - The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in     drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device.
    (CVE-2023-33203)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6901 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tun: double free in tun_free_netdev (CVE-2022-4744)

    * kernel: net/sched: cls_u32 component reference counter leak (CVE-2023-3609)

    * kernel: net/sched: sch_qfq vulnerability (CVE-2023-3611)

    * kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: use-after-free and info leak in l2cap_conn_del and l2cap_parse_conf_req (CVE-2022-3640,     CVE-2022-42895)

    * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)

    * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951,     CVE-2023-33952)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)

    * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)

    * kernel: speculative pointer dereference in do_prlimit in kernel/sys.c (CVE-2023-0458)

    * kernel: use-after-free in qdisc_graft (CVE-2023-0590)

    * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)

    * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: hid: Use After Free in asus_remove (CVE-2023-1079)

    * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)

    * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

    * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: Use after free bug in btsdio_remove (CVE-2023-1989)

    * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

    * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)

    * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)

    * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)

    * kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages     getting invalid opcode BUG in include/linux/swapops.h (CVE-2023-4732)

    * Kernel: denial of service in atm_tc_enqueue (CVE-2023-23455)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: Denial of service issue in az6027 driver (CVE-2023-28328)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)

    * kernel: saa7134: race condition in saa7134_finidev (CVE-2023-35823)

    * kernel: dm1105: race condition in dm1105_remove.c (CVE-2023-35824)

    * kernel: r592: race condition in r592_remove (CVE-2023-35825)

    * kernel: net/tls: tls_is_tx_ready checked list_entry (CVE-2023-1075)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free in r592_remove (CVE-2023-3141)

    * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

    For more details about the security issue(s), refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7077 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206,     CVE-2023-4207, CVE-2023-4208)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)

    * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)

    * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951,     CVE-2023-33952)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)

    * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)

    * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)

    * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)

    * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)

    * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)

    * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: hid: Use After Free in asus_remove (CVE-2023-1079)

    * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)

    * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

    * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)

    * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

    * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)

    * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)

    * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)

    * kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)

    * Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: Denial of service issue in az6027 driver (CVE-2023-28328)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)

    * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)

    * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)

    * kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)

    * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free bug in r592_remove (CVE-2023-3141)

    * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
184349	OracleVM 3.4：kernel-uek (OVMSA-2023-0023)	Nessus	OracleVM Local Security Checks	2023/11/3	2023/12/15	high
166118	Amazon Linux 2：内核 (ALASKERNEL-5.15-2022-008)	Nessus	Amazon Linux Local Security Checks	2022/10/14	2025/8/29	high
185666	RHEL 8：kernel-rt (RHSA-2023:6901)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/9/10	high
185679	RHEL 8：内核 (RHSA-2023:7077)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/9/10	high
264498	RHEL 8：内核 (RHSA-2025:15649)	Nessus	Red Hat Local Security Checks	2025/9/10	2025/9/10	medium
264563	RHEL 9：内核 (RHSA-2025:15670)	Nessus	Red Hat Local Security Checks	2025/9/11	2025/9/11	medium
179516	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-2601)	Nessus	Huawei Local Security Checks	2023/8/8	2023/8/8	medium
175477	RHEL 9 : kernel (RHSA-2023:2458)	Nessus	Red Hat Local Security Checks	2023/5/13	2025/9/10	high
184349	OracleVM 3.4 : kernel-uek (OVMSA-2023-0023)	Nessus	OracleVM Local Security Checks	2023/11/3	2023/12/15	high
177334	SUSE SLES12 Security Update : kernel (SUSE-SU-2023:2507-1)	Nessus	SuSE Local Security Checks	2023/6/15	2023/7/14	high
204070	Photon OS 3.0: Linux PHSA-2023-3.0-0585	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/20	high
264498	RHEL 8 : kernel (RHSA-2025:15649)	Nessus	Red Hat Local Security Checks	2025/9/10	2025/9/10	medium
264563	RHEL 9 : kernel (RHSA-2025:15670)	Nessus	Red Hat Local Security Checks	2025/9/11	2025/9/11	medium
188850	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2023-2724)	Nessus	Huawei Local Security Checks	2024/1/16	2024/3/4	high
188944	EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2023-2755)	Nessus	Huawei Local Security Checks	2024/1/16	2024/3/4	high
185666	RHEL 8 : kernel-rt (RHSA-2023:6901)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/9/10	high
166118	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2022-008 (ALASKERNEL-5.15-2022-008)	Nessus	Amazon Linux Local Security Checks	2022/10/14	2025/8/29	high
185679	RHEL 8 : kernel (RHSA-2023:7077)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/9/10	high

偵測

搜尋 Plugin

high

high

high

high

medium

medium

medium

high

high

high

high

medium

medium

high

high

high

high

high