According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ASoC: topology: Fix references to freed memory(CVE-2024-41069)

    bcache: fix variable length array abuse in btree_iter(CVE-2024-39482)

    bnx2x: Fix multiple UBSAN array-index-out-of-bounds(CVE-2024-42148)

    bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD(CVE-2024-42161)

    bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro(CVE-2024-42068)

    bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro(CVE-2024-42067)

    cachefiles: add consistency check for copen/cread(CVE-2024-41075)

    cachefiles: cyclic allocation of msg_id to avoid reuse(CVE-2024-41050)

    cachefiles: Set object to close if ondemand_id  0 in copen(CVE-2024-41074)

    cachefiles: wait for ondemand_object_worker to finish when dropping object(CVE-2024-41051)

    crypto: aead,cipher - zeroize key buffer after use(CVE-2024-42229)

    crypto: ecdh - explicitly zeroize private_key(CVE-2024-42098)

    crypto: hisilicon/debugfs - Fix debugfs uninit process issue(CVE-2024-42147)

    crypto: hisilicon/sec - Fix memory leak for sec resource release(CVE-2024-41002)

    drivers: core: synchronize really_probe() and dev_uevent(CVE-2024-39501)

    drm/ nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes(CVE-2024-41095)

    drm/ nouveau: fix null pointer dereference in nouveau_connector_get_modes(CVE-2024-42101)

    drm/ nouveau: fix off by one in BIOS boundary checking(CVE-2022-48732)

    drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)(CVE-2024-39497)

    enic: Validate length of nl attributes in enic_set_vf_port(CVE-2024-38659)

    ext4: fix error handling in ext4_fc_record_modified_inode()(CVE-2022-48712)

    filelock: Fix fcntl/close race recovery compat path(CVE-2024-41020)

    filelock: fix potential use-after-free in posix_lock_inode(CVE-2024-41049)

    filelock: Remove locks reliably when fcntl/close race is detected(CVE-2024-41012)

    Fix userfaultfd_api to return EINVAL as expected(CVE-2024-41027)

    ftruncate: pass a signed offset(CVE-2024-42084)

    ima: Avoid blocking in RCU read-side critical section(CVE-2024-40947)

    In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to     drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.(CVE-2024-23848)

    inet_diag: Initialize pad field in struct inet_diag_req_v2(CVE-2024-42106)

    Input: aiptek - properly check endpoint type(CVE-2022-48836)

    io_uring: fix possible deadlock in io_register_iowq_max_workers()(CVE-2024-41080)

    iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected(CVE-2024-26891)

    iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()(CVE-2022-48724)

    iommu: Fix potential use-after-free during probe(CVE-2022-48796)

    kernel:ima: Fix use-after-free on a dentry's dname.name(CVE-2024-39494)

    kernel:RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests(CVE-2021-47391)

    KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin(CVE-2024-40953)

    media: dvb-frontends: tda10048: Fix integer overflow(CVE-2024-42223)

    mm: avoid overflows in dirty throttling logic(CVE-2024-42131)

    net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket(CVE-2024-42246)

    net: hns3: fix kernel crash when 1588 is received on HIP08 devices(CVE-2024-26881)

    net: phy: fix phy_get_internal_delay accessing an empty array(CVE-2024-27047)

    net: USB: Fix wrong-direction WARNING in plusb.c(CVE-2023-52742)

    netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers(CVE-2024-42070)

    netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu(CVE-2024-36286)

    netfilter: tproxy: bail out if IP has been disabled on the device(CVE-2024-36270)

    net-sysfs: add check for netdevice being present to speed_show(CVE-2022-48850)

    null_blk: fix validation of block size(CVE-2024-41077)

    nvme-fabrics: use reserved tag for reg read/write command(CVE-2024-41082)

    nvmet: always initialize cqe.result(CVE-2024-41079)

    nvmet: fix a possible leak when destroy a ctrl during qp establishment(CVE-2024-42152)

    nvme-tcp: fix possible use-after-free in transport error_recovery work(CVE-2022-48789)

    of: module: prevent NULL pointer dereference in vsnprintf()(CVE-2024-35878)

    pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER(CVE-2024-42090)

    powerpc/powernv: Add a null pointer check in opal_powercap_init()(CVE-2023-52696)

    ppp: reject claimed-as-LCP but actually malformed packets(CVE-2024-41044)

    RDMA/restrack: Fix potential invalid address access(CVE-2024-42080)

    sched/deadline: Fix task_struct reference leak(CVE-2024-41023)

    scsi: qedf: Make qedf_execute_tmf() non-preemptible(CVE-2024-42124)

    skmsg: Skip zero length skb in sk_msg_recvmsg(CVE-2024-41048)

    tap: add missing verification for short frame(CVE-2024-41090)

    tcp_metrics: validate source addr length(CVE-2024-42154)

    tun: add missing verification for short frame(CVE-2024-41091)

    udp: do not accept non-tunnel GSO skbs landing in a tunnel(CVE-2024-35884)

    udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().(CVE-2024-41041)

    usb: atm: cxacru: fix endpoint checking in cxacru_bind()(CVE-2024-41097)

    usb: usbtmc: Fix bug in pipe direction for control transfers(CVE-2022-48834)

    x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD(CVE-2024-35801)

    x86: stop playing stack games in profile_pc()(CVE-2024-42096)

    xdp: Remove WARN() from __xdp_reg_mem_model(CVE-2024-42082)

    xfs: add bounds checking to xlog_recover_process_data(CVE-2024-41014)

    xfs: don't walk off the end of a directory data block(CVE-2024-41013)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7089-3 advisory.

    Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the     device to be enabled before writing. A local attacker could possibly use this to cause a denial of     service. (CVE-2024-25741)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - MIPS architecture;

    - PA-RISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Serial ATA and Parallel ATA drivers;

    - Null block device driver;

    - Bluetooth drivers;

    - Cdrom driver;

    - Clock framework and drivers;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - Cirrus firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - ISDN/mISDN subsystem;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Near Field Communication (NFC) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - S/390 drivers;

    - SCSI drivers;

    - Thermal drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB DSL drivers;

    - USB core drivers;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Serial drivers;

    - VFIO drivers;

    - VHOST drivers;

    - File systems infrastructure;

    - BTRFS file system;

    - GFS2 file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system client;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - Memory management;

    - Netfilter;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Core kernel;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - IUCV driver;

    - MAC80211 subsystem;

    - Network traffic control;

    - Sun RPC protocol;

    - Wireless networking;

    - AMD SoC Alsa drivers;

    - SoC Audio for Freescale CPUs drivers;

    - MediaTek ASoC drivers;

    - SoC audio core drivers;

    - SOF drivers;

    - Sound sequencer drivers; (CVE-2024-42239, CVE-2024-42079, CVE-2024-41080, CVE-2024-42064,     CVE-2024-42127, CVE-2024-41049, CVE-2024-41086, CVE-2024-42142, CVE-2024-42244, CVE-2024-41060,     CVE-2024-42131, CVE-2024-42085, CVE-2024-42246, CVE-2024-41062, CVE-2024-42115, CVE-2024-42234,     CVE-2024-42080, CVE-2024-41095, CVE-2024-41063, CVE-2024-42227, CVE-2024-41089, CVE-2024-42133,     CVE-2024-43858, CVE-2024-42135, CVE-2024-42113, CVE-2024-42120, CVE-2024-42149, CVE-2024-42132,     CVE-2024-41038, CVE-2024-41069, CVE-2024-41090, CVE-2024-41059, CVE-2024-41028, CVE-2024-42126,     CVE-2024-42121, CVE-2024-42155, CVE-2024-42110, CVE-2024-41021, CVE-2024-41044, CVE-2024-42098,     CVE-2024-42235, CVE-2024-41083, CVE-2024-41065, CVE-2024-42094, CVE-2024-42229, CVE-2024-42240,     CVE-2024-42225, CVE-2024-42230, CVE-2024-41088, CVE-2024-42073, CVE-2024-42145, CVE-2024-42076,     CVE-2024-42087, CVE-2024-42241, CVE-2024-41019, CVE-2024-41052, CVE-2024-42093, CVE-2024-42063,     CVE-2024-41039, CVE-2024-42106, CVE-2024-42108, CVE-2024-42237, CVE-2024-41048, CVE-2024-41033,     CVE-2023-52888, CVE-2024-41096, CVE-2024-41032, CVE-2024-41091, CVE-2024-42238, CVE-2024-41056,     CVE-2024-42091, CVE-2024-42088, CVE-2024-41047, CVE-2024-42271, CVE-2024-41064, CVE-2024-42223,     CVE-2024-42129, CVE-2024-42102, CVE-2024-42146, CVE-2024-42138, CVE-2024-41079, CVE-2024-42232,     CVE-2024-42112, CVE-2024-39487, CVE-2024-42245, CVE-2024-41093, CVE-2024-41066, CVE-2024-43855,     CVE-2024-41055, CVE-2024-42100, CVE-2024-41053, CVE-2024-42069, CVE-2024-42252, CVE-2024-42243,     CVE-2024-42124, CVE-2024-41054, CVE-2024-42151, CVE-2024-42118, CVE-2024-42251, CVE-2024-42137,     CVE-2024-41071, CVE-2024-41010, CVE-2024-41087, CVE-2024-41050, CVE-2024-42068, CVE-2024-42158,     CVE-2024-41075, CVE-2024-42141, CVE-2024-42236, CVE-2024-41068, CVE-2024-42157, CVE-2024-42140,     CVE-2024-41058, CVE-2024-41076, CVE-2024-42097, CVE-2024-41029, CVE-2024-41097, CVE-2024-42109,     CVE-2024-41051, CVE-2024-41061, CVE-2024-42156, CVE-2024-42101, CVE-2024-41031, CVE-2024-41017,     CVE-2024-42247, CVE-2024-42128, CVE-2024-41085, CVE-2024-41072, CVE-2024-42248, CVE-2024-41045,     CVE-2024-42104, CVE-2024-42253, CVE-2024-42117, CVE-2024-41078, CVE-2024-42130, CVE-2024-42090,     CVE-2024-42280, CVE-2024-42250, CVE-2024-42231, CVE-2024-41042, CVE-2024-42077, CVE-2024-42153,     CVE-2024-41015, CVE-2024-41035, CVE-2024-41082, CVE-2024-42114, CVE-2024-41007, CVE-2024-41073,     CVE-2024-42161, CVE-2024-42082, CVE-2024-42150, CVE-2024-42111, CVE-2024-42086, CVE-2024-42095,     CVE-2024-41025, CVE-2024-41081, CVE-2024-42105, CVE-2024-41027, CVE-2024-42089, CVE-2024-39486,     CVE-2024-41084, CVE-2024-42092, CVE-2024-42152, CVE-2024-41022, CVE-2024-41077, CVE-2024-41098,     CVE-2024-41023, CVE-2024-42066, CVE-2024-41034, CVE-2024-41037, CVE-2024-41046, CVE-2023-52887,     CVE-2024-42147, CVE-2024-42065, CVE-2024-42096, CVE-2024-41018, CVE-2024-42067, CVE-2024-41041,     CVE-2024-42103, CVE-2024-42084, CVE-2024-42074, CVE-2024-41094, CVE-2024-42119, CVE-2024-41012,     CVE-2024-41020, CVE-2024-41074, CVE-2024-42144, CVE-2024-41067, CVE-2024-42070, CVE-2024-41057,     CVE-2024-41036, CVE-2024-42136, CVE-2024-41030, CVE-2024-41070, CVE-2024-41092)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7089-5 advisory.

    Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the     device to be enabled before writing. A local attacker could possibly use this to cause a denial of     service. (CVE-2024-25741)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - MIPS architecture;

    - PA-RISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Serial ATA and Parallel ATA drivers;

    - Null block device driver;

    - Bluetooth drivers;

    - Cdrom driver;

    - Clock framework and drivers;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - Cirrus firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - ISDN/mISDN subsystem;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Near Field Communication (NFC) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - S/390 drivers;

    - SCSI drivers;

    - Thermal drivers;

    - TTY drivers;

    - UFS subsystem;

    - USB DSL drivers;

    - USB core drivers;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Serial drivers;

    - VFIO drivers;

    - VHOST drivers;

    - File systems infrastructure;

    - BTRFS file system;

    - GFS2 file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system client;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - Memory management;

    - Netfilter;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Core kernel;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - IUCV driver;

    - MAC80211 subsystem;

    - Network traffic control;

    - Sun RPC protocol;

    - Wireless networking;

    - AMD SoC Alsa drivers;

    - SoC Audio for Freescale CPUs drivers;

    - MediaTek ASoC drivers;

    - SoC audio core drivers;

    - SOF drivers;

    - Sound sequencer drivers; (CVE-2024-42223, CVE-2024-42244, CVE-2024-42105, CVE-2024-42100,     CVE-2024-42235, CVE-2024-41007, CVE-2024-41047, CVE-2024-42088, CVE-2024-42079, CVE-2024-41053,     CVE-2024-41094, CVE-2024-42227, CVE-2024-42253, CVE-2024-42150, CVE-2024-41049, CVE-2024-42096,     CVE-2024-42093, CVE-2024-41079, CVE-2024-41037, CVE-2024-42129, CVE-2024-41031, CVE-2024-39486,     CVE-2024-41065, CVE-2024-42101, CVE-2024-41082, CVE-2024-42135, CVE-2024-42236, CVE-2024-41078,     CVE-2024-42098, CVE-2024-41056, CVE-2024-41096, CVE-2024-41074, CVE-2024-42246, CVE-2024-42137,     CVE-2024-42232, CVE-2024-42121, CVE-2024-41093, CVE-2024-41076, CVE-2024-42157, CVE-2024-41062,     CVE-2024-42104, CVE-2024-42085, CVE-2024-41092, CVE-2024-41034, CVE-2024-41036, CVE-2024-41072,     CVE-2024-41012, CVE-2024-39487, CVE-2024-42124, CVE-2024-42065, CVE-2024-41061, CVE-2024-41064,     CVE-2024-41091, CVE-2024-42119, CVE-2024-41088, CVE-2024-42089, CVE-2024-41048, CVE-2024-41032,     CVE-2024-41020, CVE-2024-42066, CVE-2024-42068, CVE-2024-42238, CVE-2024-41069, CVE-2024-41044,     CVE-2024-41025, CVE-2024-42161, CVE-2023-52887, CVE-2024-42127, CVE-2024-42239, CVE-2024-42149,     CVE-2024-42091, CVE-2024-42097, CVE-2024-41054, CVE-2024-41041, CVE-2024-42131, CVE-2024-41089,     CVE-2024-41018, CVE-2024-42067, CVE-2024-41039, CVE-2024-42128, CVE-2024-42248, CVE-2024-41090,     CVE-2024-42073, CVE-2024-43858, CVE-2024-42225, CVE-2024-42077, CVE-2024-42247, CVE-2024-42109,     CVE-2024-41045, CVE-2024-41019, CVE-2024-42231, CVE-2024-41017, CVE-2024-42145, CVE-2024-41046,     CVE-2024-42063, CVE-2024-41087, CVE-2024-41033, CVE-2024-41021, CVE-2024-42241, CVE-2024-42229,     CVE-2024-41015, CVE-2024-42087, CVE-2024-42133, CVE-2024-41073, CVE-2024-42070, CVE-2024-41067,     CVE-2024-41077, CVE-2024-42102, CVE-2024-42158, CVE-2024-42126, CVE-2024-41042, CVE-2024-41055,     CVE-2024-42092, CVE-2024-42114, CVE-2024-41059, CVE-2024-41058, CVE-2024-41071, CVE-2024-42144,     CVE-2024-42146, CVE-2024-41084, CVE-2024-42155, CVE-2024-42245, CVE-2024-42156, CVE-2024-41050,     CVE-2024-42141, CVE-2024-42095, CVE-2024-41097, CVE-2024-42103, CVE-2024-42152, CVE-2024-42140,     CVE-2024-41023, CVE-2024-41083, CVE-2024-42138, CVE-2024-42271, CVE-2024-42252, CVE-2024-42237,     CVE-2024-42132, CVE-2024-41098, CVE-2024-42086, CVE-2024-41063, CVE-2024-42153, CVE-2024-41070,     CVE-2024-42115, CVE-2024-42111, CVE-2024-42142, CVE-2024-42069, CVE-2024-41027, CVE-2024-42130,     CVE-2024-42090, CVE-2024-42251, CVE-2024-42118, CVE-2024-41060, CVE-2024-41029, CVE-2024-41095,     CVE-2024-41038, CVE-2024-42243, CVE-2024-42112, CVE-2024-41035, CVE-2024-42240, CVE-2024-41066,     CVE-2024-41085, CVE-2024-42082, CVE-2024-42117, CVE-2024-42250, CVE-2024-41080, CVE-2024-42147,     CVE-2024-41081, CVE-2024-42113, CVE-2023-52888, CVE-2024-42136, CVE-2024-41057, CVE-2024-41086,     CVE-2024-42064, CVE-2024-42234, CVE-2024-42076, CVE-2024-42084, CVE-2024-42094, CVE-2024-42230,     CVE-2024-41068, CVE-2024-43855, CVE-2024-42080, CVE-2024-41052, CVE-2024-41051, CVE-2024-42074,     CVE-2024-41010, CVE-2024-41028, CVE-2024-41030, CVE-2024-41022, CVE-2024-42120, CVE-2024-42108,     CVE-2024-41075, CVE-2024-42106, CVE-2024-42280, CVE-2024-42110, CVE-2024-42151)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
210235	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-2794)	Nessus	Huawei Local Security Checks	2024/11/4	2024/11/4	high
210531	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-7089-3)	Nessus	Ubuntu Local Security Checks	2024/11/7	2024/11/7	high
211360	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-7089-5)	Nessus	Ubuntu Local Security Checks	2024/11/14	2024/11/14	high

偵測

搜尋 Plugin

high

high

high