The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1490-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
    - CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
    - CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
    - CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
    - CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
    - CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
    - CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
    - CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
    - CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
    - CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
    - CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
    - CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
    - CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
    - CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
    - CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
    - CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
    - CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
    - CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in     net/marvell/prestera (bsc#1221009).
    - CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
    - CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
    - CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
    - CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
    - CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()     (bsc#1222660).
    - CVE-2021-47182: Fixed buffer length handling in scsi_mode_sense() in scsi core (bsc#1222662).
    - CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145,     bsc#1222664).
    - CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
    - CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work     functions in btrfs (bsc#1222706).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
    - CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
    - CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng     (bsc#1220990).
    - CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system     (bsc#1209657).
    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround  (bsc#1220251).
    - CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
    - CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
    - CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
    - CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
    - CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
    - CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests     (bsc#1220445).
    - CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).
    - CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
    - CVE-2023-52481: Fixed speculative unprivileged load in Cortex-A520 (bsc#1220887).
    - CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
    - CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).
    - CVE-2023-52488: Fixed data corruption due to error on incrementing register address in regmap functions     for FIFO in serial sc16is7xx (bsc#1221162).
    - CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function
    __dma_async_device_channel_register() (bsc#1221276).
    - CVE-2023-52493: Fixed possible soft lockup in bus/mhi/host (bsc#1221274).
    - CVE-2023-52494: Fixed missing alignment check for event ring read pointer in bus/mhi/host (bsc#1221273).
    - CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2023-52503: Fixed use-after-free in amdtee_close_session due to race condition with     amdtee_open_session in tee amdtee (bsc#1220915).
    - CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine     (bsc#1221553).
    - CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
    - CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
    - CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
    - CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
    - CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
    - CVE-2023-52513: Fixed connection failure handling  in RDMA/siw (bsc#1221022).
    - CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
    - CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i     (bsc#1221055).
    - CVE-2023-52518: Fixed information leak in bluetooth/hci_codec (bsc#1221056).
    - CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
    - CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
    - CVE-2023-52523: Fixed wrong redirects to non-TCP sockets in bpf (bsc#1220926).
    - CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
    - CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
    - CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
    - CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2023-52561: Fixed denial of service due to missing reserved attribute on cont splash memory region     in arm64 dts qcom sdm845-db845c (bsc#1220935).
    - CVE-2023-52563: Fixed memory leak on ->hpd_notify callback() in drm/meson (bsc#1220937).
    - CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
    - CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
    - CVE-2023-52567: Fixed possible Oops in  serial/8250_port: when using IRQ polling (irq = 0)     (bsc#1220839).
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
    - CVE-2023-52576: Fixed potential use after free in memblock_isolate_range() (bsc#1220872).
    - CVE-2023-52582: Fixed possible oops in netfs (bsc#1220878).
    - CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).
    - CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).
    - CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
    - CVE-2023-52594: Fixed potential array-index-out-of-bounds read in ath9k_htc_txstatus() (bsc#1221045).
    - CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).
    - CVE-2023-52599: Fixed array-index-out-of-bounds in diNewExt() in jfs (bsc#1221062).
    - CVE-2023-52600: Fixed uaf in jfs_evict_inode() (bsc#1221071).
    - CVE-2023-52601: Fixed array-index-out-of-bounds in dbAdjTree() in jfs (bsc#1221068).
    - CVE-2023-52602: Fixed slab-out-of-bounds Read in dtSearch() in jfs (bsc#1221070).
    - CVE-2023-52603: Fixed array-index-out-of-bounds in dtSplitRoot() (bsc#1221066).
    - CVE-2023-52604: Fixed array-index-out-of-bounds in dbAdjTree() (bsc#1221067).
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-52606: Fixed possible kernel stack corruption in powerpc/lib (bsc#1221069).
    - CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).
    - CVE-2023-52608: Fixed possible race condition in firmware/arm_scmi (bsc#1221375).
    - CVE-2023-52612: Fixed req->dst buffer overflow in crypto/scomp (bsc#1221616).
    - CVE-2023-52615: Fixed page fault dead lock on mmap-ed hwrng (bsc#1221614).
    - CVE-2023-52617: Fixed stdev_release() crash after surprise hot remove (bsc#1221613).
    - CVE-2023-52619: Fixed possible crash when setting number of cpus to an odd number in pstore/ram     (bsc#1221618).
    - CVE-2023-52621: Fixed missing asserion in bpf (bsc#1222073).
    - CVE-2023-52623: Fixed suspicious RCU usage in SUNRPC (bsc#1222060).
    - CVE-2023-52627: Fixed null pointer dereference due to lack of callback functions in iio adc ad7091r     (bsc#1222051)
    - CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).
    - CVE-2023-52632: Fixed lock dependency warning with srcu in drm/amdkfd (bsc#1222274).
    - CVE-2023-52636: Fixed denial of service due to wrongly init the cursor when preparing sparse read in     msgr2 in libceph  (bsc#1222247).
    - CVE-2023-52637: Fixed UAF in j1939_sk_match_filter() in can/k1939 (bsc#1222291).
    - CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()     (bsc#1218336).
    - CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in     net/netfilter/nf_conntrack_netlink.c (bsc#1218479).
    - CVE-2024-0841: Fixed null pointer dereference in hugetlbfs_fill_super() (bsc#1219264).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
    - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5     modules (bsc#1219169).
    - CVE-2024-23850: Fixed denial of service due to assertion failure due to subvolume readed before root     item insertion in btrfs_get_root_ref in btrfs (bsc#1219126).
    - CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).
    - CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
    - CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2024-26599: Fixed out-of-bounds access in of_pwm_single_xlate() (bsc#1220365).
    - CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
    - CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
    - CVE-2024-26612: Fixed Oops in fscache_put_cache() This function dereferences  (bsc#1221291).
    - CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
    - CVE-2024-26620: Fixed possible device model violation in s390/vfio-ap (bsc#1221298).
    - CVE-2024-26627: Fixed possible hard lockup in scsi (bsc#1221090).
    - CVE-2024-26629: Fixed possible protocol violation via RELEASE_LOCKOWNER in nfsd (bsc#1221379).
    - CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
    - CVE-2024-26645: Fixed missing visibility when inserting an element into tracing_map (bsc#1222056).
    - CVE-2024-26646: Fixed potential memory corruption when resuming from suspend or hibernation in     thermal/intel/hfi (bsc#1222070).
    - CVE-2024-26651: Fixed possible oops via malicious devices in sr9800 (bsc#1221337).
    - CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
    - CVE-2024-26659: Fixed wrong handling of isoc Babble and Buffer Overrun events in xhci (bsc#1222317).
    - CVE-2024-26660: Fixed buffer overflow in dcn301_stream_encoder_create in drm amd display (bsc#1222266)
    - CVE-2024-26664: Fixed out-of-bounds memory access in create_core_data() in hwmon coretemp (bsc#1222355).
    - CVE-2024-26667: Fixed null pointer reference in dpu_encoder_helper_phys_cleanup in drm/msm/dpu     (bsc#1222331).
    - CVE-2024-26670: Fixed ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround in kernel arm64 (bsc#1222356).
    - CVE-2024-26680: Fixed denial of service due to DMA mapping for PTP hwts ring in net atlantic     (bsc#1222427).
    - CVE-2024-26681: Fixed denial of service in nsim_dev_trap_report_work() in netdevsim (bsc#1222431).
    - CVE-2024-26684: Fixed handling of DPP safety error for DMA channels in net stmmac xgmac (bsc#1222445).
    - CVE-2024-26685: Fixed denial of service in end_buffer_async_write() in nilfs2 (bsc#1222437).
    - CVE-2024-26689: Fixed use-after-free in encode_cap_msg() in ceph (bsc#1222503).
    - CVE-2024-26695: Fixed null pointer dereference in __sev_platform_shutdown_locked in crypto ccp     (bsc#1222373).
    - CVE-2024-26696: Fixed denial of service in nilfs_lookup_dirty_data_buffers() in nilfs2 (bsc#1222549).
    - CVE-2024-26697: Fixed data corruption in dsync block recovery for small block sizes in nilfs2     (bsc#1222550).
    - CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
    - CVE-2024-26717: Fixed null pointer dereference on failed power up in HID i2c-hid-of (bsc#1222360).
    - CVE-2024-26718: Fixed memory corruption in tasklet_unlock via disabling tasklets in dm-crypt and dm-     verify (bsc#1222416).
    - CVE-2024-26722: Fixed denial of service in rt5645_jack_detect_work() due to mutex left locked forever in     ASoC rt5645 (bsc#1222520).
    - CVE-2024-26727: Fixed denial of service due to assertion failure during subvolume creation     (bsc#1222536).
    - CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
    - CVE-2024-26736: Fixed buffer overflow in afs_update_volume_status() in afs (bsc#1222586).
    - CVE-2024-26737: Fixed use-after-free due to race between bpf_timer_cancel_and_free and bpf_timer_cancel     in bpf (bsc#1222557).
    - CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677)
    - CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449)
    - CVE-2024-26745: Fixed null pointer dereference due to IOMMU table not initialized for kdump over SR-IOV     (bsc#1220492, bsc#1222678).
    - CVE-2024-26747: Fixed null pointer issue when put module's reference in usb roles  (bsc#1222609).
    - CVE-2024-26749: Fixed use-after-free at cdns3_gadget_ep_disable() in usb cdns3 (bsc#1222680).
    - CVE-2024-26751: Fixed denial of service due to gpiod_lookup_table search loop not ending correctly     (bsc#1222724)
    - CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).
    - CVE-2024-26760: Fixed null pointer dereference on error case in bio_put() in scsi target pscsi     (bsc#1222596)
    - CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt     (bsc#1222720).
    - CVE-2024-26766: Fixed off-by-one error in sdma.h tx->num_descs in ib/hfi1 (bsc#1222726)
    - CVE-2024-26769: Fixed deadlock on delete association path in nvmet-fc  (bsc#1222727).
    - CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)
    - CVE-2024-26776: Fixed null pointer dereference due to null value returned by interrupt handler in spi     hisi-sfc-v3xx (bsc#1222764)
    - CVE-2024-26779: Fixed denial of service due to race condition on enabling fast-xmit in wifi mac80211     (bsc#1222772).
    - CVE-2024-26787: Fixed DMA API overlapping mappings in mmc mmci stm32 (bsc#1222781)
    - CVE-2024-26790: Fixed denial of service on 16 bytes unaligned read in dmaengine fsl-qdma (bsc#1222784)
    - CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).
    - CVE-2024-26798: Fixed denial of service due to wrongly restore fond data upon failure in fbcon     (bsc#1222798).
    - CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).
    - CVE-2024-26807: Fixed memory corruption due to wrong pointer reference in spi cadence-qspi (bsc#1222801)
    - CVE-2024-26848: Fixed denial of service due to endless loop in directory parsing in afs (bsc#1223030).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3840 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3840-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     June 25, 2024                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 4.19.316-1     CVE ID         : CVE-2021-33630 CVE-2022-48627 CVE-2023-0386 CVE-2023-6040                      CVE-2023-6270 CVE-2023-7042 CVE-2023-46838 CVE-2023-47233                      CVE-2023-52340 CVE-2023-52429 CVE-2023-52436 CVE-2023-52439                      CVE-2023-52443 CVE-2023-52444 CVE-2023-52445 CVE-2023-52449                      CVE-2023-52464 CVE-2023-52469 CVE-2023-52470 CVE-2023-52486                      CVE-2023-52583 CVE-2023-52587 CVE-2023-52594 CVE-2023-52599                      CVE-2023-52600 CVE-2023-52601 CVE-2023-52602 CVE-2023-52603                      CVE-2023-52604 CVE-2023-52609 CVE-2023-52612 CVE-2023-52615                      CVE-2023-52619 CVE-2023-52620 CVE-2023-52622 CVE-2023-52623                      CVE-2023-52628 CVE-2023-52644 CVE-2023-52650 CVE-2023-52670                      CVE-2023-52679 CVE-2023-52683 CVE-2023-52691 CVE-2023-52693                      CVE-2023-52698 CVE-2023-52699 CVE-2023-52880 CVE-2024-0340                      CVE-2024-0607 CVE-2024-1086 CVE-2024-22099 CVE-2024-23849                      CVE-2024-23851 CVE-2024-24857 CVE-2024-24858 CVE-2024-24861                      CVE-2024-25739 CVE-2024-26597 CVE-2024-26600 CVE-2024-26602                      CVE-2024-26606 CVE-2024-26615 CVE-2024-26625 CVE-2024-26633                      CVE-2024-26635 CVE-2024-26636 CVE-2024-26642 CVE-2024-26645                      CVE-2024-26651 CVE-2024-26663 CVE-2024-26664 CVE-2024-26671                      CVE-2024-26675 CVE-2024-26679 CVE-2024-26685 CVE-2024-26696                      CVE-2024-26697 CVE-2024-26704 CVE-2024-26720 CVE-2024-26722                      CVE-2024-26735 CVE-2024-26744 CVE-2024-26752 CVE-2024-26754                      CVE-2024-26763 CVE-2024-26764 CVE-2024-26766 CVE-2024-26772                      CVE-2024-26773 CVE-2024-26777 CVE-2024-26778 CVE-2024-26779                      CVE-2024-26791 CVE-2024-26793 CVE-2024-26801 CVE-2024-26805                      CVE-2024-26816 CVE-2024-26817 CVE-2024-26820 CVE-2024-26825                      CVE-2024-26839 CVE-2024-26840 CVE-2024-26845 CVE-2024-26851                      CVE-2024-26852 CVE-2024-26857 CVE-2024-26859 CVE-2024-26863                      CVE-2024-26874 CVE-2024-26875 CVE-2024-26878 CVE-2024-26880                      CVE-2024-26883 CVE-2024-26884 CVE-2024-26889 CVE-2024-26894                      CVE-2024-26898 CVE-2024-26901 CVE-2024-26903 CVE-2024-26917                      CVE-2024-26922 CVE-2024-26923 CVE-2024-26931 CVE-2024-26934                      CVE-2024-26955 CVE-2024-26956 CVE-2024-26965 CVE-2024-26966                      CVE-2024-26969 CVE-2024-26973 CVE-2024-26974 CVE-2024-26976                      CVE-2024-26981 CVE-2024-26984 CVE-2024-26993 CVE-2024-26994                      CVE-2024-26997 CVE-2024-27001 CVE-2024-27008 CVE-2024-27013                      CVE-2024-27020 CVE-2024-27024 CVE-2024-27028 CVE-2024-27043                      CVE-2024-27046 CVE-2024-27059 CVE-2024-27074 CVE-2024-27075                      CVE-2024-27077 CVE-2024-27078 CVE-2024-27388 CVE-2024-27395                      CVE-2024-27396 CVE-2024-27398 CVE-2024-27399 CVE-2024-27401                      CVE-2024-27405 CVE-2024-27410 CVE-2024-27412 CVE-2024-27413                      CVE-2024-27416 CVE-2024-27419 CVE-2024-27436 CVE-2024-31076                      CVE-2024-33621 CVE-2024-35789 CVE-2024-35806 CVE-2024-35807                      CVE-2024-35809 CVE-2024-35811 CVE-2024-35815 CVE-2024-35819                      CVE-2024-35821 CVE-2024-35822 CVE-2024-35823 CVE-2024-35825                      CVE-2024-35828 CVE-2024-35830 CVE-2024-35835 CVE-2024-35847                      CVE-2024-35849 CVE-2024-35877 CVE-2024-35886 CVE-2024-35888                      CVE-2024-35893 CVE-2024-35898 CVE-2024-35902 CVE-2024-35910                      CVE-2024-35915 CVE-2024-35922 CVE-2024-35925 CVE-2024-35930                      CVE-2024-35933 CVE-2024-35935 CVE-2024-35936 CVE-2024-35944                      CVE-2024-35947 CVE-2024-35955 CVE-2024-35960 CVE-2024-35969                      CVE-2024-35973 CVE-2024-35978 CVE-2024-35982 CVE-2024-35984                      CVE-2024-35997 CVE-2024-36004 CVE-2024-36014 CVE-2024-36015                      CVE-2024-36016 CVE-2024-36017 CVE-2024-36020 CVE-2024-36286                      CVE-2024-36288 CVE-2024-36883 CVE-2024-36886 CVE-2024-36902                      CVE-2024-36904 CVE-2024-36905 CVE-2024-36919 CVE-2024-36933                      CVE-2024-36934 CVE-2024-36940 CVE-2024-36941 CVE-2024-36946                      CVE-2024-36950 CVE-2024-36954 CVE-2024-36959 CVE-2024-36960                      CVE-2024-36964 CVE-2024-36971 CVE-2024-37353 CVE-2024-37356                      CVE-2024-38381 CVE-2024-38549 CVE-2024-38552 CVE-2024-38558                      CVE-2024-38559 CVE-2024-38560 CVE-2024-38565 CVE-2024-38567                      CVE-2024-38578 CVE-2024-38579 CVE-2024-38582 CVE-2024-38583                      CVE-2024-38587 CVE-2024-38589 CVE-2024-38596 CVE-2024-38598                      CVE-2024-38599 CVE-2024-38601 CVE-2024-38612 CVE-2024-38618                      CVE-2024-38621 CVE-2024-38627 CVE-2024-38633 CVE-2024-38634                      CVE-2024-38637 CVE-2024-38659 CVE-2024-38780 CVE-2024-39292

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 10 buster, these problems have been fixed in version     4.19.316-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0017 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-20588:
    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality.

    CVE-2023-28464:
    hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation.

    CVE-2023-39192:
    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure.

    CVE-2023-45863:
    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write.

    CVE-2023-45871:
    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.

    CVE-2023-4622:
    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.
    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.
    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

    CVE-2023-51779:
    bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free     because of a bt_sock_ioctl race condition.

    CVE-2023-5178:
    A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause     a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation.

    CVE-2023-52438:
    In the Linux kernel, the following vulnerability has been resolved:
    binder: fix use-after-free in shinker's callback     The mmap read lock is used during the shrinker's callback, which means     that using alloc->vma pointer isn't safe as it can race with munmap().
    As of commit dd2283f2605e (mm: mmap: zap pages with read mmap_sem in     munmap) the mmap lock is downgraded after the vma has been isolated.
    I was able to reproduce this issue by manually adding some delays and     triggering page reclaiming through the shrinker's debug sysfs. The     following KASAN report confirms the UAF:
    ==================================================================     BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8     Read of size 8 at addr ffff356ed50e50f0 by task bash/478     CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70     Hardware name: linux,dummy-virt (DT)     Call trace:
    zap_page_range_single+0x470/0x4b8     binder_alloc_free_page+0x608/0xadc
    __list_lru_walk_one+0x130/0x3b0     list_lru_walk_node+0xc4/0x22c     binder_shrink_scan+0x108/0x1dc     shrinker_debugfs_scan_write+0x2b4/0x500     full_proxy_write+0xd4/0x140     vfs_write+0x1ac/0x758     ksys_write+0xf0/0x1dc
    __arm64_sys_write+0x6c/0x9c     Allocated by task 492:
    kmem_cache_alloc+0x130/0x368     vm_area_alloc+0x2c/0x190     mmap_region+0x258/0x18bc     do_mmap+0x694/0xa60     vm_mmap_pgoff+0x170/0x29c     ksys_mmap_pgoff+0x290/0x3a0
    __arm64_sys_mmap+0xcc/0x144     Freed by task 491:
    kmem_cache_free+0x17c/0x3c8     vm_area_free_rcu_cb+0x74/0x98     rcu_core+0xa38/0x26d4     rcu_core_si+0x10/0x1c
    __do_softirq+0x2fc/0xd24     Last potentially related work creation:
    __call_rcu_common.constprop.0+0x6c/0xba0     call_rcu+0x10/0x1c     vm_area_free+0x18/0x24     remove_vma+0xe4/0x118     do_vmi_align_munmap.isra.0+0x718/0xb5c     do_vmi_munmap+0xdc/0x1fc
    __vm_munmap+0x10c/0x278
    __arm64_sys_munmap+0x58/0x7c     Fix this issue by performing instead a vma_lookup() which will fail to     find the vma that was isolated before the mmap lock downgrade. Note that     this option has better performance than upgrading to a mmap write lock     which would increase contention. Plus, mmap_write_trylock() has been     recently removed anyway.

    CVE-2023-5717:
    A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation.
    If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it     can increment or write to memory locations outside of the allocated buffer.
    We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

    CVE-2023-6176:
    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system.

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.
    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().
    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

    CVE-2023-6932:
    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.
    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.
    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.
    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.
    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2024-22099:
    NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth     modules) allows Overflow Buffers. This vulnerability is associated with program files     /net/bluetooth/rfcomm/core.C.
    This issue affects Linux kernel: v2.6.12-rc2.

    CVE-2024-24855:
    A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue.

    CVE-2024-24860:
    A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue.

    CVE-2024-26597:
    In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob     in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-     bounds read when parsing the netlink attributes. See bug trace below:
    ==================================================================     BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline]     BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at     addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N     6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call     Trace: < TASK > __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395     kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline]
    __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697     nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] __rtnl_newlink+0x50a/0x1880     net/core/rtnetlink.c:3485 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43c/0xd70     net/core/rtnetlink.c:6091 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 netlink_unicast_kernel     net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345     netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline]     sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482
    ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdcf2072359 Code: 28 00 00 00 75 05 48 83 c4 28 c3     e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246     ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 RDX:
    0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007fdcf20bd493 R08: 0000000000000000     R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13:
    00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 < /TASK > The buggy address belongs to the     variable: rmnet_policy+0x30/0xe0 The buggy address belongs to the physical page: page:0000000065bdeb3c     refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 flags:
    0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8     0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped     because: kasan: bad access detected Memory state around the buggy address: ffffffff92c43780: f9 f9 f9 f9     00 00 00 02 f9 f9 f9 f9 00 00 00 07 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9     >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 ^ ffffffff92c43900: 00 00 00 00 00 00     00 00 07 f9 f9 f9 f9 f9 f9 f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According     to the comment of `nla_parse_nested_deprecated`, the maxtype should be len(destination array) - 1. Hence     use `IFLA_RMNET_MAX` here.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. This vulnerability is associated with program files /net/bluetooth/rfcomm/core.C.  This issue affects Linux kernel:
v2.6.12-rc2.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
194976	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:1490-1)	Nessus	SuSE Local Security Checks	2024/5/4	2025/9/24	high
201099	Debian dla-3840 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	2024/6/27	2025/10/31	high
235960	Alibaba Cloud Linux 3 : 0017: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2024:0017)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
503721	Siemens SIMATIC Devices NULL Pointer Dereference (CVE-2024-22099)	Tenable OT Security	Tenable.ot	2025/10/27	2025/10/29	medium

偵測

搜尋 Plugin

high

high

high

medium