The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1988 advisory.

  - In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual     root cause. This could lead to local escalation of privilege in the kernel with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream kernel (CVE-2020-0404)

  - IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive     information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
    (CVE-2020-4788)

  - An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer     overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community     argue that the integer overflow does not lead to a security issue in this case. (CVE-2020-13974)

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References:
    Upstream kernel (CVE-2021-0941)

  - An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions     before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the     system or possibly escalate their privileges on the system. The highest threat from this vulnerability is     to confidentiality, integrity, as well as system availability. (CVE-2021-3612)

  - An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel.
    A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system     crash or a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-3743)

  - A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in     drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption).
    This vulnerability is similar with the older CVE-2019-18808. (CVE-2021-3744)

  - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to     the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the     system or escalate their privileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-3752)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint     information for further use in traditional network attacks. (CVE-2021-3773)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux     kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source     port randomization are indirectly affected as well. (CVE-2021-20322)

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process's     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
    (CVE-2021-26401)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows     unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds     write. (CVE-2021-41864)

  - A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user     calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or     escalate privileges on the system. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-42739)

  - An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to     crash the host, when the host is running on Power8, due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S     implementation bug in the handling of the SRR1 register values. (CVE-2021-43056)

  - An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in     the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. (CVE-2021-43389)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local     denial of service. (CVE-2022-0286)

  - A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network     protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more     buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). (CVE-2022-0322)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1988 advisory.

    - netfilter: nf_tables_offload: incorrect flow offload action array size (Florian Westphal) [2056728]     {CVE-2022-25636}
    - RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032074] {CVE-2021-4028}
    - x86/speculation: Check CPU capability before applying IBRS spectre v2 mitigation (Waiman Long) [2062156     2062166] {CVE-2022-0001 CVE-2022-0002 CVE-2021-26401}
    - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT (Waiman Long) [2062156 2062166]     {CVE-2022-0001 CVE-2022-0002 CVE-2021-26401}
    - x86/speculation: Warn about Spectre v2 LFENCE mitigation (Waiman Long) [2062156 2062166] {CVE-2022-0001     CVE-2022-0002 CVE-2021-26401}
    - x86/speculation: Update link to AMD speculation whitepaper (Waiman Long) [2062166] {CVE-2021-26401}
    - x86/speculation: Use generic retpoline by default on AMD (Waiman Long) [2062166] {CVE-2021-26401}
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Waiman Long)     [2062156] {CVE-2022-0001 CVE-2022-0002}
    - Documentation/hw-vuln: Update spectre doc (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
    - x86/speculation: Add eIBRS + Retpoline options (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Waiman Long) [2062156] {CVE-2022-0001     CVE-2022-0002}
    - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd (Waiman Long) [2062156] {CVE-2022-0001     CVE-2022-0002}
    - x86: deduplicate the spectre_v2_user documentation (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
    - fuse: fix pipe buffer lifetime for direct_io (Miklos Szeredi) [2064863] {CVE-2022-1011}
    - tipc: improve size validations for received domain records (Xin Long) [2048971] {CVE-2022-0435}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
161093	AlmaLinux 8 : kernel (ALSA-2022:1988)	Nessus	Alma Linux Local Security Checks	2022/5/12	2022/5/18	critical
161305	Oracle Linux 8 : kernel (ELSA-2022-1988)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/11/1	critical

偵測

搜尋 Plugin

critical

critical