The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5232 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-1966)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * XFS inode cluster corruption (BZ#2050464)

    * sock: sock_dequeue_err_skb() needs hard irq safety (BZ#2070408)

    * libceph: fix potential use-after-free on linger ping and resends (BZ#2088025)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5806 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5232 advisory.

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a     duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this     candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2022-1966)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel (CVE-2021-39686)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients. (CVE-2022-1678)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-33981. Reason: This candidate is a     reservation duplicate of CVE-2022-33981. Notes: All CVE users should reference CVE-2022-33981 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2022-1836)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5602-1 advisory.

    Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux     kernel performed insufficient control flow management. A local attacker could possibly use this to cause a     denial of service. (CVE-2021-33061)

    Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not     provide sufficient randomization when calculating port offsets. An attacker could possibly use this to     expose sensitive information. (CVE-2022-1012)

    Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel,     resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

    Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux     kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference.
    An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS.
    (CVE-2022-1852)

    It was discovered that the UDF file system implementation in the Linux kernel contained an out-of-bounds     write vulnerability. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-1943)

    Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle     certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to     cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

    It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly     verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

    Zheyu Ma discovered that the Intel iSMT SMBus host controller driver in the Linux kernel contained an out-     of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system     crash). (CVE-2022-2873)

    Selim Enes Karaduman discovered that a race condition existed in the pipe buffers implementation of the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     escalate privileges. (CVE-2022-2959)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2078-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated.

    The following security bugs were fixed:

    - CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
    - CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in     mmc_blk_read_single of block.c. (bnc#1199564)
    - CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
    - CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs     filesystem image. (bnc#1158266)
    - CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
    - CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a     corrupted image. (bsc#1198577)
    - CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
    - CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
    - CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers     and Adapters that may have allowed an authenticated user to potentially enable denial of service via local     access (bnc#1196426).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2111-1 advisory.

    The SUSE Linux Enterprise 15 SP1 kernel was updated.

    The following security bugs were fixed:

    - CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently     disclose information via spectre like attacks. (bsc#1199650)
    - CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs     filesystem image. (bnc#1158266)
    - CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a     corrupted image. (bsc#1198577)
    - CVE-2017-13695: Fixed a bug that caused a stack dump allowing local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table.
    (bnc#1055710)
    - CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
    - CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
    - CVE-2021-39711: In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to     Incorrect Size Value. This could lead to local information disclosure with System execution privileges     needed. User interaction is not needed for exploitation (bnc#1197219).
    - CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
    - CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers     and Adapters that may have allowed an authenticated user to potentially enable denial of service via local     access (bnc#1196426).
    - CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
    - CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users     do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system     (bnc#1191647).
    - CVE-2019-20811: Fixed issue in rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-     sysfs.c, where a reference count is mishandled (bnc#1172456).
    - CVE-2022-28748: Fixed memory lead over the network by ax88179_178a devices (bsc#1196018).
    - CVE-2018-7755: Fixed an issue in the fd_locked_ioctl function in drivers/block/floppy.c. The floppy     driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send     the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data     and bypass kernel security protections such as KASLR (bnc#1084513).
    - CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
    - CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
    - CVE-2021-43389: Fixed an array-index-out-of-bounds flaw in the detach_capi_ctr function in     drivers/isdn/capi/kcapi.c (bnc#1191958).
    - CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname     call after a certain type of failure of a bind call (bnc#1187055).
    - CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c     (bnc#1198516).
    - CVE-2021-20292: Fixed object validation prior to performing operations on the object in     nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
    - CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve     (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems.
    (bnc#1197343)
    - CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from     user-space. (bsc#1200144).
    - CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism.
    (bnc#1177282)
    - CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device     from user-space. (bsc#1200143)
    - CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it     with kgdb or kdb. (bsc#1199426)
    - CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware     download routine. (bnc#1199605).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23037)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - Due to the small table perturb size, a memory leak flaw was found in the Linux kernel's TCP source port     generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and     may cause a denial of service. (CVE-2022-1012)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel.This flaw     allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of     internal kernel information. (CVE-2022-1353)

  - Kernel-headers includes the C header files that specify the interfacebetween the Linux kernel and     userspace libraries and programs.  Theheader files define structures and constants that are needed     forbuilding most standard programs and are also needed for rebuilding theglibc package. (CVE-2022-1729)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation. (CVE-2022-20132)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23037)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

  - The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges. (CVE-2022-36123)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
162583	RHEL 7 : kernel (RHSA-2022:5232)	Nessus	Red Hat Local Security Checks	2022/6/28	2025/9/12	high
163696	RHEL 7 : kernel (RHSA-2022:5806)	Nessus	Red Hat Local Security Checks	2022/8/2	2024/11/7	high
163735	CentOS 7 : kernel (RHSA-2022:5232)	Nessus	CentOS Local Security Checks	2022/8/2	2024/10/10	high
164207	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2244)	Nessus	Huawei Local Security Checks	2022/8/17	2024/1/16	high
164891	Ubuntu 22.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-5602-1)	Nessus	Ubuntu Local Security Checks	2022/9/8	2024/8/27	high
162239	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:2078-1)	Nessus	SuSE Local Security Checks	2022/6/15	2025/9/24	high
162399	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2111-1)	Nessus	SuSE Local Security Checks	2022/6/18	2025/9/24	high
162908	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2022-1999)	Nessus	Huawei Local Security Checks	2022/7/8	2023/1/6	high
165388	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2022-2384)	Nessus	Huawei Local Security Checks	2022/9/23	2023/1/13	high
166644	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2022-2619)	Nessus	Huawei Local Security Checks	2022/10/27	2023/1/13	high
173106	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/8/22	high
501081	Siemens SCALANCE XCM332 Concurrent Execution Using Shared Resource with Improper Synchronization (CVE-2022-1729)	Tenable OT Security	Tenable.ot	2023/5/2	2025/3/10	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high