The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2232-1 advisory.
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
(CVE-2017-5753)
An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference. (CVE-2020-36691)
A flaw was found in the Linux kernel’s implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)
A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)
In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References:
Upstream kernel (CVE-2022-20567)
The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CVE-2022-43945)
A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)
A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters. (CVE-2023-1076)
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
– the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)
A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. (CVE-2023-1118)
A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue.
Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition. (CVE-2023-1390)
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. (CVE-2023-1513)
A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea (CVE-2023-1611)
A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
(CVE-2023-1670)
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem.
(CVE-2023-1855)
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. (CVE-2023-1989)
A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem. (CVE-2023-1990)
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection.
However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. (CVE-2023-1998)
An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2023-2124)
A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
(CVE-2023-2162)
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23455)
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device.
This flaw allows a local user to crash the system or potentially cause a denial of service.
(CVE-2023-28328)
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation. (CVE-2023-28464)
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow. (CVE-2023-28772)
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device.
(CVE-2023-30772)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# SUSE update advisory SUSE-SU-2023:2232-1. The text itself
# is copyright (C) SUSE.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(176058);
script_version("1.4");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/13");
script_cve_id(
"CVE-2017-5753",
"CVE-2020-36691",
"CVE-2021-3923",
"CVE-2021-4203",
"CVE-2022-20567",
"CVE-2022-43945",
"CVE-2023-0394",
"CVE-2023-0590",
"CVE-2023-0597",
"CVE-2023-1076",
"CVE-2023-1095",
"CVE-2023-1118",
"CVE-2023-1390",
"CVE-2023-1513",
"CVE-2023-1611",
"CVE-2023-1670",
"CVE-2023-1855",
"CVE-2023-1989",
"CVE-2023-1990",
"CVE-2023-1998",
"CVE-2023-2124",
"CVE-2023-2162",
"CVE-2023-2483",
"CVE-2023-23454",
"CVE-2023-23455",
"CVE-2023-28328",
"CVE-2023-28464",
"CVE-2023-28772",
"CVE-2023-30772"
);
script_xref(name:"SuSE", value:"SUSE-SU-2023:2232-1");
script_name(english:"SUSE SLES12 Security Update : kernel (SUSE-SU-2023:2232-1)");
script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in
the SUSE-SU-2023:2232-1 advisory.
- Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via a side-channel analysis.
(CVE-2017-5753)
- An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of
service (unbounded recursion) via a nested Netlink policy with a back reference. (CVE-2020-36691)
- A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a
privileged local account can leak kernel stack information when issuing commands to the
/dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it
can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)
- A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and
SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a
user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)
- In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could
lead to local escalation of privilege with System execution privileges needed. User interaction is not
needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References:
Upstream kernel (CVE-2022-20567)
- The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer
overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send
buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer
to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC
message with garbage data is still correctly formed according to the specification and is passed forward
to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the
allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CVE-2022-43945)
- A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network
subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)
- A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race
problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race
condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)
- A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was
found in the way user can guess location of exception stack(s) or other important data. A local user could
use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)
- A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a
type confusion in their initialization function. While it will be often correct, as tuntap devices require
CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This
would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing
network filters. (CVE-2023-1076)
- In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the
transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
-- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)
- A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the
way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate
their privileges on the system. (CVE-2023-1118)
- A remote denial of service vulnerability was found in the Linux kernel's TIPC kernel module. The while
loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue.
Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system
to instantly spike to 100%, causing a denial of service condition. (CVE-2023-1390)
- A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some
uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an
information leak. (CVE-2023-1513)
- A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This
flaw allows an attacker to crash the system and possibly cause a kernel information lea (CVE-2023-1611)
- A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local
user could use this flaw to crash the system or potentially escalate their privileges on the system.
(CVE-2023-1670)
- A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware
Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system
due to a race problem. This vulnerability could even lead to a kernel information leak problem.
(CVE-2023-1855)
- A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In
this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on
hdev devices. (CVE-2023-1989)
- A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw
could allow an attacker to crash the system due to a race problem. (CVE-2023-1990)
- The Linux kernel allows userspace processes to enable mitigations by calling prctl with
PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed
that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to
attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be
observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened
because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that
STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection.
However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons,
which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target
injection against which STIBP protects. (CVE-2023-1998)
- An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores
an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or
potentially escalate their privileges on the system. (CVE-2023-2124)
- A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in
SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
(CVE-2023-2162)
- cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial
of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes
indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)
- atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial
of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition
rather than valid classification results). (CVE-2023-23455)
- A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in
the Linux Kernel. The message from user space is not checked properly before transferring into the device.
This flaw allows a local user to crash the system or potentially cause a denial of service.
(CVE-2023-28328)
- hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free
(observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free
that may lead to privilege escalation. (CVE-2023-28464)
- An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer
overflow. (CVE-2023-28772)
- The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in
drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device.
(CVE-2023-30772)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1076830");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194535");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1202353");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1205128");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1207036");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1207125");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1207168");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1207185");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1207795");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1207845");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1208179");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1208333");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1208599");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1208777");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1208837");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1208850");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209008");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209052");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209256");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209289");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209291");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209532");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209547");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209549");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209613");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209687");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209777");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209778");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209845");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209871");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209887");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210124");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210202");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210301");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210329");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210336");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210337");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210469");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210498");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210506");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1210647");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1211037");
script_set_attribute(attribute:"see_also", value:"https://lists.suse.com/pipermail/sle-updates/2023-May/029439.html");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2017-5753");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-36691");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-3923");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-4203");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-20567");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-43945");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-0394");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-0590");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-0597");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1076");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1095");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1118");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1390");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1513");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1611");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1670");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1855");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1989");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1990");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1998");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-2124");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-2162");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-23454");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-23455");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-2483");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-28328");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-28464");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-28772");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-30772");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:P");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-4203");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2023-28464");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
script_set_attribute(attribute:"canvas_package", value:"CANVAS");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/01/03");
script_set_attribute(attribute:"patch_publication_date", value:"2023/07/06");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/05/18");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cluster-md-kmp-default");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:dlm-kmp-default");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:drbd");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:drbd-kmp-default");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:gfs2-kmp-default");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-base");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-kgraft");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-kgraft-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-man");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-macros");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-source");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-syms");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kgraft-patch-4_12_14-95_125-default");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ocfs2-kmp-default");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"SuSE Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item("Host/SuSE/release");
if (isnull(os_release) || os_release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
var os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES12', 'SUSE (' + os_ver + ')');
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);
var service_pack = get_kb_item("Host/SuSE/patchlevel");
if (isnull(service_pack)) service_pack = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(4)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES12 SP4", os_ver + " SP" + service_pack);
var pkgs = [
{'reference':'cluster-md-kmp-default-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-ha-release-12.4']},
{'reference':'dlm-kmp-default-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-ha-release-12.4']},
{'reference':'drbd-9.0.14+git.62f906cf-4.26.2', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-ha-release-12.4']},
{'reference':'drbd-kmp-default-9.0.14+git.62f906cf_k4.12.14_95.125-4.26.2', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-ha-release-12.4']},
{'reference':'gfs2-kmp-default-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-ha-release-12.4']},
{'reference':'ocfs2-kmp-default-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-ha-release-12.4']},
{'reference':'kernel-default-kgraft-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-live-patching-release-12.4']},
{'reference':'kernel-default-kgraft-devel-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-live-patching-release-12.4']},
{'reference':'kgraft-patch-4_12_14-95_125-default-1-6.5.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-live-patching-release-12.4']},
{'reference':'kernel-default-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.4']},
{'reference':'kernel-default-base-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.4']},
{'reference':'kernel-default-devel-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.4']},
{'reference':'kernel-default-man-4.12.14-95.125.1', 'sp':'4', 'cpu':'s390x', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.4']},
{'reference':'kernel-devel-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.4']},
{'reference':'kernel-macros-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.4']},
{'reference':'kernel-source-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.4']},
{'reference':'kernel-syms-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-12.4']},
{'reference':'kernel-default-4.12.14-95.125.1', 'sp':'4', 'cpu':'aarch64', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-default-4.12.14-95.125.1', 'sp':'4', 'cpu':'x86_64', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-default-base-4.12.14-95.125.1', 'sp':'4', 'cpu':'aarch64', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-default-base-4.12.14-95.125.1', 'sp':'4', 'cpu':'x86_64', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-default-devel-4.12.14-95.125.1', 'sp':'4', 'cpu':'aarch64', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-default-devel-4.12.14-95.125.1', 'sp':'4', 'cpu':'x86_64', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-devel-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-macros-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-source-4.12.14-95.125.1', 'sp':'4', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-syms-4.12.14-95.125.1', 'sp':'4', 'cpu':'aarch64', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']},
{'reference':'kernel-syms-4.12.14-95.125.1', 'sp':'4', 'cpu':'x86_64', 'release':'SLES12', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-release-4']}
];
var ltss_caveat_required = FALSE;
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var exists_check = NULL;
var rpm_spec_vers_cmp = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (reference && _release) {
if (exists_check) {
var check_flag = 0;
foreach var check (exists_check) {
if (!rpm_exists(release:_release, rpm:check)) continue;
if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;
check_flag++;
}
if (!check_flag) continue;
}
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
}
}
if (flag)
{
var ltss_plugin_caveat = NULL;
if(ltss_caveat_required) ltss_plugin_caveat = '\n' +
'NOTE: This vulnerability check contains fixes that apply to\n' +
'packages only available in SUSE Enterprise Linux Server LTSS\n' +
'repositories. Access to these package security updates require\n' +
'a paid SUSE LTSS subscription.\n';
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get() + ltss_plugin_caveat
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'cluster-md-kmp-default / dlm-kmp-default / drbd / drbd-kmp-default / etc');
}
Vendor | Product | Version | CPE |
---|---|---|---|
novell | suse_linux | 12 | cpe:/o:novell:suse_linux:12 |
novell | suse_linux | kernel-default | p-cpe:/a:novell:suse_linux:kernel-default |
novell | suse_linux | kernel-source | p-cpe:/a:novell:suse_linux:kernel-source |
novell | suse_linux | kernel-syms | p-cpe:/a:novell:suse_linux:kernel-syms |
novell | suse_linux | kernel-default-base | p-cpe:/a:novell:suse_linux:kernel-default-base |
novell | suse_linux | kernel-default-devel | p-cpe:/a:novell:suse_linux:kernel-default-devel |
novell | suse_linux | kernel-default-man | p-cpe:/a:novell:suse_linux:kernel-default-man |
novell | suse_linux | kernel-default-kgraft | p-cpe:/a:novell:suse_linux:kernel-default-kgraft |
novell | suse_linux | cluster-md-kmp-default | p-cpe:/a:novell:suse_linux:cluster-md-kmp-default |
novell | suse_linux | dlm-kmp-default | p-cpe:/a:novell:suse_linux:dlm-kmp-default |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5753
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36691
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3923
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4203
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20567
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43945
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0394
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0590
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0597
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1076
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1095
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1118
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1390
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1513
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1611
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1670
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1855
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1989
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1990
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1998
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2124
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2162
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23454
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23455
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2483
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28328
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28464
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28772
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30772
bugzilla.suse.com/1076830
bugzilla.suse.com/1194535
bugzilla.suse.com/1202353
bugzilla.suse.com/1205128
bugzilla.suse.com/1207036
bugzilla.suse.com/1207125
bugzilla.suse.com/1207168
bugzilla.suse.com/1207185
bugzilla.suse.com/1207795
bugzilla.suse.com/1207845
bugzilla.suse.com/1208179
bugzilla.suse.com/1208333
bugzilla.suse.com/1208599
bugzilla.suse.com/1208777
bugzilla.suse.com/1208837
bugzilla.suse.com/1208850
bugzilla.suse.com/1209008
bugzilla.suse.com/1209052
bugzilla.suse.com/1209256
bugzilla.suse.com/1209289
bugzilla.suse.com/1209291
bugzilla.suse.com/1209532
bugzilla.suse.com/1209547
bugzilla.suse.com/1209549
bugzilla.suse.com/1209613
bugzilla.suse.com/1209687
bugzilla.suse.com/1209777
bugzilla.suse.com/1209778
bugzilla.suse.com/1209845
bugzilla.suse.com/1209871
bugzilla.suse.com/1209887
bugzilla.suse.com/1210124
bugzilla.suse.com/1210202
bugzilla.suse.com/1210301
bugzilla.suse.com/1210329
bugzilla.suse.com/1210336
bugzilla.suse.com/1210337
bugzilla.suse.com/1210469
bugzilla.suse.com/1210498
bugzilla.suse.com/1210506
bugzilla.suse.com/1210647
bugzilla.suse.com/1211037
lists.suse.com/pipermail/sle-updates/2023-May/029439.html
www.suse.com/security/cve/CVE-2017-5753
www.suse.com/security/cve/CVE-2020-36691
www.suse.com/security/cve/CVE-2021-3923
www.suse.com/security/cve/CVE-2021-4203
www.suse.com/security/cve/CVE-2022-20567
www.suse.com/security/cve/CVE-2022-43945
www.suse.com/security/cve/CVE-2023-0394
www.suse.com/security/cve/CVE-2023-0590
www.suse.com/security/cve/CVE-2023-0597
www.suse.com/security/cve/CVE-2023-1076
www.suse.com/security/cve/CVE-2023-1095
www.suse.com/security/cve/CVE-2023-1118
www.suse.com/security/cve/CVE-2023-1390
www.suse.com/security/cve/CVE-2023-1513
www.suse.com/security/cve/CVE-2023-1611
www.suse.com/security/cve/CVE-2023-1670
www.suse.com/security/cve/CVE-2023-1855
www.suse.com/security/cve/CVE-2023-1989
www.suse.com/security/cve/CVE-2023-1990
www.suse.com/security/cve/CVE-2023-1998
www.suse.com/security/cve/CVE-2023-2124
www.suse.com/security/cve/CVE-2023-2162
www.suse.com/security/cve/CVE-2023-23454
www.suse.com/security/cve/CVE-2023-23455
www.suse.com/security/cve/CVE-2023-2483
www.suse.com/security/cve/CVE-2023-28328
www.suse.com/security/cve/CVE-2023-28464
www.suse.com/security/cve/CVE-2023-28772
www.suse.com/security/cve/CVE-2023-30772