u/retroisbest

Wazuh 4.14.8

Shows numerous CVE vulnerabilities for hosts running Ubuntu 24.04.5 LTS

Some of these date back to 2012

I have 34 pages of CVE vulnerabilities (I will paste a few below)

CVE-2012-4542

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.

-

CVE-2013-7445

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended securelevel/secureboot restrictions by leveraging improper handling of secure_boot flag across kexec reboot.

Medium

CVE-2015-7837

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation."

Medium

CVE-2016-8660

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-31614969.

Medium

CVE-2017-0537

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

An elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937.

Medium

CVE-2017-13165

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.

Medium

CVE-2017-13693

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.

Medium

CVE-2017-13694

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.

Low

CVE-2018-1121

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem.

Medium

CVE-2018-12928

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem.

Medium

CVE-2018-12929

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.

High

CVE-2018-12930

time

linux-image-7.0.0-34-generic

7.0.0-34.34~24.04.1

ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.

High

CVE-2018-12931

I know I can create a rule to silence these but I want to know why, is it because they are not being matched correctly with CTI information?

https://preview.redd.it/yc5l4cf5e0th1.png?width=695&format=png&auto=webp&s=83344de90ed1ee45616ab5780e8c513984f60293

The above hosts are fully updated 24.04.5 LTS servers, with each new kernel that gets downloaded it increases by a similar amount, removing the old kernels brings it back down to the figures shown in the image

Thanks