Linux Distros 未修補弱點：CVE-2023-52786
low Nessus Plugin ID 227428
語言:
概要
Linux/Unix 主機上安裝的一個或多個套件存有弱點，供應商表示將不會修補。說明
Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。- 在 Linux 核心中，已解決下列弱點： ext4: fix racy may inline data check in dio write syzbot reports that the following warning from ext4_iomap_begin() triggers as of the commit referenced below: if (WARN_ON_ONCE(ext4_has_inline_data(inode))) return -ERANGE; This occurs during a dio write, which is never expected to encounter an inode with inline data. To enforce this behavior, ext4_dio_write_iter() checks the current inline state of the inode and clears the MAY_INLINE_DATA state flag to either fall back to buffered writes, or enforce that any other writers in progress on the inode are not allowed to create inline data. The problem is that the check for existing inline data and the state flag can span a lock cycle. For example, if the ilock is originally locked shared and subsequently upgraded to exclusive, another writer may have reacquired the lock and created inline data before the dio write task acquires the lock and proceeds. The commit referenced below loosens the lock requirements to allow some forms of unaligned dio writes to occur under shared lock, but AFAICT the inline data check was technically already racy for any dio write that would have involved a lock cycle. Regardless, lift clearing of the state bit to the same lock critical section that checks for preexisting inline data on the inode to close the race. (CVE-2023-52786)
請注意，Nessus 依賴供應商報告的套件存在。
解決方案
目前尚未有已知的解決方案。Plugin 詳細資訊
嚴重性: Low
ID: 227428
檔案名稱: unpatched_CVE_2023_52786.nasl
版本: 1.1
類型: local
代理程式: unix
系列: Misc.
已發布: 2025/3/5
已更新: 2025/3/5
支援的感應器: Nessus Agent, Nessus
風險資訊
VPR
風險因素: Low
分數: 2.5
CVSS v2
風險因素: Low
基本分數: 2.4
時間性分數: 1.8
媒介: CVSS2#AV:L/AC:H/Au:S/C:N/I:P/A:P
CVSS 評分資料來源: CVE-2023-52786
CVSS v3
風險因素: Low
基本分數: 3.6
時間性分數: 3.2
媒介: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
時間媒介: CVSS:3.0/E:U/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, global_settings/vendor_unpatched
可輕鬆利用: No known exploits are available
弱點發布日期: 2024/5/21
參考資訊
CVE: CVE-2023-52786