Linux Distros 未修補弱點：CVE-2024-26846
medium Nessus Plugin ID 227686
語言:
概要
Linux/Unix 主機上安裝的一個或多個套件存有弱點，供應商表示將不會修補。說明
Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。- 在 Linux 核心中，已解決下列弱點： nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl and ida_destroy has been added by the initial commit. There is some logic around trying to prevent from hanging forever in wait_for_completion, though it does not handling all cases. E.g. blktests is able to reproduce the situation where the module unload hangs forever. If we completely rely on the cleanup code executed from the nvme_delete_ctrl path, all IDs will be freed eventually. This makes calling ida_destroy unnecessary.
We only have to ensure that all nvme_delete_ctrl code has been executed before we leave nvme_fc_exit_module. This is done by flushing the nvme_delete_wq workqueue. While at it, remove the unused nvme_fc_wq workqueue too. (CVE-2024-26846)
請注意，Nessus 依賴供應商報告的套件存在。
解決方案
目前尚未有已知的解決方案。Plugin 詳細資訊
嚴重性: Medium
ID: 227686
檔案名稱: unpatched_CVE_2024_26846.nasl
版本: 1.1
類型: local
代理程式: unix
系列: Misc.
已發布: 2025/3/5
已更新: 2025/3/5
支援的感應器: Nessus Agent, Nessus
風險資訊
VPR
風險因素: Medium
分數: 4.4
CVSS v2
風險因素: Medium
基本分數: 4.3
時間性分數: 3.2
媒介: CVSS2#AV:L/AC:L/Au:M/C:N/I:N/A:C
CVSS 評分資料來源: CVE-2024-26846
CVSS v3
風險因素: Medium
基本分數: 4.4
時間性分數: 3.9
媒介: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
時間媒介: CVSS:3.0/E:U/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, global_settings/vendor_unpatched
可輕鬆利用: No known exploits are available
弱點發布日期: 2021/7/21
參考資訊
CVE: CVE-2024-26846