概要
Linux/Unix 主機上安裝的一個或多個套件存有弱點,供應商表示將不會修補。
說明
Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件,且供應商未提供可用的修補程式。
- 在 Linux 核心中,已解決下列弱點: serial/pmac_zilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console: ttyPZ0: pmz: rx irq flood ! BUG: spinlock recursion on CPU#0, swapper/0 That's because the pr_err() call in pmz_receive_chars() results in pmz_console_write() attempting to lock a spinlock already locked in pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal BUG splat. The spinlock in question is the one in struct uart_port. Even when it's not fatal, the serial port rx function ceases to work. Also, the iteration limit doesn't play nicely with QEMU, as can be seen in the bug report linked below. A web search for other reports of the error message pmz: rx irq flood didn't produce anything. So I don't think this code is needed any more. Remove it. (CVE-2024-26999)
請注意,Nessus 依賴供應商報告的套件存在。
Plugin 詳細資訊
檔案名稱: unpatched_CVE_2024_26999.nasl
代理程式: unix
支援的感應器: Nessus Agent, Nessus
風險資訊
媒介: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C
媒介: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
時間媒介: CVSS:3.0/E:U/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, global_settings/vendor_unpatched
可輕鬆利用: No known exploits are available