概要
Linux/Unix 主機上安裝的一個或多個套件存有弱點,供應商表示將不會修補。
說明
Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件,且供應商未提供可用的修補程式。
- 在 Linux 核心中,已解決下列弱點: sch_cake: Fix out of bounds when parsing TCP options and header The TCP option parser in cake qdisc (cake_get_tcpopt and cake_tcph_may_drop) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 (ipv4:
tcp_input: fix stack out of bounds when parsing TCP options.). v2 changes: Added doff validation in cake_get_tcphdr to avoid parsing garbage as TCP header. Although it wasn't strictly an out-of-bounds access (memory was allocated), garbage values could be read where CAKE expected the TCP header if doff was smaller than 5. (CVE-2021-47243)
請注意,Nessus 依賴供應商報告的套件存在。
Plugin 詳細資訊
檔案名稱: unpatched_CVE_2021_47243.nasl
代理程式: unix
支援的感應器: Nessus Agent, Nessus
風險資訊
媒介: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C
媒介: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
時間媒介: CVSS:3.0/E:U/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, global_settings/vendor_unpatched
可輕鬆利用: No known exploits are available