Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - xsk修正刪除元素時的 OOB 地圖寫入 Jordy說在 xsk_map_delete_elem 函式中會將未簽署的整數 (map->max_entries) 與使用者控制的已簽署整數 (k) 進行比較。由於隱含類型轉換map->max_entries 的無正負號大值可繞過預定的邊界檢查 if (k >= map->max_entries) return -EINVAL;這可讓 k 保留一個負值 (介於 -2147483648 和 -2 之間)然後作為 m->xsk_map[k] 中的陣列索引使用進而導致超出邊界存取。
    spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // 超出邊界 map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry);
    spin_unlock_bh(&m->lock);然後可利用 xchg 作業來造成超出邊界寫入。此外傳遞至 xsk_map_sock_delete 的無效 map_entry 可導致進一步的記憶體損毀。這確實會導致下列錯誤 [76612.897343] 錯誤無法處理 ffffc8fc2e461108 位址的頁面錯誤 [76612.904330] #PF核心模式中的監督寫入存取 [76612.909639] #PFerror_code(0x0002) - 不存在頁面 [76612.914855] PGD 0 P4D 0 [76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP [76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out 未受污染的 6.12.0-rc1+ #470 [76612.929189] 硬體名稱Intel Corporation S2600WFT/S2600WFT、BIOS SE5C620.86B.02.01.0008.031920191559 2019 年 3 月 19 日 [76612.939781] RIP
    0010:xsk_map_delete_elem+0x2d/0x60 [76612.944738] 代碼00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 4 8 8 4 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31 [76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246 [76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX0000000000000000 [76612.976323] RDX
    0000000000000001 RSIffffc8fc2e461108 RDI 0000000000000000 [76612.983569] RBPffffffff80000001 R08
    0000000000000000 R090000000000000007 [76612.990812] R10ffffc9002e407e18 R11ffff888108a38858 R12
    ffffc9002e4610f8 [76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0 [76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000 [76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0 0000000080050033 [76613.019349] CR2ffffc8fc2e461108 CR3
    000000011e3ef001 CR400000000007726f0 [76613.026595] DR00000000000000000 DR10000000000000000 DR2
    0000000000000000 [76613.033841] DR30000000000000000 DR600000000fffe0ff0 DR70000000000000400 [76613.041086] PKRU55555554 [76613.043842] 呼叫追踪 [76613.046331] ] <TASK> [76613.048468]
    __die+0x20/0x60 [76613.051581] ? page_fault_oops+0x15a/0x450 [76613.055747] ? search_extable+0x22/0x30 [76613.059649] ? search_bpf_extables+0x5f/0x80 [76613.063988] ? exc_page_fault+0xa9/0x140 [76613.067975] ? asm_exc_page_fault+0x22/0x30 [76613.072229] ? xsk_map_delete_elem+0x2d/0x60 [76613.076573] xsk_map_delete_elem+0x23/0x60 [76613.080914] __sys_bpf+0x19b7/0x23c0 [76613.084555]
    __x64_sys_bpf+0x1a/0x20 [76613.088194] do_syscall_64+0x37/0xb0 [76613.091832] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [76613.096962] RIP 0033:0x7f80b6d1e88d [76613.100592] 代碼5b 41 5c 5c 3 66 0f 1008 c3 66 0f 1f 008 c3 66 0f 1f 008 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f 46 89 01 48 [76613.119631] RSP
    002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d [76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003 [76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000 [76613.166030] R1000007f80b6f77040 R110000000000000206 R1200007ffd1ae0aed8 [76613.177130] R13
    000055ddf42ce1e9 R14000055ddf42d0d98 R1500 ---truncated--- (CVE-2024-56614)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2024-56614

high Nessus Plugin ID 230351

版本 1.8