Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 已解決 Linux 核心中的下列弱點：bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n. In particular, the report is on tcp_congestion_ops that has a struct module *owner member. For struct_ops that has a struct module *owner member, it can be extended either by the regular kernel module or by the bpf_struct_ops. bpf_try_module_get() will be used to do the refcounting and different refcount is done based on the owner pointer. When CONFIG_MODULES=n, the btf_id of the struct module is missing: WARN: resolve_btfids: unresolved symbol module Thus, the bpf_try_module_get() cannot do the correct refcounting. Not all subsystem's struct_ops requires the struct module *owner member.
    e.g. the recent sched_ext_ops. This patch is to disable bpf_struct_ops registration if the struct_ops has the struct module * member and the struct module btf_id is missing. The btf_type_is_fwd() helper is moved to the btf.h header file for this test. This has happened since the beginning of bpf_struct_ops which has gone through many changes. The Fixes tag is set to a recent commit that this patch can apply cleanly. Considering CONFIG_MODULES=n is not common and the age of the issue, targeting for bpf-next also.
    (CVE-2024-58060)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2024-58060

high Nessus Plugin ID 232233

版本 1.3

版本 1.1

版本 1.3 Aug 6, 2025, 4:52 AM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on CVE-2024-58060, severity decreased from "Medium" to "Low") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508060452
版本 1.1 Mar 7, 2025, 1:27 PM New Plugin Feed: 202503071327