CentOS Linux 8 [TuxCare] 安全性更新：bpftool / kernel / kernel-core / kernel-cross-headers / etc多個漏洞 （CENTOS-STREAM8：CLSA-2025：1763722365）
high Nessus Plugin ID 352377
語言:
概要
CentOS Linux 主機缺少一個或多個安全性更新。說明
CentOS Linux 8 主機安裝的套件會受到 TuxCare CENTOS-STREAM8：CLSA-2025：1763722365 公告中提及的多個弱點影響。- 在 Linux 核心的 BPF 子系統中，使用者以大於對應 max_entries 的金鑰呼叫 bpf_tail_call 函式的方式中存在超出邊界讀取記憶體的缺陷。本機使用者利用此缺陷，未經授權即可存取某些資料。(CVE-2022-2905)
- 在使用者觸發 security_inode_alloc 函式失敗並於隨後呼叫 nilfs_mdt_destroy 函式的方式中，發現 Linux 核心的 NILFS 檔案系統存在釋放後使用缺陷。本機使用者可利用此缺陷使系統當機，或可能提升其在系統中的權限。(CVE-2022-2978)
- 已解決 Linux 核心中的下列弱點：bpf: Don't use tnum_range on array range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customized syzkaller: BUG: KASAN: slab-out-of-bounds in bpf_int_jit_compile+0x1257/0x13f0 Read of size 8 at addr ffff888004e90b58 by task syz-executor.0/1489 CPU:
1 PID: 1489 Comm: syz-executor.0 Not tainted 5.19.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x9c/0xc9 print_address_description.constprop.0+0x1f/0x1f0 ? bpf_int_jit_compile+0x1257/0x13f0 kasan_report.cold+0xeb/0x197 ? kvmalloc_node+0x170/0x200 ? bpf_int_jit_compile+0x1257/0x13f0 bpf_int_jit_compile+0x1257/0x13f0 ? arch_prepare_bpf_dispatcher+0xd0/0xd0 ? rcu_read_lock_sched_held+0x43/0x70 bpf_prog_select_runtime+0x3e8/0x640 ? bpf_obj_name_cpy+0x149/0x1b0 bpf_prog_load+0x102f/0x2220 ? __bpf_prog_put.constprop.0+0x220/0x220 ? find_held_lock+0x2c/0x110 ?
__might_fault+0xd6/0x180 ? lock_downgrade+0x6e0/0x6e0 ? lock_is_held_type+0xa6/0x120 ?
__might_fault+0x147/0x180 __sys_bpf+0x137b/0x6070 ? bpf_perf_link_attach+0x530/0x530 ? new_sync_read+0x600/0x600 ? __fget_files+0x255/0x450 ? lock_downgrade+0x6e0/0x6e0 ? fput+0x30/0x1a0 ? ksys_write+0x1a8/0x260 __x64_sys_bpf+0x7a/0xc0 ? syscall_enter_from_user_mode+0x21/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f917c4e2c2d The problem here is that a range of tnum_range(0, map->max_entries - 1) has limited ability to represent the concrete tight range with the tnum as the set of resulting states from value + mask can result in a superset of the actual intended range, and as such a tnum_in(range, reg->var_off) check may yield true when it shouldn't, for example tnum_range(0, 2) would result in 00XX -> v = 0000, m = 0011 such that the intended set of {0, 1, 2} is here represented by a less precise superset of {0, 1, 2, 3}. As the register is known const scalar, really just use the concrete reg->var_off.value for the upper index check. (CVE-2022-49985)
- 已解決 Linux 核心中的下列弱點：fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes) (CVE-2022-50367)
- 已解決 Linux 核心中的下列弱點：Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in
__mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in
__mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in
__mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389 (CVE-2022-50386)
請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。
解決方案
根據 TuxCare 公告 CENTOS-STREAM8：CLSA-2025：1763722365 中的指引更新受影響的套件。另請參閱
Plugin 詳細資訊
嚴重性: High
ID: 352377
檔案名稱: tuxcare_centos_8_CLSA-2025-1763722365.nasl
版本: 1.2
類型: Local
代理程式: unix
已發布: 2026/9/30
已更新: 2026/10/18
支援的感應器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
風險資訊
VPR
風險因素: High
分數: 7
百分位數: 98.57
Vendor
Vendor Severity: Important
CVSS v2
風險因素: High
基本分數: 7.7
時間性分數: 6
媒介: CVSS2#AV:A/AC:L/Au:S/C:C/I:C/A:C
CVSS 評分資料來源: CVE-2022-50386
CVSS v3
風險因素: High
基本分數: 8
時間性分數: 7.2
媒介: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
時間媒介: CVSS:3.0/E:P/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party
可被惡意程式利用: true
可輕鬆利用: Exploits are available
修補程式發佈日期: 2025/11/21
弱點發布日期: 2021/7/21
參考資訊
CVE: CVE-2022-2905, CVE-2022-2978, CVE-2022-49985, CVE-2022-50367, CVE-2022-50386, CVE-2023-52530, CVE-2023-52764, CVE-2023-52775, CVE-2023-52847, CVE-2023-52864, CVE-2023-53125, CVE-2023-53178, CVE-2023-53226, CVE-2023-53257, CVE-2023-53305, CVE-2023-53373, CVE-2024-26739, CVE-2024-26958, CVE-2024-26961, CVE-2024-27395, CVE-2024-35937, CVE-2024-35939, CVE-2024-36015, CVE-2024-36880, CVE-2024-36921, CVE-2024-38556, CVE-2024-38586, CVE-2024-38635, CVE-2024-38659, CVE-2024-39487, CVE-2024-40927, CVE-2024-40978, CVE-2024-42119, CVE-2024-42292, CVE-2024-46713, CVE-2024-46754, CVE-2024-50038, CVE-2024-52332, CVE-2024-53214, CVE-2024-56539, CVE-2024-56570, CVE-2024-56594, CVE-2024-56616, CVE-2024-57876, CVE-2024-57929, CVE-2024-58014, CVE-2024-58072, CVE-2025-21704, CVE-2025-21772, CVE-2025-22121, CVE-2025-37796, CVE-2025-37797, CVE-2025-38001, CVE-2025-38392, CVE-2025-38461, CVE-2025-38498, CVE-2025-38527, CVE-2025-38556, CVE-2025-38718, CVE-2025-39730, CVE-2025-39757, CVE-2025-39817, CVE-2025-39864
CLSA: 2025:1763722365