Rocky Linux 9.6 [TuxCare] 安全性更新：kernel / kernel-abi-stablelists / kernel-core / etc 多個弱點 （ALMALINUX9.6：CLSA-2026：1777633439）
high Nessus Plugin ID 360870
語言:
概要
Rocky Linux 主機缺少一或多個安全性更新。說明
Rocky Linux 9.6 主機已安裝的套件會受到 TuxCare ALMALINUX9.6：CLSA-2026：1777633439 公告中提及的多個弱點影響。- 已解決 Linux 核心中的下列弱點：capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace:
<TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
__ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0
__x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> (CVE-2022-49870)
- 已解決 Linux 核心中的下列弱點：intel_th: Fix a resource leak in an error handling path If an error occurs after calling 'pci_alloc_irq_vectors()', 'pci_free_irq_vectors()' must be called as already done in the remove function. (CVE-2022-50143)
- 已解決 Linux 核心中的下列弱點：xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. This can happen either due to the socket being closed or the device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better system was introduced by having an explicit state variable in the xsk socket struct. For example, the state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND.
The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a socket is going down. Fix this by introducing a test against the state variable. If the socket is in the state XSK_UNBOUND, simply abort the diagnostic's netlink operation. (CVE-2023-53426)
- 已解決 Linux 核心中的下列弱點：VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
__kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
__fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
__syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). (CVE-2024-46738)
- 已解決 Linux 核心中的下列弱點：tracing: Consider the NULL character when validating the event length strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL terminating character. This commit checks this condition and returns failure for it. (CVE-2024-50131)
請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。
解決方案
根據 TuxCare 公告 ALMALINUX9.6：CLSA-2026：1777633439 中的指引更新受影響的套件。另請參閱
Plugin 詳細資訊
嚴重性: High
ID: 360870
檔案名稱: tuxcare_rocky_linux_9.6_CLSA-2026-1777633439.nasl
版本: 1.2
類型: Local
已發布: 2026/10/1
已更新: 2026/10/2
支援的感應器: Continuous Assessment, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
風險資訊
VPR
風險因素: Critical
分數: 9.5
百分位數: 99.87
Vendor
Vendor Severity: Important
CVSS v2
風險因素: Medium
基本分數: 6.8
時間性分數: 5.9
媒介: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 評分資料來源: CVE-2026-23231
CVSS v3
風險因素: High
基本分數: 7.8
時間性分數: 7.5
媒介: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
時間媒介: CVSS:3.0/E:H/RL:O/RC:C
CVSS v4
風險因素: High
Base Score: 8.6
Threat Score: 8.6
Threat Vector: CVSS:4.0/E:A
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 評分資料來源: CVE-2026-31431
弱點資訊
必要的 KB 項目: Host/OS/extended-third-party, Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu
可被惡意程式利用: true
可輕鬆利用: Exploits are available
修補程式發佈日期: 2026/5/1
弱點發布日期: 2021/7/21
CISA 已知遭惡意利用弱點到期日: 2026/5/15
可惡意利用
Core Impact
Metasploit (Copy Fail AF_ALG + authencesn Page-Cache Write)
參考資訊
CVE: CVE-2022-49870, CVE-2022-49900, CVE-2022-50143, CVE-2022-50422, CVE-2023-53426, CVE-2023-54119, CVE-2024-40994, CVE-2024-46738, CVE-2024-50131, CVE-2025-37940, CVE-2025-37949, CVE-2025-37959, CVE-2025-37967, CVE-2025-37985, CVE-2025-37990, CVE-2025-37995, CVE-2025-37997, CVE-2025-37998, CVE-2025-38009, CVE-2025-38023, CVE-2025-38035, CVE-2025-38037, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044, CVE-2025-38058, CVE-2025-38061, CVE-2025-38063, CVE-2025-38066, CVE-2025-38071, CVE-2025-38072, CVE-2025-38083, CVE-2025-38095, CVE-2025-38100, CVE-2025-38112, CVE-2025-38115, CVE-2025-38122, CVE-2025-38125, CVE-2025-38148, CVE-2025-38166, CVE-2025-38174, CVE-2025-38181, CVE-2025-38184, CVE-2025-38190, CVE-2025-38214, CVE-2025-38215, CVE-2025-38222, CVE-2025-38231, CVE-2025-38251, CVE-2025-38285, CVE-2025-38293, CVE-2025-38310, CVE-2025-38312, CVE-2025-38319, CVE-2025-38324, CVE-2025-38334, CVE-2025-38337, CVE-2025-38344, CVE-2025-38345, CVE-2025-38363, CVE-2025-38386, CVE-2025-38387, CVE-2025-38514, CVE-2025-38515, CVE-2025-38528, CVE-2025-38540, CVE-2025-38553, CVE-2025-38563, CVE-2025-38581, CVE-2025-38601, CVE-2025-38602, CVE-2025-38608, CVE-2025-38609, CVE-2025-38617, CVE-2025-38622, CVE-2025-38644, CVE-2025-38668, CVE-2025-38671, CVE-2025-38695, CVE-2025-38700, CVE-2025-38701, CVE-2025-38706, CVE-2025-38721, CVE-2025-38730, CVE-2025-39675, CVE-2025-39676, CVE-2025-39703, CVE-2025-39706, CVE-2025-39713, CVE-2025-39736, CVE-2025-39737, CVE-2025-39742, CVE-2025-39756, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39798, CVE-2025-39808, CVE-2025-39812, CVE-2025-39813, CVE-2025-39835, CVE-2025-39844, CVE-2025-39845, CVE-2025-39847, CVE-2025-39876, CVE-2025-39929, CVE-2025-39932, CVE-2025-39937, CVE-2025-39953, CVE-2025-40096, CVE-2025-40322, CVE-2025-68223, CVE-2025-68340, CVE-2025-68725, CVE-2025-68741, CVE-2025-68800, CVE-2025-71089, CVE-2025-71091, CVE-2025-71112, CVE-2025-71147, CVE-2025-71154, CVE-2026-22977, CVE-2026-22980, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-23001, CVE-2026-23060, CVE-2026-23061, CVE-2026-23084, CVE-2026-23089, CVE-2026-23097, CVE-2026-23111, CVE-2026-23133, CVE-2026-23144, CVE-2026-23191, CVE-2026-23193, CVE-2026-23204, CVE-2026-23216, CVE-2026-23231, CVE-2026-31431
CLSA: 2026:1777633439