CentOS Linux 8.5 [TuxCare] 安全性更新：bpftool / kernel / kernel-core / kernel-cross-headers / etc 多個弱點 （CENTOS8.5：CLSA-2025：1738663660）
high Nessus Plugin ID 366966
語言:
概要
CentOS Linux 主機缺少一個或多個安全性更新。說明
CentOS Linux 8.5 主機已安裝的套件會受到 TuxCare CENTOS8.5：CLSA-2025：1738663660 公告中提及的多個弱點影響。- 已解決 Linux 核心中的下列弱點：net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error. Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.
(CVE-2023-52664)
- 已解決 Linux 核心中的下列弱點：smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. (CVE-2024-26928)
- 已解決 Linux 核心中的下列弱點：smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. (CVE-2024-35861)
- 已解決 Linux 核心中的下列弱點：smb: client: fix potential UAF in is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
(CVE-2024-35863)
- 已解決 Linux 核心中的下列弱點：smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
(CVE-2024-35864)
請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。
解決方案
根據 TuxCare 公告 CENTOS8.5：CLSA-2025：1738663660 中的指引更新受影響的套件。另請參閱
Plugin 詳細資訊
嚴重性: High
ID: 366966
檔案名稱: tuxcare_centos_8.5_CLSA-2025-1738663660.nasl
版本: 1.1
類型: Local
代理程式: unix
已發布: 2026/10/18
已更新: 2026/10/18
支援的感應器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
風險資訊
VPR
風險因素: High
分數: 7.6
百分位數: 98.67
Vendor
Vendor Severity: Important
CVSS v2
風險因素: Medium
基本分數: 6.8
時間性分數: 5
媒介: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 評分資料來源: CVE-2024-50047
CVSS v3
風險因素: High
基本分數: 7.8
時間性分數: 6.8
媒介: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
時間媒介: CVSS:3.0/E:U/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party
可輕鬆利用: No known exploits are available
修補程式發佈日期: 2025/2/4
弱點發布日期: 2024/2/14
參考資訊
CVE: CVE-2023-52664, CVE-2023-52752, CVE-2024-26928, CVE-2024-35861, CVE-2024-35863, CVE-2024-35864, CVE-2024-35865, CVE-2024-35867, CVE-2024-35868, CVE-2024-46826, CVE-2024-50036, CVE-2024-50047
CLSA: 2025:1738663660