CentOS Linux 6 [TuxCare] 安全性更新：核心 / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc 多個弱點 （CENTOS6：CLSA-2026：1791949745）
high Nessus Plugin ID 367921
語言:
概要
CentOS Linux 主機缺少一個或多個安全性更新。說明
CentOS Linux 6 主機安裝的套件會受到 TuxCare CENTOS6：CLSA-2026：1791949745 公告中提及的多個弱點影響。- 已解決 Linux 核心中的下列弱點：HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. (CVE-2024-50302)
- 已解決 Linux 核心中的下列弱點：ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration. (CVE-2024-53197)
- 已解決 Linux 核心中的下列弱點：smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. (CVE-2026-46243)
- 已解決 Linux 核心中的下列弱點：Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket. (CVE-2026-52918)
- 已解決 Linux 核心中的下列弱點：netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits(). (CVE-2026-53266)
請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。
解決方案
根據 TuxCare 公告 CENTOS6：CLSA-2026：1791949745 中的指引更新受影響的套件。另請參閱
Plugin 詳細資訊
嚴重性: High
ID: 367921
檔案名稱: tuxcare_centos_6_CLSA-2026-1791949745.nasl
版本: 1.2
類型: Local
代理程式: unix
已發布: 2026/10/20
已更新: 2026/10/22
支援的感應器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
風險資訊
VPR
風險因素: Critical
分數: 9.2
百分位數: 99.77
Vendor
Vendor Severity: Critical
CVSS v2
風險因素: Medium
基本分數: 6.8
時間性分數: 5.9
媒介: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 評分資料來源: CVE-2026-64340
CVSS v3
風險因素: High
基本分數: 7.8
時間性分數: 7.5
媒介: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
時間媒介: CVSS:3.0/E:H/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party
可被惡意程式利用: true
可輕鬆利用: Exploits are available
修補程式發佈日期: 2026/10/14
弱點發布日期: 2024/4/9
CISA 已知遭惡意利用弱點到期日: 2025/3/25, 2025/4/30, 2026/9/21
參考資訊
CVE: CVE-2024-50302, CVE-2024-53197, CVE-2026-46243, CVE-2026-52918, CVE-2026-53266, CVE-2026-63826, CVE-2026-63922, CVE-2026-63983, CVE-2026-64322, CVE-2026-64340, CVE-2026-64422, CVE-2026-64471, CVE-2026-68093, CVE-2026-68202, CVE-2026-68320, CVE-2026-68365, CVE-2026-72070, CVE-2026-72322, CVE-2026-72389, CVE-2026-72398, CVE-2026-72413, CVE-2026-74287, CVE-2026-74359, CVE-2026-74387, CVE-2026-74388, CVE-2026-74556, CVE-2026-74588, CVE-2026-74630, CVE-2026-74641, CVE-2026-74689, CVE-2026-80536, CVE-2026-80590, CVE-2026-80622, CVE-2026-80829, CVE-2026-81001, CVE-2026-89478, CVE-2026-89549, CVE-2026-89550, CVE-2026-89575, CVE-2026-89607, CVE-2026-89633, CVE-2026-89671, CVE-2026-89699, CVE-2026-89893, CVE-2026-90033, CVE-2026-90057, CVE-2026-90116, CVE-2026-90203, CVE-2026-90383, CVE-2026-90421, CVE-2026-93803, CVE-2026-97408, CVE-2026-97445, CVE-2026-97455, CVE-2026-97536, CVE-2026-97539, CVE-2026-97540, CVE-2026-97931, CVE-2026-97938, CVE-2026-97949, CVE-2026-98077, CVE-2026-98193, CVE-2026-98194, CVE-2026-98266, CVE-2026-98276, CVE-2026-98348, CVE-2026-98349, CVE-2026-98364, CVE-2026-98375
CLSA: 2026:1791949745