遠端 Redhat Enterprise Linux 9 主機上安裝的套件受到 RHSA-2023:6583 公告中提及的多個弱點影響。

  - kernel：記憶體管理員中的裝置私人頁面發生錯誤時發生爭用 (CVE-2022-3523)

  - kernel：l1oip 計時器處置程式中的釋放後使用 (CVE-2022-3565)

  - kernel：intr_callback 中 r8152 的速率限制溢位訊息 (CVE-2022-3594)

  - kernel: vmwgfx：vmw_cmd_res_check 中出現釋放後使用 (CVE-2022-38457)

  - kernel: vmwgfx：vmw_execbuf_tie_context 中出現釋放後使用 (CVE-2022-40133)

  - hw：Intel：Gather Data Sampling (GDS) 側通道弱點 (CVE-2022-40982)

  - 核心：net/bluetooth/l2cap_core.c 的 l2cap_parse_conf_req 中包含資訊洩漏弱點 (CVE-2022-42895)

  - kernel: x86/mm：隨機化 per-cpu 項目區域 (CVE-2023-0597)

  - kernel: HID：檢查 hid_validate_values() 中的空 report_list (CVE-2023-1073)

  - kernel: sctp：如果沒有邊界位址可用於指定範圍則失敗 (CVE-2023-1074)

  - kernel: net/tls：tls_is_tx_ready() 已檢查 list_entry (CVE-2023-1075)

  - kernel: tap: tap_open()：正確初始化通訊端 uid (CVE-2023-1076)

  - kernel: hid：asus_remove() 中的釋放後使用 (CVE-2023-1079)

  - kernel：IPv6 連線查閱表格中的雜湊衝突 (CVE-2023-1206)

  - kernel：file_files_note 中遺漏 mmap_lock，如此可能導致 coredump 程式碼中的釋放後使用 (CVE-2023-1249)

  - kernel: ovl：修正結構 ovl_aio_req 中的釋放後使用 (CVE-2023-1252)

  - kernel：fs/nfsd/nfs4proc.c 中的 nfsd4_ssc_setup_dul 發生釋放後使用 (CVE-2023-1652)

  - kernel：移除函式 xgene_hwmon_remove 中的釋放後使用錯誤 (CVE-2023-1855)

  - kernel：由於爭用情形在 btsdio_remove 中發生釋放後使用錯誤 (CVE-2023-1989)

  - kernel：dm-ioctl.c 的 dm_get_inactive_table 中可能存有死結，進而導致 dos (CVE-2023-2269)

  - kernel：r592_remove 中發生釋放後使用錯誤 (CVE-2023-3141)

  - kernel: fbcon：fbcon_set_font() 中發生移位超出邊界 (CVE-2023-3161)

  - kernel: gfs2：gfs2_evict_inode() 中的 NULL 指標解除參照 (CVE-2023-3212)

  - kernel：relay_file_read 中的超出邊界存取 (CVE-2023-3268)

  - kernel：由於在 shtp_cl_get_dma_send_buf() 中遺漏 kalloc() 傳回值檢查，進而發生 NULL 指標解除參照 (CVE-2023-3358)

  - kernel: net/sched：tcf_change_indev() 失敗時，發生 cls_u32 元件參照計數器洩漏 (CVE-2023-3609)

  - kernel: xfrm：xfrm_update_ae_params() 中的 NULL 指標解除參照 (CVE-2023-3772)

  - kernel: xfrm：XFRMA_MTIMER_THRESH nlattr 的超出邊界讀取 (CVE-2023-3773)

  - kernel: KVM：SEV-ES / SEV-SNP VMGEXIT 雙重擷取弱點 (CVE-2023-4155)

  - kernel: tap: tap_open()：正確地將 i_uid 的通訊端 uid 下次修正初始化為 current_fsuid (CVE-2023-4194)

  - kernel: net/sched：cls_fw、cls_u32 和 cls_route 分類器中的釋放後使用弱點 (CVE-2023-4206、CVE-2023-4207、CVE-2023-4208)

  - kernel: exFAT：exfat_get_uniname_from_ext_entry 中的堆疊溢位 (CVE-2023-4273)

  - kernel: mpls：sysctl 配置失敗時發生重複釋放 (CVE-2023-26545)

  - kernel: KVM: nVMX：缺少 CR0 和 CR4 的一致性檢查 (CVE-2023-30456)

   kernel: net: qcom/emac：導致 emac_remove() 中發生釋放後使用的爭用情形 (CVE-2023-33203)

  - kernel: vmwgfx：導致資訊洩漏弱點的爭用情形 (CVE-2023-33951)

  - kernel: vmwgfx：處理 vmw_buffer_object 物件時存在釋放後使用問題 (CVE-2023-33952)

  - kernel: r592：導致 r592_remove() 中發生釋放後使用的爭用情形 (CVE-2023-35825)

  - 核心：eBPF：dynptr 中的堆疊類型檢查不充分弱點 (CVE-2023-39191)

請注意，Nessus 並未測試這些問題，而是僅根據應用程式自我報告的版本號碼作出判斷。

AlmaLinux 9.2 主機已安裝的套件會受到 TuxCare ALMALINUX9.2：CLSA-2026：1787307395 公告中提及的多個弱點影響。

  - 已解決 Linux 核心中的下列弱點：ftrace: Clean up hash direct_functions on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection fault, probably for non-canonical address \ 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [...] [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48 85 d2 74 [...] [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 [ ] RAX: 0000000000000000 RBX:
    ffffffff813e0df0 RCX: 000000000000003b [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI:
    ffffffff813e0df0 [ ] RBP: ffffffffa00a3000 R08: ffffffff81180ce0 R09: 0000000000000001 [ ] R10:
    ffffc9000138bc18 R11: 0000000000000001 R12: ffffffff813e0df0 [ ] R13: ffffffff813e0df0 R14:
    ffff888171b56400 R15: 0000000000000000 [ ] FS: 00007fa9420c7780(0000) GS:ffff888ff6a00000(0000) knlGS:000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 000000000770d000 CR3:
    0000000107d50003 CR4: 0000000000370ee0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
    0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] Call Trace: [ ] <TASK> [ ] register_ftrace_direct+0x54/0x290 [ ] ? render_sigset_t+0xa0/0xa0 [ ] bpf_trampoline_update+0x3f5/0x4a0 [ ] ? 0xffffffffa00a3000 [ ] bpf_trampoline_link_prog+0xa9/0x140 [ ] bpf_tracing_prog_attach+0x1dc/0x450 [ ] bpf_raw_tracepoint_open+0x9a/0x1e0 [ ] ? find_held_lock+0x2d/0x90 [ ] ? lock_release+0x150/0x430 [ ] __sys_bpf+0xbd6/0x2700 [ ] ? lock_is_held_type+0xd8/0x130 [ ]
    __x64_sys_bpf+0x1c/0x20 [ ] do_syscall_64+0x3a/0x80 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xae [ ] RIP:
    0033:0x7fa9421defa9 [ ] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 9 f8 [...] [ ] RSP:
    002b:00007ffed743bd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ ] RAX: ffffffffffffffda RBX:
    00000000069d2480 RCX: 00007fa9421defa9 [ ] RDX: 0000000000000078 RSI: 00007ffed743bd80 RDI:
    0000000000000011 [ ] RBP: 00007ffed743be00 R08: 0000000000bb7270 R09: 0000000000000000 [ ] R10:
    00000000069da210 R11: 0000000000000246 R12: 0000000000000001 [ ] R13: 00007ffed743c4b0 R14:
    00000000069d2480 R15: 0000000000000001 [ ] </TASK> [ ] Modules linked in: klp_vm(OK) [ ] ---[ end trace 0000000000000000 ]--- One way to trigger this is: 1. load a livepatch that patches kernel function xxx; 2.
    run bpftrace -e 'kfunc:xxx {}', this will fail (expected for now); 3. repeat #2 => gpf. This is because the entry is added to direct_functions, but not removed. Fix this by remove the entry from direct_functions when register_ftrace_direct fails. Also remove the last trailing space from ftrace.c, so we don't have to worry about it anymore. (CVE-2022-49402)

  - 已解決 Linux 核心中的下列弱點：irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
    (CVE-2022-49715)

  - 已解決 Linux 核心中的下列弱點：cpufreq: CPPC: Add u64 casts to avoid overflowing The fields of the _CPC object are unsigned 32-bits values. To avoid overflows while using
    _CPC's values, add 'u64' casts. (CVE-2022-49750)

  - 已解決 Linux 核心中的下列弱點：net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in sk_error_queue, socket refcount is kept elevated. 3) Application closes the socket, while error queue is not empty. Since tcp_close() no longer purges the socket error queue, we might end up with a TCP socket with at least one skb in error queue keeping the socket alive forever. This bug can be (ab)used to consume all kernel memory and freeze the host. We need to purge the error queue, with proper synchronization against concurrent writers. (CVE-2022-50838)

  - 已解決 Linux 核心中的下列弱點：bpf: Add preempt_count_{sub,add} into btf id deny list The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave preempt_count_{sub,add} unprotected. When attaching trampoline to them we get panic as follows, [867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [867.843101] <TASK> [ 867.843104] asm_exc_int3+0x3a/0x40 [ 867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0 [ 867.843135] __bpf_prog_enter_recur+0x17/0x90 [ 867.843148] bpf_trampoline_6442468108_0+0x2e/0x1000 [867.843154] ? preempt_count_sub+0x1/0xa0 [ 867.843157] preempt_count_sub+0x5/0xa0 [ 867.843159] ? migrate_enable+0xac/0xf0 [ 867.843164] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843168] bpf_trampoline_6442468108_0+0x55/0x1000 ... [ 867.843788] preempt_count_sub+0x5/0xa0 [ 867.843793] ? migrate_enable+0xac/0xf0 [ 867.843829] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [867.843842] bpf_trampoline_6442468108_0+0x55/0x1000 ... That is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are called after prog->active is decreased. Fixing this by adding these two functions into btf ids deny list. (CVE-2023-54086)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 已解決 Linux 核心中的下列弱點：cpufreq: CPPC: Add u64 casts to avoid overflowing The fields of the _CPC object are unsigned 32-bits values. To avoid overflows while using
    _CPC's values, add 'u64' casts. (CVE-2022-49750)

請注意，Nessus 依賴供應商報告的套件存在。

ID	名稱	產品	系列	已發布	已更新	嚴重性
194262	RHEL 9：kernel (RHSA-2023:6583)	Nessus	Red Hat Local Security Checks	2024/4/28	2025/10/28	high
361223	AlmaLinux 9.2 [TuxCare] 安全性更新：bpftool / kernel / kernel-abi-stablelists / kernel-core / etc 多個弱點（ALMALINUX9.2：CLSA-2026：1787307395）	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	medium
246024	Linux Distros 未修補弱點：CVE-2022-49750	Nessus	Misc.	2025/8/8	2026/10/21	medium

偵測

搜尋 Plugin

high

medium

medium