The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6949-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - M68K architecture;

    - OpenRISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Accessibility subsystem;

    - Bluetooth drivers;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - FireWire subsystem;

    - EFI core;

    - Qualcomm firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - Microsoft Hyper-V drivers;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - EEPROM drivers;

    - MMC subsystem;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Device tree and open firmware driver;

    - HiSilicon SoC PMU drivers;

    - PHY drivers;

    - Pin controllers subsystem;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Thermal drivers;

    - Userspace I/O drivers;

    - USB subsystem;

    - DesignWare USB3 driver;

    - ACRN Hypervisor Service Module driver;

    - Virtio drivers;

    - 9P distributed file system;

    - BTRFS file system;

    - eCrypt file system;

    - EROFS file system;

    - File systems infrastructure;

    - GFS2 file system;

    - JFFS2 file system;

    - Network file systems library;

    - Network file system client;

    - Network file system server daemon;

    - NILFS2 file system;

    - Proc file system;

    - SMB network file system;

    - Tracing file system;

    - Mellanox drivers;

    - Memory management;

    - Socket messages infrastructure;

    - Slab allocator;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - Core kernel;

    - BPF subsystem;

    - DMA mapping infrastructure;

    - RCU subsystem;

    - Dynamic debug library;

    - KUnit library;

    - Maple Tree data structure library;

    - Heterogeneous memory management;

    - Amateur Radio drivers;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NET/ROM layer;

    - NFC subsystem;

    - NSH protocol;

    - Open vSwitch;

    - Phonet protocol;

    - SMC sockets;

    - TIPC protocol;

    - Unix domain sockets;

    - Wireless networking;

    - Key management;

    - ALSA framework;

    - HD-audio driver;

    - Kirkwood ASoC drivers;

    - MediaTek ASoC drivers; (CVE-2024-36006, CVE-2024-36922, CVE-2024-38567, CVE-2024-38584, CVE-2024-36923,     CVE-2024-36892, CVE-2024-35855, CVE-2024-35853, CVE-2024-38562, CVE-2024-36920, CVE-2024-38543,     CVE-2024-38576, CVE-2024-38572, CVE-2024-36898, CVE-2024-38560, CVE-2024-36004, CVE-2024-36956,     CVE-2024-36881, CVE-2024-36977, CVE-2024-36955, CVE-2024-36906, CVE-2024-36013, CVE-2024-36884,     CVE-2024-38563, CVE-2024-36966, CVE-2024-38547, CVE-2024-38594, CVE-2024-36926, CVE-2024-38587,     CVE-2024-38566, CVE-2024-27400, CVE-2024-36941, CVE-2024-36017, CVE-2024-38544, CVE-2024-36899,     CVE-2024-35851, CVE-2024-38577, CVE-2024-38590, CVE-2024-38568, CVE-2024-38559, CVE-2024-38611,     CVE-2024-36887, CVE-2024-36886, CVE-2024-35996, CVE-2024-38612, CVE-2024-36925, CVE-2024-38586,     CVE-2024-38596, CVE-2024-36932, CVE-2024-39482, CVE-2024-38585, CVE-2024-36033, CVE-2024-38614,     CVE-2024-35852, CVE-2024-36908, CVE-2024-36939, CVE-2024-36963, CVE-2024-27401, CVE-2024-36029,     CVE-2024-38540, CVE-2024-38565, CVE-2024-36927, CVE-2024-36910, CVE-2024-42134, CVE-2024-36888,     CVE-2024-35859, CVE-2024-36911, CVE-2024-35947, CVE-2024-36940, CVE-2024-36921, CVE-2024-36913,     CVE-2024-36943, CVE-2024-35986, CVE-2024-38616, CVE-2024-36900, CVE-2024-36954, CVE-2024-36915,     CVE-2024-38602, CVE-2024-41011, CVE-2024-35991, CVE-2024-36909, CVE-2024-38603, CVE-2023-52882,     CVE-2024-36953, CVE-2024-38599, CVE-2024-38574, CVE-2024-36967, CVE-2024-36895, CVE-2024-36003,     CVE-2024-36961, CVE-2024-38545, CVE-2024-38538, CVE-2024-36001, CVE-2024-36912, CVE-2024-36952,     CVE-2024-38550, CVE-2024-38570, CVE-2024-36969, CVE-2024-38595, CVE-2024-35849, CVE-2024-36936,     CVE-2024-35949, CVE-2024-36009, CVE-2024-35987, CVE-2024-38541, CVE-2024-38564, CVE-2024-36032,     CVE-2024-38615, CVE-2024-36960, CVE-2024-36934, CVE-2024-36951, CVE-2024-35999, CVE-2024-38551,     CVE-2024-36903, CVE-2024-36931, CVE-2024-38593, CVE-2024-36938, CVE-2024-38607, CVE-2024-36928,     CVE-2024-38552, CVE-2024-36002, CVE-2024-38605, CVE-2024-38582, CVE-2024-36933, CVE-2024-38620,     CVE-2024-27395, CVE-2024-27396, CVE-2024-36012, CVE-2024-38591, CVE-2024-38597, CVE-2024-36889,     CVE-2024-36964, CVE-2024-38606, CVE-2024-38553, CVE-2024-36945, CVE-2024-35848, CVE-2024-36962,     CVE-2024-36947, CVE-2024-27399, CVE-2024-38546, CVE-2024-38583, CVE-2024-38573, CVE-2024-35850,     CVE-2024-38549, CVE-2024-38588, CVE-2024-38610, CVE-2024-36917, CVE-2024-36957, CVE-2024-35846,     CVE-2024-38579, CVE-2024-36965, CVE-2024-35857, CVE-2024-38548, CVE-2024-36975, CVE-2024-36919,     CVE-2024-38542, CVE-2024-36948, CVE-2024-36011, CVE-2024-38556, CVE-2024-36897, CVE-2024-38557,     CVE-2024-36890, CVE-2024-36882, CVE-2024-38613, CVE-2024-36914, CVE-2024-35998, CVE-2024-36958,     CVE-2024-38580, CVE-2024-36896, CVE-2024-36891, CVE-2024-36924, CVE-2024-38589, CVE-2024-38592,     CVE-2024-36904, CVE-2024-36894, CVE-2024-36028, CVE-2024-36014, CVE-2024-36880, CVE-2024-36944,     CVE-2024-38598, CVE-2024-36929, CVE-2024-36883, CVE-2024-35858, CVE-2024-38555, CVE-2024-36005,     CVE-2024-38539, CVE-2024-35994, CVE-2024-36030, CVE-2024-27394, CVE-2024-36930, CVE-2024-36937,     CVE-2024-38561, CVE-2024-38578, CVE-2024-36959, CVE-2024-36935, CVE-2024-36916, CVE-2024-36902,     CVE-2024-38604, CVE-2024-38554, CVE-2024-38575, CVE-2024-36918, CVE-2024-36979, CVE-2024-35854,     CVE-2024-36968, CVE-2024-38558, CVE-2024-36000, CVE-2024-27398, CVE-2024-35983, CVE-2024-36949,     CVE-2024-38600, CVE-2024-36950, CVE-2024-36946, CVE-2024-36031, CVE-2024-35847, CVE-2024-36905,     CVE-2024-38571, CVE-2024-36007, CVE-2024-35856, CVE-2024-38601, CVE-2024-38569, CVE-2024-38617,     CVE-2024-35988, CVE-2024-35989, CVE-2024-35993, CVE-2024-36893, CVE-2024-36901)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-467.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if     SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a     callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we     never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a     crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [     303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [     303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current     EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04:
    level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [     303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error:
    Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core     crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm:
    efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown     Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv     daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr :
    efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29:
    ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25:
    ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21:
    ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [     303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14:
    ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10:
    0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 :
    0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [     303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [     303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585]     efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [     303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156]     el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [     303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code:
    ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this     by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and     deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. (CVE-2023-52463)

  - This CVE was assigned by Intel. Please see CVE-2024-2201 on CVE.org for more information. (CVE-2024-2201)

  - In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in     blk_rq_stat_sum() The expression dst->nr_samples + src->nr_samples may have zero value on overflow. It is     necessary to add a check to avoid division by zero. Found by Linux Verification Center (linuxtesting.org)     with Svace. (CVE-2024-35925)

  - In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration     on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting     to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is     overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that     key_set_expiry is only called when the pre-parser sets a specific expiry. (CVE-2024-36031)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6952-1 advisory.

    Benedict Schlter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted     hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP.
    This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose     sensitive information or possibly execute arbitrary code in the trusted execution environment.
    (CVE-2024-25742)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - M68K architecture;

    - OpenRISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Accessibility subsystem;

    - Bluetooth drivers;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - FireWire subsystem;

    - EFI core;

    - Qualcomm firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Microsoft Hyper-V drivers;

    - I2C subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - EEPROM drivers;

    - MMC subsystem;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Device tree and open firmware driver;

    - HiSilicon SoC PMU drivers;

    - PHY drivers;

    - Pin controllers subsystem;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Thermal drivers;

    - TTY drivers;

    - Userspace I/O drivers;

    - USB subsystem;

    - DesignWare USB3 driver;

    - ACRN Hypervisor Service Module driver;

    - Virtio drivers;

    - 9P distributed file system;

    - BTRFS file system;

    - eCrypt file system;

    - EROFS file system;

    - File systems infrastructure;

    - GFS2 file system;

    - JFFS2 file system;

    - Network file systems library;

    - Network file system client;

    - Network file system server daemon;

    - NILFS2 file system;

    - Proc file system;

    - SMB network file system;

    - Tracing file system;

    - Mellanox drivers;

    - Memory management;

    - Socket messages infrastructure;

    - Slab allocator;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - Core kernel;

    - BPF subsystem;

    - DMA mapping infrastructure;

    - RCU subsystem;

    - Dynamic debug library;

    - KUnit library;

    - Maple Tree data structure library;

    - Heterogeneous memory management;

    - Amateur Radio drivers;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NET/ROM layer;

    - NFC subsystem;

    - NSH protocol;

    - Open vSwitch;

    - Phonet protocol;

    - SMC sockets;

    - TIPC protocol;

    - Unix domain sockets;

    - Wireless networking;

    - Key management;

    - ALSA framework;

    - HD-audio driver;

    - Kirkwood ASoC drivers;

    - MediaTek ASoC drivers; (CVE-2024-38601, CVE-2024-36935, CVE-2024-35991, CVE-2024-36032, CVE-2024-35988,     CVE-2024-36886, CVE-2024-36913, CVE-2024-36928, CVE-2024-38553, CVE-2024-36927, CVE-2024-38615,     CVE-2024-36958, CVE-2024-36977, CVE-2024-36889, CVE-2024-38554, CVE-2024-38590, CVE-2024-42134,     CVE-2024-35857, CVE-2024-35850, CVE-2024-35986, CVE-2024-36921, CVE-2024-38569, CVE-2024-36966,     CVE-2024-38542, CVE-2024-38585, CVE-2024-36884, CVE-2024-36006, CVE-2024-38577, CVE-2024-36016,     CVE-2024-38584, CVE-2024-36887, CVE-2024-38598, CVE-2024-35994, CVE-2024-38603, CVE-2024-35998,     CVE-2024-27401, CVE-2024-35852, CVE-2024-36944, CVE-2024-38572, CVE-2024-36917, CVE-2024-36943,     CVE-2024-36009, CVE-2024-38587, CVE-2024-35949, CVE-2024-36945, CVE-2024-36004, CVE-2024-36919,     CVE-2024-27398, CVE-2024-38582, CVE-2024-35847, CVE-2024-38580, CVE-2024-38602, CVE-2024-36916,     CVE-2024-36903, CVE-2024-38555, CVE-2024-36952, CVE-2024-38589, CVE-2024-27394, CVE-2024-36933,     CVE-2024-36975, CVE-2024-38591, CVE-2024-38612, CVE-2024-36939, CVE-2024-35983, CVE-2024-38607,     CVE-2024-36929, CVE-2024-35849, CVE-2024-36941, CVE-2024-35858, CVE-2024-38599, CVE-2024-35996,     CVE-2024-36031, CVE-2024-36931, CVE-2024-35990, CVE-2024-35851, CVE-2024-38556, CVE-2024-36000,     CVE-2024-36910, CVE-2024-38573, CVE-2024-36906, CVE-2024-36951, CVE-2024-38604, CVE-2024-38613,     CVE-2024-38547, CVE-2024-36014, CVE-2024-36949, CVE-2024-36033, CVE-2024-38597, CVE-2024-36880,     CVE-2024-38594, CVE-2024-36894, CVE-2024-38546, CVE-2024-36947, CVE-2024-38541, CVE-2024-35989,     CVE-2024-27399, CVE-2024-38550, CVE-2024-36922, CVE-2024-36008, CVE-2024-38540, CVE-2024-36924,     CVE-2024-36892, CVE-2024-38549, CVE-2024-36882, CVE-2024-36908, CVE-2024-38566, CVE-2024-36005,     CVE-2024-38583, CVE-2024-36968, CVE-2024-36017, CVE-2024-38565, CVE-2024-36881, CVE-2024-38611,     CVE-2024-36897, CVE-2024-38560, CVE-2024-36923, CVE-2024-38575, CVE-2024-36899, CVE-2024-38570,     CVE-2024-36898, CVE-2024-36896, CVE-2024-38559, CVE-2024-38588, CVE-2024-38606, CVE-2024-38551,     CVE-2024-36891, CVE-2024-38567, CVE-2024-36895, CVE-2024-35993, CVE-2024-38552, CVE-2024-36925,     CVE-2024-36964, CVE-2024-36888, CVE-2024-36956, CVE-2024-36946, CVE-2024-38600, CVE-2024-35997,     CVE-2024-36912, CVE-2024-35984, CVE-2024-35848, CVE-2024-38545, CVE-2024-38563, CVE-2024-36918,     CVE-2024-36001, CVE-2024-36957, CVE-2024-38576, CVE-2024-36030, CVE-2024-38574, CVE-2024-36963,     CVE-2024-36890, CVE-2024-36960, CVE-2024-36901, CVE-2024-38614, CVE-2024-35859, CVE-2024-38593,     CVE-2024-36904, CVE-2024-36012, CVE-2024-38578, CVE-2024-36011, CVE-2024-36930, CVE-2024-36938,     CVE-2024-36893, CVE-2024-35987, CVE-2024-36905, CVE-2024-35853, CVE-2024-36003, CVE-2024-38562,     CVE-2024-38617, CVE-2024-35855, CVE-2024-36965, CVE-2024-38596, CVE-2024-38558, CVE-2024-38568,     CVE-2024-36955, CVE-2024-36029, CVE-2024-36967, CVE-2024-36940, CVE-2024-38595, CVE-2024-36028,     CVE-2024-38610, CVE-2024-36911, CVE-2024-35999, CVE-2024-35854, CVE-2024-38571, CVE-2024-38548,     CVE-2024-36948, CVE-2024-36002, CVE-2024-36961, CVE-2024-36900, CVE-2024-36932, CVE-2024-36902,     CVE-2024-35992, CVE-2024-36914, CVE-2024-38592, CVE-2024-38616, CVE-2024-27400, CVE-2024-36937,     CVE-2024-36920, CVE-2024-38586, CVE-2024-36909, CVE-2024-35846, CVE-2024-39482, CVE-2024-38579,     CVE-2024-38539, CVE-2024-27395, CVE-2024-36962, CVE-2024-36013, CVE-2024-27396, CVE-2024-38557,     CVE-2024-36953, CVE-2024-41011, CVE-2023-52882, CVE-2024-36969, CVE-2024-36007, CVE-2024-35856,     CVE-2024-38605, CVE-2024-36915, CVE-2024-36979, CVE-2024-36954, CVE-2024-38538, CVE-2024-36950,     CVE-2024-36926, CVE-2024-38544, CVE-2024-36959, CVE-2024-38561, CVE-2024-36883, CVE-2024-36936,     CVE-2024-38564, CVE-2024-38543, CVE-2024-36934, CVE-2024-35947, CVE-2024-38620)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモートの CentOS Linux 9 ホストに、kernel-5.14.0-467.el9 ビルド変更ログに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Linux カーネルでは、次の脆弱性は解決されています。efivarfs: SetVariable がサポートされていない場合、再マウント時に RO を強制します。ランタイムの SetVariable がファームウェアによってサポートされていない場合、その関数にコールバックを割り当てることはありません。同時に efivarfs を RO としてマウントし、誰もそれを呼び出せないようにします。ただし、誰かがファイルシステムを RW として再マウントした場合は、アクセス許可フラグをチェックしません。結果として、これは次のようなクラッシュを引き起こします。$ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [303.279166] 仮想アドレス 0000000000000000 [303.280482] でカーネル NULL ポインターデリファレンスを処理できません Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04:
    level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error:
    Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm:
    efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] ハードウェア名: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr :
    efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29:
    ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25:
    ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21:
    ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14:
    ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10:
    0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 :
    0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] 呼び出しトレース: [303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] コード:
    ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- .reconfigure() 関数を fs 操作に追加することによりこれを修正します。これは、リクエストされたフラグを確認したり、ファームウェアがランタイムで SetVariable を実装しない場合に RO でないものすべてを拒否する際に使用できます。(CVE-2023-52463)

  - この CVE は Intel によって割り当てられました。詳細については、CVE.org の CVE-2024-2201 を参照してください。(CVE-2024-2201)

  - Linux カーネルでは、次の脆弱性が解決されました。block: blk_rq_stat_sum() でのゼロ除算を防止します。式 dst->nr_samples + src->nr_samples は、オーバーフロー時にゼロ値を持つ可能性があります。ゼロ除算を回避するためのチェックを追加する必要があります。SVACE で Linux Verification Center (linuxtesting.org) によって発見されました。(CVE-2024-35925)

  - Linux カーネルでは、次の脆弱性が解決されました。keys: インスタンス化でのキー有効期限の上書きを修正。キーの有効期限はインスタンス化中に無条件に上書きされ、永続的になります。これにより、ユーザー空間で設定された有効期限が TIME64_MAX に上書きされ、それ以降の DNS 更新が無効になるため、DNS 解決に問題が発生します。これを修正するには、プリパーサーが特定の有効期限を設定する場合にのみ key_set_expiry が呼び出されるという条件を復元します。(CVE-2024-36031)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 CentOS Linux 9 主機上安裝的套件受到 kernel-5.14.0-467.el9 版本變更記錄中提及的多個弱點影響。

  - 在 Linux 核心中，下列弱點已修復：efivarfs：如果不支援 SetVariable，在重新掛載時會強制執行 RO 若韌體不支援執行階段的 SetVariable，我們絕不會為該函式指派回呼。同時將 efivarfs 掛載為 RO，讓任何人都無法呼叫。但是，我們從不會檢查權限旗標，除非有人將檔案系統掛載為 RW。因此，這會導致當機，如下所示：$ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [303.279166] 無法處理虛擬位址 0000000000000000 的 NULL 指標解除參照 [303.280482] 記憶體中止資訊：[ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21：IABT (当前 EL)，IL = 32 位 [ 303.282016] SET = 0，FnV = 0 [ 303.282414] EA = 0，S1PTW = 0 [ 303.282821] FSC = 0x04：
    0 級轉譯錯誤 [303.283771 ] 使用者 pgtable：4k 頁面，48 位元 VA，pgdp=000000004258c000 [303.284913] [0000000000000000] pgd=0000000000000000、p4d=0000000000000000 [ 303.286076] 內部錯誤：
    Oops：0000000086000004 [#1] PREEMPT SMP [ 303.286936] 模組連結位置：qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU：1 PID：755 命令：
    efi-updatevar 未污染 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] 硬體名稱：未知 未知產品/未知產品，BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate：60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc：0x0 [ 303.292443] lr：
    efivar_set_variable_locked+0x74/0xec [ 303.293156] sp：ffff800008673c10 [ 303.293619] x29：
    ffff800008673c10 x28：ffff0000037e8000 x27：0000000000000000 [ 303.294592] x26：0000000000000800 x25：
    ffff000002467400 x24：0000000000000027 [ 303.295572] x23：ffffd49ea9832000 x22：ffff0000020c9800 x21：
    ffff000002467000 [ 303.296566] x20：0000000000000001 x19：00000000000007fc x18：0000000000000000 [303.297531] x17：0000000000000000 x16：0000000000000000 x15：0000aaaac807ab54 [ 303.298495] x14：
    ed37489f673633c0 x13：71c45c606de13f80 x12：47464259e219acf4 [ 303.299453] x11：ffff000002af7b01 x10：
    0000000000000003 x9：0000000000000002 [ 303.300431] x8：0000000000000010 x7：ffffd49ea8973230 x6：
    0000000000a85201 [ 303.301412] x5：0000000000000000 x4：ffff0000020c9800 x3：00000000000007fc [303.302370] x2：0000000000000027 x1：ffff000002467400 x0：ffff000002467000 [ 303.303341] 呼叫追蹤：[303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] 程式碼：
    ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[結束追蹤 0000000000000000]--- 透過向 fs 作業新增 .reconfigure() 函式修復此弱點，我們可以使用此函式檢查請求的旗標，並拒絕不是 RO 的任何內容 (前提是固體在執行階段未實作 SetVariable)。(CVE-2023-52463)

  - 此 CVE 是由 Intel 指派。如需詳細資訊，請參閱 CVE.org 上的 CVE-2024-2201。(CVE-2024-2201)

  - 在 Linux 核心中，下列弱點已解決：block：阻止 blk_rq_stat_sum() 中的除以零問題 運算式 dst->nr_samples + src->nr_samples 在溢位時可能會有零值。必須新增檢查以避免除以零。由 Linux Verification Center (linuxtesting.org) 和 SVACE 發現。(CVE-2024-35925)

  - 在 Linux 核心中，下列弱點已解決：keys：修正具現化時金鑰到期時間覆寫問題。金鑰到期時間在具現化期間被無條件覆寫，預設為永久化。這會造成 DNS 解析發生問題，因為使用者空間所設定的到期日會覆寫為 TIME64_MAX，進而停用進一步的 DNS 更新。修正方法是：還原只有在預先剖析器設定特定到期日時才呼叫 key_set_expiry 的條件。(CVE-2024-36031)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 CentOS Linux 9 主机上安装的多个程序包受到 kernel-5.14.0-467.el9 版本变更日志中提及的多个漏洞影响。

  - 在 Linux 内核中，以下漏洞已修复：efivarfs：如果不支持 SetVariable，在重新挂载时会强制执行 RO 如果固件不支持运行时的 SetVariable，我们绝不会为该函数分配回调。同时将 efivarfs 挂载为 RO，让任何人都无法调用。但是，我们从不会检查权限标记，除非有人将文件系统重新挂载为 RW。因此，这会导致崩溃，具体如下所示：$ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [303.279166] 无法处理虚拟地址 0000000000000000 的内核空指针取消引用 [303.280482] 内存中止信息：[ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21：IABT（当前 EL），IL = 32 位 [ 303.282016] SET = 0，FnV = 0 [ 303.282414] EA = 0，S1PTW = 0 [ 303.282821] FSC = 0x04：
    0 级转换错误 [ 303.283771] 用户 pgtable：4k 页面，48 位虚拟机，pgdp=000000004258c000 [303.284913] [0000000000000000] pgd=0000000000000000、p4d=0000000000000000 [ 303.286076] 内部错误：
    Oops：0000000086000004 [#1] PREEMPT SMP [ 303.286936] 模块链接位置：qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU：1 PID：755 命令：
    efi-updatevar 未感染 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] 硬件名称：未知 未知产品/未知产品，BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate：60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc：0x0 [ 303.292443] lr：
    efivar_set_variable_locked+0x74/0xec [ 303.293156] sp：ffff800008673c10 [ 303.293619] x29：
    ffff800008673c10 x28：ffff0000037e8000 x27：0000000000000000 [ 303.294592] x26：0000000000000800 x25：
    ffff000002467400 x24：0000000000000027 [ 303.295572] x23：ffffd49ea9832000 x22：ffff0000020c9800 x21：
    ffff000002467000 [ 303.296566] x20：0000000000000001 x19：00000000000007fc x18：0000000000000000 [303.297531] x17：0000000000000000 x16：0000000000000000 x15：0000aaaac807ab54 [ 303.298495] x14：
    ed37489f673633c0 x13：71c45c606de13f80 x12：47464259e219acf4 [ 303.299453] x11：ffff000002af7b01 x10：
    0000000000000003 x9：0000000000000002 [ 303.300431] x8：0000000000000010 x7：ffffd49ea8973230 x6：
    0000000000a85201 [ 303.301412] x5：0000000000000000 x4：ffff0000020c9800 x3：00000000000007fc [303.302370] x2：0000000000000027 x1：ffff000002467400 x0：ffff000002467000 [ 303.303341] 调用跟踪：[303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] 代码：
    ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[结束跟踪 0000000000000000]--- 通过向 fs 操作添加 .reconfigure() 函数修复此漏洞，我们可以使用此函数检查请求的标记，并拒绝不是 RO 的任何内容（前提是固件在运行时未实施 SetVariable）。(CVE-2023-52463)

  - 此 CVE 由 Intel 分配。有关更多信息，请参阅 CVE.org 中的 CVE-2024-2201。(CVE-2024-2201)

  - 在 Linux 内核中，以下漏洞已修复：block：防止在 blk_rq_stat_sum() 中出现除以零问题。表达式 dst->nr_samples + src->nr_samples 在溢出时可能有零值。请务必添加检查，以避免除以零问题。由 Linux Verification Center (linuxtesting.org) 和 Svace 发现。(CVE-2024-35925)

  - 在 Linux 内核中，以下漏洞已修复：keys：修复实例化时密钥到期的覆盖问题。实例化期间，密钥的到期时间会被无条件覆盖，默认使其永久覆盖。这会造成 DNS 解析问题，因为用户空间设置的有效期限会被 TIME64_MAX 覆盖，进而导致无法进一步更新 DNS。将条件还原为仅当预解析器设置特定有效期限时才调用 key_set_expiry，从而修复此问题。(CVE-2024-36031)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名稱	產品	系列	已發布	已更新	嚴重性
205226	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-6949-1)	Nessus	Ubuntu Local Security Checks	2024/8/8	2024/8/8	high
200887	CentOS 9 : kernel-5.14.0-467.el9	Nessus	CentOS Local Security Checks	2024/6/24	2024/6/24	medium
205289	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-6952-1)	Nessus	Ubuntu Local Security Checks	2024/8/9	2024/8/9	high
200887	CentOS 9 : kernel-5.14.0-467.el9	Nessus	CentOS Local Security Checks	2024/6/24	2024/6/24	medium
200887	CentOS 9：kernel-5.14.0-467.el9	Nessus	CentOS Local Security Checks	2024/6/24	2024/6/24	medium
200887	CentOS 9：kernel-5.14.0-467.el9	Nessus	CentOS Local Security Checks	2024/6/24	2024/6/24	medium

偵測

搜尋 Plugin

high

medium

high

medium

medium

medium