遠端 CentOS Linux 9 主機上安裝的套件受到 kernel-5.14.0-435.el9 版本變更記錄中提及的多個弱點影響。

  - 已解決 Linux 核心中的下列弱點：hwrng: core - Fix page fault dead lock on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. (CVE-2023-52615)

  - 已解決 Linux 核心中的下列弱點：thermal: core: Fix NULL pointer dereference in zone registration error path If device_register() in thermal_zone_device_register_with_trips() returns an error, the tz variable is set to NULL and subsequently dereferenced in kfree(tz->tzp). Commit adc8749b150c (thermal/drivers/core: Use put_device() if device_register() fails) added the tz = NULL assignment in question to avoid a possible double-free after dropping the reference to the zone device. However, after commit 4649620d9404 (thermal: core: Make thermal_zone_device_unregister() return after freeing the zone), that assignment has become redundant, because dropping the reference to the zone device does not cause the zone object to be freed any more.
    Drop it to address the NULL pointer dereference. (CVE-2023-52473)

  - 拒絕原因：此 CVE ID 已被其 CVE 編號授權單位拒絕或撤銷。
    (CVE-2023-52466)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

偵測

CentOS 9：kernel-5.14.0-435.el9

medium Nessus Plugin ID 193929

版本 1.1