Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - メディアusbsianodo_submit_urb により引き起こされる use-after-free バグを修正します do_submit_urb() により引き起こされる UAF バグがあります。KASan レポートの 1 つを以下に示します [ 36.403605] バグ KASANworker_thread+0x4a2/0x890 の use-after-free 36.406105] タスク kworker/ による addr ff880059600e8 でのサイズ 8 の読み取り0:2/49 [36.408316] [ 36.408867] CPU:0 PID:49 通信: kworker/0:2 汚染されていない 6.2.0-rc3-15798-g5a41237ad1d4-dir8 [36.411696] ハードウェア名: QEMU Standard PC (i440FX + PIIX, 1996)、BIOS rel -1.14.0-0-g15584 36.416157] Workqueue: 0x0 (events) [ 36.417654] Call Trace: [ 36.418546] [] <TASK> [ 36.419320] dump_stack_lvl+0x96/0xd0 [ 36.420522]  ] print_address_description+0x75/0x350 [] 36.421992] print_report+0x11b/0x250 [ 36.423174] ?
    _raw_spin_lock_irqsave+0x87/0xd0 [ 36.424806] ? __virt_addr_valid+0xcf/0x170 [ 36.426069] ? worker_thread+0x4a2/0x890 [ 36.427355] kasan_report+0x131/0x160 [ 36.428556] ? worker_thread+0x4a2/0x890 [36.430053] worker_thread+0x4a2/0x890 [ 36.431297] ? worker_clr_flags+0x90/0x90 [ 36.432479] kthread+0x166/0x190 [ 36.433493] ? kthread_blkcg+0x50/0x50 [ 36.434669] ret_from_fork+0x22/0x30 [36.435923] </TASK> [ 36.436684] [ 36.437215] タスク 24 により割り当てられています [ 36.438289] kasan_set_track+0x50/0x80 36.439436] __kasan_kmalloc+0x89/ 0xa0 [ 36.440566] smsusb_probe+0x374/0xc90 [ 36.441920] usb_probe_interface+0x2d1/0x4c0 [ 36.443253] true_probe+0x1d5/0x580 [ 36.444539]
    __driver_probe_device+0xe3/0x130 [ 36.446085] driver_probe_device+0x49/0x220 [ 36.447423]
    __device_attach_driver+0x19e/0x1b0 [ 36.448931] bus_for_each_drv+0xcb/0x110 [ 36.450217]
    __device_attach+0x132/0x1f0 [ 36.451470] bus_probe_device+0x59/0xf0 [ 36.452563] device_add+0x4ec/0x7b0 [36.453830] usb_set_configuration+0xc63/0xe10 [ 36.455230] usb_generic_driver_probe+0x3b/0x80 [ 36.456166] printk: console [ttyGS0] ] 無効化 36.456569usb_probe_device+0x90/0x110 [ 36.459523] true_probe+0x1d5/0x580 36.461027] __driver_probe_device+0xe3/0x130 [ 36.462465] driver_probe_device+0x49/0x220 36.463847] __device_attach_driver+0x19e/0x1b0 [[ 36.465229]  ] bus_for_each_drv+0xcb/0x110 [ 36.466466] __device_attach+0x132/0x1f0 [ 36.467799] bus_probe_device+0x59/0xf0 36.469010] device_add+0x4ec/0x7b0 [ 36.470125 ] usb_new_device+0x863/0xa000 [36.471374 ] hub_event+0x18c7/ [] hub_event+0x18c7/ 0x2220 36.472746] process_one_work+0x34c/0x5b0 [ 36.474041] worker_thread+0x4b7/0x890 [ 36.475216] kthread+0x166/0x190 [ 36.476267] ret_from_fork+0x22/0x3036.477447] 36.478160] タスク 24 による解放[ 36.479239] kasan_set_track+0x50/0x80 [ 36.480512] kasan_save_free_info+0x2b/0x40 [ 36.481808] ___kasan_slab_free+0x122/0x1a0 [ 36.483173]
    __kmem_cache_free+0xc4/0x200 [ 36.484563] smsusb_term_device+0xcd/0xf0 36.485896] smsusb_probe+0xc85/0xc90 36.486976] usb_probe_interface+0x2d1/0x4c0 [ 36.488303] true_probe+0x1d5/0x580 36.489498] __driver_device/03e+1065 [ 36.491140] driver_probe_device+0x49/0x220 [ 36.492475] __device_attach_driver+0x19e/0x1b0 [ 36.493988] bus_for_each_drv+0xcb/0x110 [ 36.495171] __device_attach+0x132/0x1f0 [ 36.496617] bus_probe_device+0x59/0xf0 [ 36.497875] device_add +0x4ec/0x7b0 [ 36.498972] usb_set_configuration+0xc63/0xe10 [ 36.500264] usb_generic_driver_probe+0x3b/0x80 [ 36.501740] usb_probe_device+0x90/0x110 36.503084] true_probe+0x1d5/0x580 [ 36.504241]
    __driver_probe_device+0xe3/0x130 [ 36.505548] driver_probe_device+0x49/0x220 [ 36.506766]
    __device_attach_driver+0x19e/0x1b0 [ 36.508368] bus_for_each_drv+0xcb/0x110 [ 36.509646]
    __device_attach+0x132/0x1f0 [ 36.510911] bus_probe_device+0x59/0xf0 [ 36.512103] device_add+0x4ec/0x7b0 [36.513215] usb_new_device+0x863/0xa00 [ 36.514736] hub_event+0x18c7/0x2220 [ 36.516130] process_one_work+
    ---truncated--- (CVE-2023-54270)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

検出

Linux Distros のパッチ未適用の脆弱性: CVE-2023-54270

medium Nessus プラグイン ID 281507

バージョン 1.9