リモートのMiracleLinux 7ホストには、AXSA:2025-9625:10アドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    * メディアediadvbdevuse-after-free を修正します {CVE-2024-27043}
    * btrfsdev-replaceデバイス名を適切に検証します {CVE-2024-26791}
    * KVMnSVMメモリから PDPTE をロードする際に nCR3[4:0] を無視します {CVE-2024-50115}
    * net/schedTC_H_ROOT の qdisc_tree_reduce_backlog を停止します {CVE-2024-53057}
    * ipc/sem.csemctl(,,GETZCNT) のバグ修正
    * KEXEC_AUTO_RESERVED_SIZE を 256M に増加
    * x86/apic/x2apic1 つの割り込みのアフィニティを 1 つの cpu に設定します
    * bonding同じリンクステータス変更が繰り返し表示されないようにします
    * xen/netfrontライブ移行中に tx キューを停止します
    * xen/balloonxend ベースのツールスタックをサポートします
    * md/raid5ストライプのサイズ変更中の oops を修正します
    * blockblk_mq_rq_timed_out() の null ポインターデリファレンスを修正します
    * blockinit フラッシュ rq ref カウントを 1 にフラッシュ
    * blk-mq生成シーケンスを削除します
    * ドライバーコアバスドライバー API bus_register() の二重解放を修正 CVE
    CVE-2024-27043 Linux カーネルでは、次の脆弱性が解決しています media: edia: dvbdev: fix a use-after-free In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after dvbdev's deallocation, causing use-after-frees in many places, for example, in the following call chain: budget_register |-> dvb_dmxdev_init |-> dvb_register_device |-> dvb_dmxdev_release |-> dvb_unregister_device |-> dvb_remove_device |-> dvb_device_put |-> kref_put When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in dvb_register_device) could point to memory that had been freed in dvb_register_device. Thereafter, this pointer is transferred to kref_put and triggering a use-after-free.
    CVE-2024-26791 In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links).
    CVE-2024-50115 In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Ignore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't enforce 32-byte alignment of nCR3. In the absolute worst case scenario, failure to ignore bits 4:0 can result in an out-of-bounds read, e.g. if the target page is at the end of a memslot, and the VMM isn't using guard pages. Per the APM: The CR3 register points to the base address of the page-directory-pointer table. The page-directory-pointer table is aligned on a 32-byte boundary, with the low 5 address bits 4:0 assumed to be 0. And the SDM's much more explicit: 4:0 Ignored Note, KVM gets this right when loading PDPTRs, it's only the nSVM flow that is broken.
    CVE-2024-53057 In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

Tenableは、前述の記述ブロックをMiracleLinuxセキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

検出

MiracleLinux 7kernel-3.10.0-1160.119.1.0.8.el7.AXS7AXSA:2025-9625:10

high Nessus プラグイン ID 283043

バージョン 1.2