In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.context will be set to uninitialized junk on the stack, which we'll then try to free. Initialize it early.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-513.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Fix potential null     pointer dereference In lan8814_get_sig_rx() and lan8814_get_sig_tx() ptp_parse_header() may return NULL as     ptp_header due to abnormal packet type or corrupted packet. Fix this bug by adding ptp_header check. Found     by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-35891)

  - In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in     do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however,     misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the     same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies -     array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on     mispredicted path. (CVE-2024-42265)

  - In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid     Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them.
    Commit 5ec27ec735ba (fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.)     added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting     net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.
    (CVE-2024-42312)

  - In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential deadlock on
    __exfat_get_dentry_set When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array is     allocated in __exfat_get_entry_set. The problem is that the bh-array is allocated with GFP_KERNEL. It does     not make sense. In the following cases, a deadlock for sbi->s_lock between the two processes may occur.
    CPU0 CPU1 ---- ---- kswapd balance_pgdat lock(fs_reclaim) exfat_iterate lock(&sbi->s_lock) exfat_readdir     exfat_get_uniname_from_ext_entry exfat_get_dentry_set __exfat_get_dentry_set kmalloc_array ...
    lock(fs_reclaim) ... evict exfat_evict_inode lock(&sbi->s_lock) To fix this, let's allocate bh-array with     GFP_NOFS. (CVE-2024-42315)

  - In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer     dereference in case of DT error in ks_pcie_setup_rc_app_regs() If IORESOURCE_MEM is not provided in Device     Tree due to any error, resource_list_first_type() will return NULL and pci_parse_request_of_pci_ranges()     will just emit a warning. This will cause a NULL pointer dereference. Fix this bug by adding NULL return     check. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-43823)

  - In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that     nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a goto out before we get to     checking for the security label, then args.context will be set to uninitialized junk on the stack, which     we'll then try to free. Initialize it early. (CVE-2024-46697)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2024-46697

medium

Tenable Plugins

medium