The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-547.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink: Initialise     extack before use in ACKs Add missing extack initialisation when ACKing BATCH_BEGIN and BATCH_END.
    (CVE-2024-44945)

  - In the Linux kernel, the following vulnerability has been resolved: net: fix crash when config small     gso_max_size/gso_ipv4_max_size Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in     sk_dst_gso_max_size(), which may trigger a BUG_ON crash, because sk->sk_gso_max_size would be much bigger     than device limits. Call Trace: tcp_write_xmit tso_segs = tcp_init_tso_segs(skb, mss_now);
    tcp_set_skb_tso_segs tcp_skb_pcount_set // skb->len = 524288, mss_now = 8 // u16 tso_segs = 524288/8 =     65535 -> 0 tso_segs = DIV_ROUND_UP(skb->len, mss_now) BUG_ON(!tso_segs) Add check for the minimum value of     gso_max_size and gso_ipv4_max_size. (CVE-2024-50258)

  - In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error     path behaviour The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and     numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can     occur. A large amount of the complexity arises from trying to handle errors late in the process of mapping     a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent     state. Taking advantage of previous patches in this series we move a number of checks earlier in the code,     simplifying things by moving the core of the logic into a static internal function __mmap_region(). Doing     this allows us to perform a number of checks up front before we do any real work, and allows us to unwind     the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE     validation unconditionally also. We move a number of things here: 1. We preallocate memory for the     iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform     complicated and error-prone close/free logic. We carefully free iterator state on both success and error     paths. 2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously     the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a     matching mapping_unmap_writable() on success and error paths. We now do this unconditionally if this is a     file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however     doing so does not invalidate the seal check we just performed, and we in any case always decrement the     counter in the wrapper. We perform a debug assert to ensure a driver does not attempt to do the opposite.
    3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64     and sparc64, and the check is only meaningful for SPARC with ADI enabled. We explicitly add a warning for     this arch if a driver invalidates this check, though the code ought eventually to be fixed to eliminate     the need for this. With all of these measures in place, we no longer need to explicitly close the VMA on     error paths, as we place all checks which might fail prior to a call to any driver mmap hook. This     eliminates an entire class of errors, makes the code easier to reason about and more robust.
    (CVE-2024-53096)

  - In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames     of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this     type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.
    (CVE-2024-53104)

  - In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in     alloc_pages_bulk_noprof We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in     alloc_pages_bulk_noprof() when the task is migrated between cpusets. When cpuset is enabled, in     prepare_alloc_pages(), ac->nodemask may be t->mems_allowed. when first_zones_zonelist() is called     to find preferred_zoneref, the ac->nodemask may be modified concurrently if the task is migrated between     different cpusets. Assuming we have 2 NUMA Node, when traversing Node1 in ac->zonelist, the nodemask is 2,     and when traversing Node2 in ac->zonelist, the nodemask is 1. As a result, the ac->preferred_zoneref     points to NULL zone. In alloc_pages_bulk_noprof(), for_each_zone_zonelist_nodemask() finds a allowable     zone and calls zonelist_node_idx(ac.preferred_zoneref), leading to NULL pointer dereference.
    __alloc_pages_noprof() fixes this issue by checking NULL pointer in commit ea57485af8f4 (mm, page_alloc:
    fix check for NULL preferred_zone) and commit df76cee6bbeb (mm, page_alloc: remove redundant checks from     alloc fastpath). To fix it, check NULL pointer for preferred_zoneref->zone. (CVE-2024-53113)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS 9 : kernel-5.14.0-547.el9

high Nessus Plugin ID 213467

Version 1.1