Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - drm/vmwgfx取消映射表面然后在平面状态中重置表面。切换到新的平面状态需要取消引用所有保持的表面。在mob 光标所需的工作中开始缓存映射的表面但没有重置指示表面当前是否映射的变量。这会导致崩溃，因为即使不存在表面，重复的状态也会错误地指示该表面已映射。这是因为在取消引用表面后该平面完全有可能由 bo 而不是表面支持。当取消引用平面状态表面时重置表面映射标记以修复清理中的空取消引用。修复 Wayland 上 KDE KWin 6.0 的崩溃Oops: 0000 [#1] PREEMPT SMP PTI CPU: 4 PID: 2533 Comm: kwin_wayland Not tainted 6.7.0-rc3-vmwgfx #2 硬件名称: VMware, Inc.
    VMware Virtual Platform/440BX Desktop Reference Platform、BIOS 6.00 2020 年 12 月 11 日 RIP
    0010:vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx] 代码00 00 00 75 3a 48 83 c4 10 5b 5d c3 cc cc cc cc 48 8b b3 a8 00 00 00 48 c7 c7 99 90 43 c0 e8 93 db 83 ca a8 00 00 00 <48> 8b 78 28 e8 e3 f> RSP0018:ffffb6b98216fa80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff969d84cdcb00 RCX
    0000000000000027 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff969e75f21600 RBP: ffff969d4143dc50 R08: 0000000000000000 R09: ffffb6b98216f920 R10: 0000000000000003 R11: ffff969e7feb3b10 R12:
    0000000000000000 R130000000000000000 R14000000000000027b R15ffff969d49c9fc00 FS
    00007f1e8f1b4180(0000) GS:ffff969e75f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 0000000000000028 CR3: 0000000104006004 CR4: 00000000003706f0 调用跟踪 <TASK> ?
    __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx] drm_atomic_helper_cleanup_planes+0x9b/0xc0 commit_tail+0xd1/0x130 drm_atomic_helper_commit+0x11a/0x140 drm_atomic_commit+0x97/0xd0 ?
    __pfx___drm_printfn_info+0x10/0x10 drm_atomic_helper_update_plane+0xf5/0x160 drm_mode_cursor_universal+0x10e/0x270 drm_mode_cursor_common+0x102/0x230 ?
    __pfx_drm_mode_cursor2_ioctl+0x10/0x10 drm_ioctl_kernel+0xb2/0x110 drm_ioctl+0x26d/0x4b0 ?
    __pfx_drm_mode_cursor2_ioctl+0x10/0x10 ? __pfx_drm_ioctl+0x10/0x10 vmw_generic_ioctl+0xa4/0x110 [vmwgfx]
    __x64_sys_ioctl+0x94/0xd0 do_syscall_64+0x61/0xe0 __x64_sys_ioctl+0xaf/0xd0 ? syscall_exit_to_user_mode+0x2b/0x40 do_syscall_64+0x70/0xe0 ? __x64_sys_ioctl+0xaf/0xd0 ? syscall_exit_to_user_mode+0x2b/0x40 do_syscall_64+0x70/0xe0 ? exc_page_fault+0x7f/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7f1e93f279ed Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff f> RSP002b:00007ffca0faf600 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX
    000055db876ed2c0 RCX: 00007f1e93f279ed RDX: 00007ffca0faf6c0 RSI: 00000000c02464bb RDI: 0000000000000015 RBP: 00007ffca0faf650 R08: 000055db87184010 R09: 0000000000000007 R10: 000055db886471a0 R11:
     R120000000000000246  : 00007ffca0faf6c0 R13: 00000000c02464bb R14: 0000000000000015 R15: 00007ffca0faf790 </TASK> Modules linked in: snd_seq_dummy snd_hrtimer nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_ine> CR2: 0000000000000028 ---[ end trace 0000000000000000 ]--- RIP: 0010 :vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx] 代码00 00 00 75 3a 48 83 c4 10 5b 5d c3 cc cc cc cc 48 8b b3 a8 00 00 00 48 c7 c7 99 90 43 c0 e8 93 c5 83 adbbca 83 adbbca 83 00 00 00 <48> 8b 78 28 e8 e3 f> RSP0018:ffffb6b98216fa80 EFLAGS: 00010246 RAX: 0000000000000000 RBX
    ffff969d84cdcb00 RCX0000000000000027 RDX0000000000000000 RSI0000000000000001 RDIffff969e75f21600 RBPffff969d4143 ---truncated--- (CVE-2023-52648)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2023-52648

medium Nessus 插件 ID 226582

版本 1.18