iracleLinux 7kernel-3.10.0-1160.119.1.0.6.el7.AXS7 (AXSA:2024-9046:38)
high Nessus 插件 ID 291927
语言：
简介
远程iraclelinux 主机缺少一个或多个安全更新。描述
远程iraclelinux 7 主机上存在安装的程序包该程序包受到 AXSA:2024-9046:38 公告中提及的多个漏洞的影响。* net/mlx5eSHAMPO修复无效的 WQ 链接列表取消链接 {CVE-2024-44970}
* PCI将缺少的桥接锁定添加至 pci_bus_lock() {CVE-2024-46750}
* net/mlx5丢弃内部错误中的命令完成 {CVE-2024-38555}
* ALSApcm修复并发 prealloc proc 写入之间的争用 {CVE-2022-1048}
* ALSApcm添加内存分配失败的调试打印 {CVE-2022-1048}
* ALSApcm修复并发准备与 hw_params/hw_free 调用之间的争用 {CVE-2022-1048}
* ALSApcm修复并发读取/写入与缓冲区变更之间的争用 {CVE-2022-1048}
* ALSApcm修复并发 hw_params 和 hw_free 调用之间的争用 {CVE-2022-1048}
* net/packet修复 packet_recvmsg() 中的 slab 越界访问 {CVE-2022-20368}
* 数据包在 recvmsg msg_name 中至少返回 sizeof sockaddr_ll {CVE-2022-20368}
* 恢复 net/数据包修复 packet_recvmsg() 中的 slab 越界访问
* KVMVMX当客户机具有 IBRS {CVE-2022-2196} 时在模拟的 VM 退出上执行 IBPB CVE
CVE-2022-1048 在用户触发 PCM hw_params 的并发调用的方式中Linux 内核的声音子系统中发现一个释放后使用缺陷。其他 ioctl 的 ALSA PCM 内会发生 hw_free ioctls 或类似争用条件。本地用户可利用此缺陷导致系统崩溃或可能升级其系统权限。
CVE-2022-20368 Product Android版本 Android kernelAndroid ID A-224546354References上游内核 CVE-2022-2196 KVM: nVMX 内的 Linux 内核中存在一个回归允许推测执行攻击。
在 KVM (L0) 宣称会向 L1 提供 eIBRS 支持的背景下， L1 认为在运行 L2 之后便不需要使用 retpoline 或 IBPB，导致 L2 可以对 L1 执行 Spectre v2 攻击。在 L2 上拥有代码执行权的攻击者可以在主机的间接分支上执行代码。建议升级到 Kernel 6.2 或提交 2e7eab81425a 之后的版本 CVE-2024-38555 在 Linux 内核中以下漏洞已得到解决 net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state.
Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually. Kernel log: ------------[ cut here ]------------ refcount_t: underflow;
use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core]
__handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230
__common_interrupt+0x3b/0xa0 common_interrupt+0x7b/0xa0 asm_common_interrupt+0x22/0x40 CVE-2024-44970 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again.
CVE-2024-46750 In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock() One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP:
0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the bus and cxl_bus reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). [bhelgaas: squash in recursive locking deadlock fix from Keith Busch:
https://lore.kernel.org/r/[email protected]]
Tenable 已直接从MiracleLinux 安全公告中提取上述描述块。
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
更新受影响的程序包。另见
插件详情
严重性: High
ID: 291927
文件名: miracle_linux_AXSA-2024-9046.nasl
版本: 1.1
类型: local
发布时间: 2026/1/20
最近更新时间: 2026/1/20
支持的传感器: Nessus Agent, Nessus
风险信息
VPR
风险因素: High
分数: 7.3
Vendor
Vendor Severity: High
CVSS v2
风险因素: Medium
基本分数: 6.9
时间分数: 5.1
矢量: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS 分数来源: CVE-2022-1048
CVSS v3
风险因素: High
基本分数: 8.8
时间分数: 7.7
矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:U/RL:O/RC:C
CVSS 分数来源: CVE-2022-2196
漏洞信息
CPE: p-cpe:/a:miracle:linux:kernel-tools, cpe:/o:miracle:linux:7, p-cpe:/a:miracle:linux:kernel-debug, p-cpe:/a:miracle:linux:kernel-tools-libs, p-cpe:/a:miracle:linux:python-perf, p-cpe:/a:miracle:linux:perf, p-cpe:/a:miracle:linux:bpftool, p-cpe:/a:miracle:linux:kernel-headers, p-cpe:/a:miracle:linux:kernel-devel, p-cpe:/a:miracle:linux:kernel-abi-whitelists, p-cpe:/a:miracle:linux:kernel-debug-devel, p-cpe:/a:miracle:linux:kernel
必需的 KB 项: Host/local_checks_enabled, Host/cpu, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list
易利用性: No known exploits are available
补丁发布日期: 2024/12/4
漏洞发布日期: 2022/4/19
参考资料信息
CVE: CVE-2022-1048, CVE-2022-20368, CVE-2022-2196, CVE-2024-38555, CVE-2024-44970, CVE-2024-46750