CentOS Linux 8 [TuxCare] 安全更新：bpftool / kernel / kernel-core / kernel-cross-headers / 等多个漏洞 （CENTOS-STREAM8：CLSA-2025：1763722365）
high Nessus 插件 ID 352377
语言：
简介
CentOS Linux 主机缺少一个或多个安全更新。描述
如 TuxCare CENTOS-STREAM8：CLSA-2025：1763722365公告所述，CentOS Linux 8 主机上存在安装的程序包，该漏洞会受到多个漏洞的影响。- 已修复 Linux 内核中的下列漏洞：bpf: Don't use tnum_range on array range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customized syzkaller: BUG: KASAN: slab-out-of-bounds in bpf_int_jit_compile+0x1257/0x13f0 Read of size 8 at addr ffff888004e90b58 by task syz-executor.0/1489 CPU:
1 PID: 1489 Comm: syz-executor.0 Not tainted 5.19.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x9c/0xc9 print_address_description.constprop.0+0x1f/0x1f0 ? bpf_int_jit_compile+0x1257/0x13f0 kasan_report.cold+0xeb/0x197 ? kvmalloc_node+0x170/0x200 ? bpf_int_jit_compile+0x1257/0x13f0 bpf_int_jit_compile+0x1257/0x13f0 ? arch_prepare_bpf_dispatcher+0xd0/0xd0 ? rcu_read_lock_sched_held+0x43/0x70 bpf_prog_select_runtime+0x3e8/0x640 ? bpf_obj_name_cpy+0x149/0x1b0 bpf_prog_load+0x102f/0x2220 ? __bpf_prog_put.constprop.0+0x220/0x220 ? find_held_lock+0x2c/0x110 ?
__might_fault+0xd6/0x180 ? lock_downgrade+0x6e0/0x6e0 ? lock_is_held_type+0xa6/0x120 ?
__might_fault+0x147/0x180 __sys_bpf+0x137b/0x6070 ? bpf_perf_link_attach+0x530/0x530 ? new_sync_read+0x600/0x600 ? __fget_files+0x255/0x450 ? lock_downgrade+0x6e0/0x6e0 ? fput+0x30/0x1a0 ? ksys_write+0x1a8/0x260 __x64_sys_bpf+0x7a/0xc0 ? syscall_enter_from_user_mode+0x21/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f917c4e2c2d The problem here is that a range of tnum_range(0, map->max_entries - 1) has limited ability to represent the concrete tight range with the tnum as the set of resulting states from value + mask can result in a superset of the actual intended range, and as such a tnum_in(range, reg->var_off) check may yield true when it shouldn't, for example tnum_range(0, 2) would result in 00XX -> v = 0000, m = 0011 such that the intended set of {0, 1, 2} is here represented by a less precise superset of {0, 1, 2, 3}. As the register is known const scalar, really just use the concrete reg->var_off.value for the upper index check. (CVE-2022-49985)
- 已修复 Linux 内核中的下列漏洞：fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes) (CVE-2022-50367)
- 已修复 Linux 内核中的下列漏洞：Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in
__mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in
__mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in
__mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389 (CVE-2022-50386)
- 已修复 Linux 内核中的下列漏洞：of: Fix double free in of_parse_phandle_with_args_map In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of new is NULL on the first iteration of the inner loop. Make sure that this is true in all iterations of the outer loop by setting new to NULL after its value is assigned to cur. Extend the unittest to detect the double free and add an additional test case that actually triggers this path. (CVE-2023-52679)
- 已修复 Linux 内核中的下列漏洞：media: gspca: cpia1: shift-out-of-bounds in set_flicker Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the value of the variable sd->params.exposure.gain exceeds the number of bits in an integer, a shift-out-of-bounds error is reported. It is triggered because the variable currentexp cannot be left-shifted by more than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional expression is added. (CVE-2023-52764)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
根据 TuxCare 公告 CENTOS-STREAM8：CLSA-2025：1763722365 中的指南更新受影响的程序包。另见
插件详情
严重性: High
ID: 352377
文件名: tuxcare_centos_8_CLSA-2025-1763722365.nasl
版本: 1.1
类型: Local
代理: unix
发布时间: 2026/9/30
最近更新时间: 2026/9/30
支持的传感器: Continuous Assessment, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
风险信息
VPR
风险因素: High
分数: 7
百分位: 98.57
Vendor
Vendor Severity: Important
CVSS v2
风险因素: High
基本分数: 7.7
时间分数: 6
矢量: CVSS2#AV:A/AC:L/Au:S/C:C/I:C/A:C
CVSS 分数来源: CVE-2022-50386
CVSS v3
风险因素: High
基本分数: 8
时间分数: 7.2
矢量: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:P/RL:O/RC:C
漏洞信息
必需的 KB 项: Host/OS/extended-third-party, Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list
可利用: true
易利用性: Exploits are available
补丁发布日期: 2025/11/21
漏洞发布日期: 2021/7/21
参考资料信息
CVE: CVE-2022-49985, CVE-2022-50367, CVE-2022-50386, CVE-2023-52530, CVE-2023-52679, CVE-2023-52764, CVE-2023-52775, CVE-2023-52847, CVE-2023-52864, CVE-2023-52884, CVE-2023-53125, CVE-2023-53178, CVE-2023-53226, CVE-2023-53257, CVE-2023-53305, CVE-2023-53373, CVE-2024-26739, CVE-2024-26958, CVE-2024-26961, CVE-2024-27395, CVE-2024-35937, CVE-2024-35939, CVE-2024-36015, CVE-2024-36880, CVE-2024-36921, CVE-2024-38556, CVE-2024-38586, CVE-2024-38601, CVE-2024-38635, CVE-2024-38659, CVE-2024-39487, CVE-2024-40927, CVE-2024-40978, CVE-2024-42119, CVE-2024-42292, CVE-2024-46713, CVE-2024-46754, CVE-2024-50038, CVE-2024-52332, CVE-2024-53214, CVE-2024-56539, CVE-2024-56570, CVE-2024-56594, CVE-2024-56616, CVE-2024-57876, CVE-2024-57904, CVE-2024-57929, CVE-2024-58014, CVE-2024-58072, CVE-2025-21704, CVE-2025-21772, CVE-2025-22121, CVE-2025-37796, CVE-2025-37797, CVE-2025-38001, CVE-2025-38392, CVE-2025-38461, CVE-2025-38498, CVE-2025-38527, CVE-2025-38556, CVE-2025-38718, CVE-2025-39730, CVE-2025-39757, CVE-2025-39817, CVE-2025-39864
CLSA: 2025:1763722365