CentOS Linux 8.5 [TuxCare] 安全更新：bpftool / kernel / kernel-core / kernel-cross-headers / 等多种漏洞 （CENTOS8.5：CLSA-2025：1738663660）
high Nessus 插件 ID 366966
语言：
简介
CentOS Linux 主机缺少一个或多个安全更新。描述
如 TuxCare CENTOS8.5：CLSA-2025：1738663660公告所述，CentOS Linux 8.5 主机上安装的程序包受到多个漏洞的影响。- 已修复 Linux 内核中的下列漏洞：net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error. Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.
(CVE-2023-52664)
- 已修复 Linux 内核中的下列漏洞：smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. (CVE-2024-26928)
- 已修复 Linux 内核中的下列漏洞：smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. (CVE-2024-35861)
- 已修复 Linux 内核中的下列漏洞：smb: client: fix potential UAF in is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
(CVE-2024-35863)
- 已修复 Linux 内核中的下列漏洞：smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
(CVE-2024-35864)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
根据 TuxCare 公告 CENTOS8.5：CLSA-2025：1738663660 中的指南更新受影响的程序包。另见
插件详情
严重性: High
ID: 366966
文件名: tuxcare_centos_8.5_CLSA-2025-1738663660.nasl
版本: 1.1
类型: Local
代理: unix
发布时间: 2026/10/18
最近更新时间: 2026/10/18
支持的传感器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
风险信息
VPR
风险因素: High
分数: 7.6
百分位: 98.67
Vendor
Vendor Severity: Important
CVSS v2
风险因素: Medium
基本分数: 6.8
时间分数: 5
矢量: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS 分数来源: CVE-2024-50047
CVSS v3
风险因素: High
基本分数: 7.8
时间分数: 6.8
矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:U/RL:O/RC:C
漏洞信息
必需的 KB 项: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party
易利用性: No known exploits are available
补丁发布日期: 2025/2/4
漏洞发布日期: 2024/2/14
参考资料信息
CVE: CVE-2023-52664, CVE-2023-52752, CVE-2024-26928, CVE-2024-35861, CVE-2024-35863, CVE-2024-35864, CVE-2024-35865, CVE-2024-35867, CVE-2024-35868, CVE-2024-46826, CVE-2024-50036, CVE-2024-50047
CLSA: 2025:1738663660