The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989609 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

    As Yanming reported in bugzilla:

    https://bugzilla.kernel.org/show_bug.cgi?id=215894

    I have encountered a bug in F2FS file system in kernel v5.17.

    I have uploaded the system call sequence as case.c, and a fuzzed image can     be found in google net disk

    The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can     reproduce the bug by running the following commands:

    kernel BUG at fs/f2fs/segment.c:2291!     Call Trace:
     f2fs_invalidate_blocks+0x193/0x2d0      f2fs_fallocate+0x2593/0x4a70      vfs_fallocate+0x2a5/0xac0      ksys_fallocate+0x35/0x70
     __x64_sys_fallocate+0x8e/0xf0      do_syscall_64+0x3b/0x90      entry_SYSCALL_64_after_hwframe+0x44/0xae

    The root cause is, after image was fuzzed, block mapping info in inode     will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause     panic when updating SIT with invalid blkaddr.

    Let's fix the issue by adding sanity check on block address before updating     SIT table with it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - f2fs f2fs_do_zero_range() のブロックアドレスでサニティチェックを行うように修正します Yanming 氏が bugzilla で報告したように
    https://bugzilla.kernel.org/show_bug.cgi?id=215894 カーネル v5.17 の F2FS ファイルシステムでバグに遭遇しました。システムコールシーケンスを case.c としてアップロードしました。ファジングされた画像は google net ディスクにあります。カーネルは CONFIG_KASAN=y および CONFIG_KASAN_INLINE=y を有効にする必要があります。次のコマンドを実行すると、バグを複製できます。kernel BUG at fs/f2fs/segment.c:2291! 呼び出しトレース:
    f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in inodeは SIT テーブルと一致しないため、f2fs_fallocate() では、無効な blkaddr で SIT を更新する際にパニックが発生します。SIT テーブルを使用してブロックアドレスにサニティチェックを追加することにより、この問題を修正します。CVE-2022-49363

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - f2fs修复以对 f2fs_do_zero_range() 中的区块地址进行健全性检查Yanming 在 bugzilla 中报告
    https://bugzilla.kernel.org/show_bug.cgi?id=215894 我在内核 v5.17 的 F2FS 文件系统中遇到一个缺陷。我已将系统调用序列作为 case.c 上传但可以在 google net disk 中找到模糊的图像 内核应启用 CONFIG_KASAN=y 和 CONFIG_KASAN_INLINE=y。可以通过运行以下命令来重现该缺陷kernel BUG at fs/f2fs/segment.c:2291! 调用跟踪：
    f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in inode将与 SIT 表不一致因此在 f2fs_fallocate() 中它将在以无效的 blkaddr 更新 SIT 时造成错误。让我们通过在使用区块地址更新 SIT 表之前对区块地址添加健全性检查来修复该问题。 (CVE-2022-49363)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989361 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

    As Yanming reported in bugzilla:

    https://bugzilla.kernel.org/show_bug.cgi?id=215894

    I have encountered a bug in F2FS file system in kernel v5.17.

    I have uploaded the system call sequence as case.c, and a fuzzed image can     be found in google net disk

    The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can     reproduce the bug by running the following commands:

    kernel BUG at fs/f2fs/segment.c:2291!     Call Trace:
     f2fs_invalidate_blocks+0x193/0x2d0      f2fs_fallocate+0x2593/0x4a70      vfs_fallocate+0x2a5/0xac0      ksys_fallocate+0x35/0x70
     __x64_sys_fallocate+0x8e/0xf0      do_syscall_64+0x3b/0x90      entry_SYSCALL_64_after_hwframe+0x44/0xae

    The root cause is, after image was fuzzed, block mapping info in inode     will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause     panic when updating SIT with invalid blkaddr.

    Let's fix the issue by adding sanity check on block address before updating     SIT table with it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - f2fs: fix to do sanity check on block address in f2fs_do_zero_range() As Yanming reported in bugzilla:
    https://bugzilla.kernel.org/show_bug.cgi?id=215894 I have encountered a bug in F2FS file system in kernel     v5.17. I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net     disk The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by     running the following commands: kernel BUG at fs/f2fs/segment.c:2291! Call Trace:
    f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0     ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90     entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in     inode will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause panic when updating SIT     with invalid blkaddr. Let's fix the issue by adding sanity check on block address before updating SIT     table with it. (CVE-2022-49363)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - f2fs修正以對 f2fs_do_zero_range() 中的區塊位址執行功能健全檢查如 Yanming 在 bugzilla 中所報告
    https://bugzilla.kernel.org/show_bug.cgi?id=215894 我在核心 v5.17 的 F2FS 檔案系統中遇到錯誤。我已將系統呼叫序列 (case.c) 上傳然後在 google net disk 中找到模糊影像。 核心應啟用 CONFIG_KASAN=y 和 CONFIG_KASAN_INLINE=y。您可以執行下列命令來重現該錯誤： fs/f2fs/segment.c:2291! 的核心錯誤呼叫追踪：
    f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in inode將與 SIT 表格不一致因此在 f2fs_fallocate() 中使用無效的 blkaddr 更新 SIT 時將會造成錯誤。讓我們先對區塊位址新增功能健全檢查然後再以區塊位址更新 SIT 表格以修正此問題。 (CVE-2022-49363)

請注意，Nessus 依賴供應商報告的套件存在。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
273130	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989609)	Nessus	Unity Linux Local Security Checks	2025/11/5	2025/11/5	medium
275906	TencentOS Server 4: kernel (TSSA-2025:0346)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
225779	Linux Distros のパッチ未適用の脆弱性: CVE-2022-49363	Nessus	Misc.	2025/3/5	2025/10/28	medium
225779	Linux Distros 未修补的漏洞：CVE-2022-49363	Nessus	Misc.	2025/3/5	2025/10/28	medium
273667	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989361)	Nessus	Unity Linux Local Security Checks	2025/11/5	2025/11/5	medium
225779	Linux Distros Unpatched Vulnerability : CVE-2022-49363	Nessus	Misc.	2025/3/5	2025/10/28	medium
225779	Linux Distros 未修補的弱點：CVE-2022-49363	Nessus	Misc.	2025/3/5	2025/10/28	medium

检测

插件搜索

medium

high

medium

medium

medium

medium

medium