Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - binder修正爭用情形所造成的 ref->proc 的 UAF。BINDER_TYPE_WEAK_HANDLE 類型的交易可能無法遞增節點的參照。在此情況下目標 proc 通常會在關閉時如預期釋放失敗的參照。不過如果目標平行死亡則呼叫會與 binder_deferred_release() 爭用因此目標本可以釋放其所有參照現在使新失敗參照的清理處於未處理狀態。然後交易結束且目標 proc 被釋放使 ref->proc 現在變成懸置指標。稍後ref->node 會關閉而我們嘗試取得 spin_lock(&ref->proc->inner_lock)進而導致產生下方報告的釋放後使用錯誤。讓我們當場清理失敗的參照而非仰賴目標來修正此問題。
    ================================================================== BUG: KASAN: 釋放後使用發生於
    _raw_spin_lock+0xa8/0x150 工作 kworker/ 在 addr ffff5ca207094238 寫入大小 4/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 未受污染的 5.19.0-rc8 #10 硬體名稱linux,dummy-virt ( DT) 工作佇列事件 binder_deferred_func 呼叫追踪 dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4
    __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 (CVE-2022-49939)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - binder修复争用条件导致的 ref->proc 的 UAF BINDER_TYPE_WEAK_HANDLE 类型的事务可能无法递增节点的引用。在这种情况下目标 proc 通常会在预期关闭时释放失败的引用。但是如果目标并行终止则调用将与 binder_deferred_release() 争用因此目标现在可能已释放其所有引用而不处理未处理的新引用的清理。交易随后结束且目标 proc 获得释放使得 ref->proc 现在成为悬摆指针。稍后关闭 ref->node我们尝试获取 spin_lock(&ref->proc->inner_lock)这导致出现下面所报告的释放后使用缺陷。我们通过当场清除失败的引用而不是依赖目标来修复此问题。
    ================================================================== BUG: KASAN: use-after-free in
    _raw_spin_lock+0xa8/0x150 由任务 kworker/ 在 addr ffff5ca207094238 进行大小 4 的写入1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 未受感染 5.19.0-rc8 #10 硬件名称linux,dummy-virt DT) 工作队列事件 binder_deferred_func 调用跟踪dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x110 kasan_check_range+0xfc/0x1a4
    __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 (CVE-2022-49939)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - connector 競合状態により引き起こされる ref->proc の UAF を修正します。タイプ BINDER_TYPE_WEAK_HANDLE のトランザクションは、ノードに対する参照をインクリメントできない可能性があります。この場合、ターゲット proc は通常、想定通りにクローズする際に、失敗した参照をリリースします。ただし、ターゲットがパラレルで無効になった場合、呼び出しはバインダー_deferred_release()と競合するため、ターゲットは、新しい失敗した参照のクリーンアップを処理されずに、その参照をすべてリリースする可能性があります。その後トランザクションが終了し、ターゲットの proc がリリースされ、ref->proc がダングリングポインターになります。後に、ref->node が閉じられ、spin_lock(&ref->proc->inner_lock) を取得しようとします。これにより、以下で報告されている use-after-free バグが発生します。ターゲットに依存するのではなく、その場所で失敗した参照をクリーンアップすることで、これを修正します。
    ================================================================== BUG: KASAN: 
    _raw_spin_lock+0xa8/0x150 タスク kworker/ による addr ffff5ca207094238 でのサイズ 4 の書き込み1:0/590 CPU1 PID590 通信kworker/1:0 汚染されていない 5.19.0-rc8 #10 ハードウェア名linux,dummy-virtワークキューイベント cluster_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4
    __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20CVE-2022-49939

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993199 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of ref->proc caused by race condition

    A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the     reference for a node. In this case, the target proc normally releases     the failed reference upon close as expected. However, if the target is     dying in parallel the call will race with binder_deferred_release(), so     the target could have released all of its references by now leaving the     cleanup of the new failed reference unhandled.

    The transaction then ends and the target proc gets released making the     ref->proc now a dangling pointer. Later on, ref->node is closed and we     attempt to take spin_lock(&ref->proc->inner_lock), which leads to the     use-after-free bug reported below. Let's fix this by cleaning up the     failed reference on the spot instead of relying on the target to do so.

      ==================================================================       BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150       Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590

      CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10       Hardware name: linux,dummy-virt (DT)       Workqueue: events binder_deferred_func       Call trace:
       dump_backtrace.part.0+0x1d0/0x1e0        show_stack+0x18/0x70        dump_stack_lvl+0x68/0x84        print_report+0x2e4/0x61c        kasan_report+0xa4/0x110        kasan_check_range+0xfc/0x1a4
       __kasan_check_write+0x3c/0x50
       _raw_spin_lock+0xa8/0x150        binder_deferred_func+0x5e0/0x9b0        process_one_work+0x38c/0x5f0        worker_thread+0x9c/0x694        kthread+0x188/0x190        ret_from_fork+0x10/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - binder: fix UAF of ref->proc caused by race condition A transaction of type BINDER_TYPE_WEAK_HANDLE can     fail to increment the reference for a node. In this case, the target proc normally releases the failed     reference upon close as expected. However, if the target is dying in parallel the call will race with     binder_deferred_release(), so the target could have released all of its references by now leaving the     cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released     making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take     spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by     cleaning up the failed reference on the spot instead of relying on the target to do so.
    ================================================================== BUG: KASAN: use-after-free in
    _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590     Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events     binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70     dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4
    __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0     process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20     (CVE-2022-49939)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991165 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of ref->proc caused by race condition

    A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the     reference for a node. In this case, the target proc normally releases     the failed reference upon close as expected. However, if the target is     dying in parallel the call will race with binder_deferred_release(), so     the target could have released all of its references by now leaving the     cleanup of the new failed reference unhandled.

    The transaction then ends and the target proc gets released making the     ref->proc now a dangling pointer. Later on, ref->node is closed and we     attempt to take spin_lock(&ref->proc->inner_lock), which leads to the     use-after-free bug reported below. Let's fix this by cleaning up the     failed reference on the spot instead of relying on the target to do so.

      ==================================================================       BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150       Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590

      CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10       Hardware name: linux,dummy-virt (DT)       Workqueue: events binder_deferred_func       Call trace:
       dump_backtrace.part.0+0x1d0/0x1e0        show_stack+0x18/0x70        dump_stack_lvl+0x68/0x84        print_report+0x2e4/0x61c        kasan_report+0xa4/0x110        kasan_check_range+0xfc/0x1a4
       __kasan_check_write+0x3c/0x50
       _raw_spin_lock+0xa8/0x150        binder_deferred_func+0x5e0/0x9b0        process_one_work+0x38c/0x5f0        worker_thread+0x9c/0x694        kthread+0x188/0x190        ret_from_fork+0x10/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992622 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    binder: fix UAF of ref->proc caused by race condition

    A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the     reference for a node. In this case, the target proc normally releases     the failed reference upon close as expected. However, if the target is     dying in parallel the call will race with binder_deferred_release(), so     the target could have released all of its references by now leaving the     cleanup of the new failed reference unhandled.

    The transaction then ends and the target proc gets released making the     ref->proc now a dangling pointer. Later on, ref->node is closed and we     attempt to take spin_lock(&ref->proc->inner_lock), which leads to the     use-after-free bug reported below. Let's fix this by cleaning up the     failed reference on the spot instead of relying on the target to do so.

      ==================================================================       BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150       Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590

      CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10       Hardware name: linux,dummy-virt (DT)       Workqueue: events binder_deferred_func       Call trace:
       dump_backtrace.part.0+0x1d0/0x1e0        show_stack+0x18/0x70        dump_stack_lvl+0x68/0x84        print_report+0x2e4/0x61c        kasan_report+0xa4/0x110        kasan_check_range+0xfc/0x1a4
       __kasan_check_write+0x3c/0x50
       _raw_spin_lock+0xa8/0x150        binder_deferred_func+0x5e0/0x9b0        process_one_work+0x38c/0x5f0        worker_thread+0x9c/0x694        kthread+0x188/0x190        ret_from_fork+0x10/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
246997	Linux Distros 未修補的弱點：CVE-2022-49939	Nessus	Misc.	2025/8/9	2026/1/14	high
246997	Linux Distros 未修补的漏洞：CVE-2022-49939	Nessus	Misc.	2025/8/9	2026/1/14	high
246997	Linux Distros のパッチ未適用の脆弱性: CVE-2022-49939	Nessus	Misc.	2025/8/9	2026/1/14	high
281005	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993199)	Nessus	Unity Linux Local Security Checks	2025/12/31	2025/12/31	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	2021/7/22	2026/3/23	high
246997	Linux Distros Unpatched Vulnerability : CVE-2022-49939	Nessus	Misc.	2025/8/9	2026/1/14	high
278274	Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991165)	Nessus	Unity Linux Local Security Checks	2025/12/11	2025/12/11	high
280155	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992622)	Nessus	Unity Linux Local Security Checks	2025/12/30	2025/12/30	high

检测

插件搜索

high

high

high

high

high

high

high

high