遠端 Oracle Linux 8 主機中安裝的套件受到 ELSA-2022-1759 公告中提及的多個弱點影響。

  - 在 hivex 程式庫中發現一個缺陷。此缺陷允許攻擊者輸入特製的 Windows 登錄 (hive) 檔，造成 hivex 以遞回方式呼叫 _get_children() 函式，進而導致堆疊溢位。此弱點對系統可用性威脅最大。(CVE-2021-3622)

  - QEMU：hw/acpi/pcihp.c 的 pci_write() 中發生 NULL 指標解除參照 (CVE-2021-4158)

  - libnbd：nbdcopy：遺漏處理錯誤可能會導致建立損毀的目標影像 (CVE-2022-0485)

  - 在 QEMU 的磁碟片模擬器中發現一個 NULL 指標解除參照缺陷。如果所選磁碟機未使用區塊裝置初始化，則在處理讀取/寫入 ioport 命令時會發生此問題。
    擁有權限的來賓使用者可能利用此缺陷，使主機上的 QEMU 處理程序損毀，進而導致拒絕服務。此弱點對系統可用性威脅最大。(CVE-2021-20196)

  - 在 QEMU 6.2.0 之前版本的區塊鏡像層中發現一個 NULL 指標解除參照問題。
    `self` 指標在 mirror_wait_on_conflicts() 中遭到解除參照，但未經確認其不是 NULL 指標。當寫入的資料達到鏡像節點的閾值時，來賓中的惡意無權限使用者可利用此缺陷使主機上的 QEMU 處理程序損毀。(CVE-2021-4145)

  - 在 nbdkit 中發現一個缺陷，這是因為不當快取跨 STARTTLS 加密邊界的純文字狀態所致。MitM 攻擊者可利用此缺陷，在代理用戶端向伺服器傳送其他任何項目之前，插入純文字 NBD_OPT_STRUCTURED_REPLY，進而可能導致用戶端終止 NBD 工作階段。此弱點對系統可用性威脅最大。(CVE-2021-3716)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_inode_lookup_by_name 函式中使用建構的 NTFS 影像，可能會造成堆積型緩衝區溢位。(CVE-2021-39256)

  - 在 QEMU 的 virtio-net 裝置中發現一個釋放後使用弱點。當描述符號的位址屬於非直接存取區域時，可能會發生此問題，這是因為在取消對應 virtqueue elem 後設定了 num_buffers 所致。惡意來賓使用者可利用此缺陷造成 QEMU 損毀，進而造成拒絕服務或可能以 QEMU 處理程序的權限在主機上執行程式碼。(CVE-2021-3748)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_extent_inode_open 中使用建構的 NTFS 影像，可能會造成 NULL 指標解除參照。(CVE-2021-39251)

  - 在 NTFS-3G 2021.8.22 之前版本中，當為函式 ntfs_get_attribute_value 提供特製的 NTFS 屬性時，可能會發生堆積型緩衝區溢位，進而允許造成記憶體洩露或拒絕服務。此弱點是由於超出邊界的緩衝區存取所致，可藉由掛載特製的 ntfs 磁碟分割來觸發。根本原因則是讀取 MFT 記錄後遺漏一致性檢查：bytes_in_use 欄位應小於 bytes_allocate 欄位。否則，記錄剖析會繼續進行。(CVE-2021-33285)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在 NTFS 影像中提供特製的 NTFS inode 路徑名稱時，可能會發生堆積型緩衝區溢位，進而導致記憶體洩漏、拒絕服務，甚至程式碼執行。(CVE-2021-35266)

  - 在 NTFS-3G 2021.8.22 之前版本中，當更正 MFT 和 MFTMirror 中的差異時，可能會發生堆疊緩衝區溢位，進而允許在執行 setuid-root 程式時執行程式碼或提升權限。(CVE-2021-35267)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在函式 ntfs_inode_real_open 中載入特製的 NTFS inode 時，可能會發生堆積緩衝區溢位，進而允許執行程式碼和提升權限。(CVE-2021-35268)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在函式 ntfs_attr_setup_flag 中設定來自 MFT 的特製 NTFS 內容時，可能會發生堆積緩衝區溢位，進而允許執行程式碼和提升權限。(CVE-2021-35269)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_runlists_merge_i 中使用建構的 NTFS 影像，可能會造成超出邊界讀取。
    (CVE-2021-39253)

  - 在 NTFS-3G 2021.8.22 之前版本中使用建構的 NTFS 影像 (未配置點陣圖)，可能會造成無限遞回函式呼叫鏈 (從 ntfs_attr_pwrite 開始)，進而導致堆積型緩衝區溢位。(CVE-2021-39257)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_attr_find() 和 ntfs_external_attr_find() 中使用建構的 NTFS 影像，可能會造成超出邊界讀取。(CVE-2021-39258)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_inode_lookup_by_name 中使用建構的 NTFS 影像，可能會造成超出邊界存取問題，這是由於未清除屬性長度所致。(CVE-2021-39259)

  - 在 NTFS-3G 2021.8.22 之前版本中，特製的 NTFS 影像可觸發由 ntfs_get_attribute_value 中未清理的屬性所造成的堆積型緩衝區溢位弱點。(CVE-2021-39263)

  - libvirt：VM 關機期間的分割錯誤可導致 vdsm 懸置 (CVE-2021-3975)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在 NTFS 影像中提供特製的 MFT 區段時，可能會發生堆積型緩衝區溢位，並允許程式碼執行。(CVE-2021-33289)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_inode_sync_standard_information 中使用建構的 NTFS 影像，可能會造成超出邊界存取問題。(CVE-2021-39260)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_decompress 中使用建構的 NTFS 影像，可能會造成超出邊界讀取問題。
    (CVE-2021-39262)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在 NTFS 影像中提供特製的 unicode 字串時，可能會發生堆積型緩衝區溢位，並允許程式碼執行。(CVE-2021-33286)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在函式 ntfs_attr_pread_i 中讀取特製的 NTFS 屬性時，可能會發生堆積型緩衝區溢位，並允許寫入任意記憶體或應用程式拒絕服務。(CVE-2021-33287)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_ie_lookup 中使用建構的 NTFS 影像，可能會造成超出邊界讀取。
    (CVE-2021-39252)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_attr_record_resize 函式中使用建構的 NTFS 影像，可能會造成 memmove 發生整數溢位，進而導致堆積型緩衝區溢位。(CVE-2021-39254)

  - NTFS-3G 2021.8.22 之前版本的 ntfs_attr_find_in_attrdef 中存在無效內容，因此使用特製的 NTFS 影像可能會觸發超出邊界讀取問題。(CVE-2021-39255)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_compressed_pwrite 函式中使用建構的 NTFS 影像，可能會造成堆積型緩衝區溢位問題。(CVE-2021-39261)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端主機受到 GLSA-202301-01 中所述的弱點影響 (NTFS-3G：多個弱點)

  - 在 NTFS-3G 2021.8.22 之前版本中，當為函式 ntfs_get_attribute_value 提供特製的 NTFS 屬性時，可能會發生堆積型緩衝區溢位，進而允許造成記憶體洩露或拒絕服務。此弱點是由於超出邊界的緩衝區存取所致，可藉由掛載特製的 ntfs 磁碟分割來觸發。根本原因則是讀取 MFT 記錄後遺漏一致性檢查：bytes_in_use 欄位應小於 bytes_allocate 欄位。否則，記錄剖析會繼續進行。(CVE-2021-33285)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在 NTFS 影像中提供特製的 unicode 字串時，可能會發生堆積型緩衝區溢位，並允許程式碼執行。(CVE-2021-33286)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在函式 ntfs_attr_pread_i 中讀取特製的 NTFS 屬性時，可能會發生堆積型緩衝區溢位，並允許寫入任意記憶體或應用程式拒絕服務。(CVE-2021-33287)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在 NTFS 影像中提供特製的 MFT 區段時，可能會發生堆積型緩衝區溢位，並允許程式碼執行。(CVE-2021-33289)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在 NTFS 影像中提供特製的 NTFS inode 路徑名稱時，可能會發生堆積型緩衝區溢位，進而導致記憶體洩漏、拒絕服務，甚至程式碼執行。(CVE-2021-35266)

  - 在 NTFS-3G 2021.8.22 之前版本中，當更正 MFT 和 MFTMirror 中的差異時，可能會發生堆疊緩衝區溢位，進而允許在執行 setuid-root 程式時執行程式碼或提升權限。(CVE-2021-35267)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在函式 ntfs_inode_real_open 中載入特製的 NTFS inode 時，可能會發生堆積緩衝區溢位，進而允許執行程式碼和提升權限。(CVE-2021-35268)

  - 在 NTFS-3G 2021.8.22 之前版本中，當在函式 ntfs_attr_setup_flag 中設定來自 MFT 的特製 NTFS 內容時，可能會發生堆積緩衝區溢位，進而允許執行程式碼和提升權限。(CVE-2021-35269)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_extent_inode_open 中使用建構的 NTFS 影像，可能會造成 NULL 指標解除參照。(CVE-2021-39251)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_ie_lookup 中使用建構的 NTFS 影像，可能會造成超出邊界讀取。
    (CVE-2021-39252)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_runlists_merge_i 中使用建構的 NTFS 影像，可能會造成超出邊界讀取。
    (CVE-2021-39253)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_attr_record_resize 函式中使用建構的 NTFS 影像，可能會造成 memmove 發生整數溢位，進而導致堆積型緩衝區溢位。(CVE-2021-39254)

  - NTFS-3G 2021.8.22 之前版本的 ntfs_attr_find_in_attrdef 中存在無效內容，因此使用特製的 NTFS 影像可能會觸發超出邊界讀取問題。(CVE-2021-39255)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_inode_lookup_by_name 函式中使用建構的 NTFS 影像，可能會造成堆積型緩衝區溢位。(CVE-2021-39256)

  - 在 NTFS-3G 2021.8.22 之前版本中使用建構的 NTFS 影像 (未配置點陣圖)，可能會造成 無限遞回函式呼叫鏈 (從 ntfs_attr_pwrite 開始)，進而導致堆積型緩衝區溢位。(CVE-2021-39257)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_attr_find() 和 ntfs_external_attr_find() 中使用建構的 NTFS 影像，可能會造成超出邊界讀取。(CVE-2021-39258)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_inode_lookup_by_name 中使用建構的 NTFS 影像，可能會造成超出邊界存取問題，這是由於未清除屬性長度所致。(CVE-2021-39259)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_inode_sync_standard_information 中使用建構的 NTFS 影像，可能會造成超出邊界存取問題。(CVE-2021-39260)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_compressed_pwrite 函式中使用建構的 NTFS 影像，可能會造成堆積型緩衝區溢位問題。(CVE-2021-39261)

  - 在 NTFS-3G 2021.8.22 之前版本的 ntfs_decompress 中使用建構的 NTFS 影像，可能會造成超出邊界讀取問題。
    (CVE-2021-39262)

  - 在 NTFS-3G 2021.8.22 之前版本中，特製的 NTFS 影像可觸發由 ntfs_get_attribute_value 中未清理的屬性所造成的堆積型緩衝區溢位弱點。(CVE-2021-39263)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，當使用 libfuse-lite 時，fuse_kern_mount 中的無效傳回碼允許攔截 NTFS-3G 與核心之間的 libfuse-lite 通訊協定流量。(CVE-2022-30783)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，攻擊者可利用特製的 NTFS 影像在 ntfs_get_attribute_value 中造成堆積耗盡。
    (CVE-2022-30784)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，當使用 libfuse-lite 時，在 fuse_lib_opendir 中建立並稍後在 fuse_lib_readdir 中使用的檔案控制碼允許攻擊者執行任意記憶體讀取和寫入作業。(CVE-2022-30785)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，攻擊者可使用建構的 NTFS 影像在 ntfs_names_full_collate 中造成堆積型緩衝區溢位問題。(CVE-2022-30786)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，當使用 libfuse-lite 時，fuse_lib_readdir 中的整數反向溢位允許攻擊者執行任意記憶體讀取作業。(CVE-2022-30787)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，攻擊者可使用建構的 NTFS 影像在 ntfs_mft_rec_alloc 中造成堆積型緩衝區溢位問題。(CVE-2022-30788)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，攻擊者可使用建構的 NTFS 影像在 ntfs_check_log_client_array 中造成堆積型緩衝區溢位問題。(CVE-2022-30789)

  - 在 2022.10.3 之前的 NTFS-3G 中發現緩衝區溢位弱點。NTFS 影像中特製的中繼資料可引致程式碼執行攻擊。如果 ntfs-3g 二進位檔為 setuid root，則本機攻擊者可利用此弱點。如果 NTFS-3G 軟體設定為在附加外部儲存裝置時執行，則實際位置靠近的攻擊者可利用此弱點。(CVE-2022-40284)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4971 advisory.

    Several vulnerabilities were discovered in NTFS-3G, a read-write NTFS driver for FUSE. A local user can     take advantage of these flaws for local root privilege escalation. For the oldstable distribution     (buster), these problems have been fixed in version 1:2017.3.23AR.3-3+deb10u1. For the stable distribution     (bullseye), these problems have been fixed in version 1:2017.3.23AR.3-4+deb11u1. We recommend that you     upgrade your ntfs-3g packages. For the detailed security status of ntfs-3g please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/ntfs-3g

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3703 advisory.

    The Advanced Virtualization module provides the user-space component for running virtual machines that use     KVM in environments managed by Red Hat products.

    Security Fix(es):

    * QEMU: usbredir: free() call on invalid pointer in bufp_alloc() (CVE-2021-3682)

    * ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of     bytes_in_use value in MFT records (CVE-2021-33285)

    * ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string (CVE-2021-33286)

    * ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes     (CVE-2021-33287)

    * ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section (CVE-2021-33289)

    * ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname (CVE-2021-35266)

    * ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections     (CVE-2021-35267)

    * ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode     (CVE-2021-35268)

    * ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute     from MFT (CVE-2021-35269)

    * ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() (CVE-2021-39251)

    * ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() (CVE-2021-39252)

    * ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() (CVE-2021-39253)

    * ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize()     (CVE-2021-39254)

    * ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute     (CVE-2021-39255)

    * ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() (CVE-2021-39256)

    * ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap (CVE-2021-39257)

    * ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() (CVE-2021-39258)

    * ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length     (CVE-2021-39259)

    * ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() (CVE-2021-39260)

    * ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() (CVE-2021-39261)

    * ntfs-3g: Out-of-bounds access in ntfs_decompress() (CVE-2021-39262)

    * ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute     (CVE-2021-39263)

    * QEMU: net: Infinite loop in loopback mode may lead to stack overflow (CVE-2021-3416)

    * libvirt: Insecure sVirt label generation (CVE-2021-3631)

    * libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * SAP/3TB VM migration slowness [idle db] (BZ#1984458)

    * Detecting TSC timer frequencies requires too many privileges (BZ#1996130)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ntfs-3g packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function     ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of     service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a     crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the     'bytes_in_use' field should be less than the 'bytes_allocated' field. When it is not, the parsing of the     records proceeds into the wild. (CVE-2021-33285)

  - In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function     ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of     service of the application. (CVE-2021-33287)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap     buffer overflow can occur and allow for code execution. (CVE-2021-33289)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image     a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code     execution. (CVE-2021-35266)

  - NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and     MFTMirror allowing for code execution or escalation of privileges when setuid-root. (CVE-2021-35267)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function     ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of     privileges. (CVE-2021-35268)

  - NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the     function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation     of privileges. (CVE-2021-35269)

  - A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G <     2021.8.22. (CVE-2021-39251)

  - A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.
    (CVE-2021-39252)

  - A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
    (CVE-2021-39253)

  - A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in     the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22. (CVE-2021-39254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1759 advisory.

  - QEMU: block: fdc: null pointer dereference may lead to guest crash (CVE-2021-20196)

  - ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of     bytes_in_use value in MFT records (CVE-2021-33285)

  - ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string (CVE-2021-33286)

  - ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes     (CVE-2021-33287)

  - ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section (CVE-2021-33289)

  - ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname (CVE-2021-35266)

  - ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections     (CVE-2021-35267)

  - ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode     (CVE-2021-35268)

  - ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute     from MFT (CVE-2021-35269)

  - hivex: stack overflow due to recursive call of _get_children() (CVE-2021-3622)

  - nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS (CVE-2021-3716)

  - QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu (CVE-2021-3748)

  - ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() (CVE-2021-39251)

  - ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() (CVE-2021-39252)

  - ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() (CVE-2021-39253)

  - ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize()     (CVE-2021-39254)

  - ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute (CVE-2021-39255)

  - ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() (CVE-2021-39256)

  - ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap (CVE-2021-39257)

  - ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() (CVE-2021-39258)

  - ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length     (CVE-2021-39259)

  - ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() (CVE-2021-39260)

  - ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() (CVE-2021-39261)

  - ntfs-3g: Out-of-bounds access in ntfs_decompress() (CVE-2021-39262)

  - ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute     (CVE-2021-39263)

  - libvirt: segmentation fault during VM shutdown can lead to vdsm hang (CVE-2021-3975)

  - QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c (CVE-2021-4145)

  - QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

  - libnbd: nbdcopy: missing error handling may create corrupted destination image (CVE-2022-0485)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1244-1 advisory.

  - An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by     running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap     buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where     /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges. (CVE-2019-9755)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function     ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of     service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a     crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the     bytes_in_use field should be less than the bytes_allocated field. When it is not, the parsing of the     records proceeds into the wild. (CVE-2021-33285)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a     heap buffer overflow can occur and allow for code execution. (CVE-2021-33286)

  - In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function     ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of     service of the application. (CVE-2021-33287)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap     buffer overflow can occur and allow for code execution. (CVE-2021-33289)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image     a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code     execution. (CVE-2021-35266)

  - NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and     MFTMirror allowing for code execution or escalation of privileges when setuid-root. (CVE-2021-35267)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function     ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of     privileges. (CVE-2021-35268)

  - NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the     function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation     of privileges. (CVE-2021-35269)

  - A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G <     2021.8.22. (CVE-2021-39251)

  - A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.
    (CVE-2021-39252)

  - A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
    (CVE-2021-39253)

  - A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in     ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22. (CVE-2021-39255)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G <     2021.8.22. (CVE-2021-39256)

  - A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain     (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22. (CVE-2021-39257)

  - A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in     NTFS-3G < 2021.8.22. (CVE-2021-39258)

  - A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in     ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22. (CVE-2021-39259)

  - A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G     < 2021.8.22. (CVE-2021-39260)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G <     2021.8.22. (CVE-2021-39261)

  - A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.
    (CVE-2021-39262)

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2819 advisory.

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function     ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of     service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a     crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the     bytes_in_use field should be less than the bytes_allocated field. When it is not, the parsing of the     records proceeds into the wild. (CVE-2021-33285)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a     heap buffer overflow can occur and allow for code execution. (CVE-2021-33286)

  - In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function     ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of     service of the application. (CVE-2021-33287)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap     buffer overflow can occur and allow for code execution. (CVE-2021-33289)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image     a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code     execution. (CVE-2021-35266)

  - NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and     MFTMirror allowing for code execution or escalation of privileges when setuid-root. (CVE-2021-35267)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function     ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of     privileges. (CVE-2021-35268)

  - NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the     function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation     of privileges. (CVE-2021-35269)

  - A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G <     2021.8.22. (CVE-2021-39251)

  - A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.
    (CVE-2021-39252)

  - A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
    (CVE-2021-39253)

  - A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in     the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22. (CVE-2021-39254)

  - A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in     ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22. (CVE-2021-39255)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G <     2021.8.22. (CVE-2021-39256)

  - A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain     (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22. (CVE-2021-39257)

  - A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in     NTFS-3G < 2021.8.22. (CVE-2021-39258)

  - A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in     ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22. (CVE-2021-39259)

  - A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G     < 2021.8.22. (CVE-2021-39260)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G <     2021.8.22. (CVE-2021-39261)

  - A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.
    (CVE-2021-39262)

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1759 advisory.

  - A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while     processing read/write ioport commands if the selected floppy drive is not initialized with a block device.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2021-20196)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function     ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of     service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a     crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the     bytes_in_use field should be less than the bytes_allocated field. When it is not, the parsing of the     records proceeds into the wild. (CVE-2021-33285)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a     heap buffer overflow can occur and allow for code execution. (CVE-2021-33286)

  - In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function     ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of     service of the application. (CVE-2021-33287)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap     buffer overflow can occur and allow for code execution. (CVE-2021-33289)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image     a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code     execution. (CVE-2021-35266)

  - NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and     MFTMirror allowing for code execution or escalation of privileges when setuid-root. (CVE-2021-35267)

  - In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function     ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of     privileges. (CVE-2021-35268)

  - NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the     function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation     of privileges. (CVE-2021-35269)

  - A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows     Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to     a stack overflow. The highest threat from this vulnerability is to system availability. (CVE-2021-3622)

  - A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption     boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before     proxying everything else a client sends to the server, potentially leading the client to terminate the NBD     session. The highest threat from this vulnerability is to system availability. (CVE-2021-3716)

  - A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the     descriptor's address belongs to the non direct access region, due to num_buffers being set after the     virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a     denial of service condition, or potentially execute code on the host with the privileges of the QEMU     process. (CVE-2021-3748)

  - A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G <     2021.8.22. (CVE-2021-39251)

  - A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.
    (CVE-2021-39252)

  - A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
    (CVE-2021-39253)

  - A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in     the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22. (CVE-2021-39254)

  - A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in     ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22. (CVE-2021-39255)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G <     2021.8.22. (CVE-2021-39256)

  - A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain     (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22. (CVE-2021-39257)

  - A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in     NTFS-3G < 2021.8.22. (CVE-2021-39258)

  - A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in     ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22. (CVE-2021-39259)

  - A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G     < 2021.8.22. (CVE-2021-39260)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G <     2021.8.22. (CVE-2021-39261)

  - A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.
    (CVE-2021-39262)

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in     qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a     monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is     shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial     of service attack by causing the libvirt daemon to crash. (CVE-2021-3975)

  - A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0.
    The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A     malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host     when writing data reaches the threshold of mirroring node. (CVE-2021-4145)

  - A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within     the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition. (CVE-2021-4158)

  - A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using     asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as     successful, rather than checking the *error parameter. This could result in the silent creation of a     corrupted destination image. (CVE-2022-0485)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.100173 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

  - A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange     differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. (CVE-2023-5981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 AHV 低於 20230302.102005 版。因此，它受到 NXSA-AHV-20230302.101026 公告中所提及的多個弱點影響。

  - 在 NTFS-3G 2021.8.22 之前版本中，特製的 NTFS 影像可觸發由 ntfs_get_attribute_value 中未清理的屬性所造成的堆積型緩衝區溢位弱點。(CVE-2021-39263)

  - EDK2 的 Network Package 在處理 DHCPv6 Advertise 訊息的 DNS Servers 選項時，容易受到緩衝區溢位弱點影響。攻擊者可利用此弱點來取得未經授權的存取權，並可能造成機密性、完整性和/或可用性喪失。
    (CVE-2023-45234)

  - 遠端攻擊者可利用 DNS 通訊協定 (在 RFC 4033、4034、4035、6840 和相關 RFC 中) 的特定 DNSSEC 方面，透過一或多個 DNSSEC 回應造成拒絕服務 (CPU 消耗)，即 KeyTrap 問題。其中一個問題是，當某個區域具有多個 DNSKEY 和 RRSIG 記錄時，通訊協定規格即表示演算法必須評估 DNSKEY 和 RRSIG 記錄的所有組合。(CVE-2023-50387)

  - 遠端攻擊者可利用 DNS 通訊協定 (略過 RFC 9276 指南時為 RFC 5155) 的最近封裝證明部分，透過隨機子網域攻擊中的 DNSSEC 回應造成拒絕服務 (SHA-1 計算的 CPU 消耗)，即 NSEC3 問題。RFC 5155 規格即表示，演算法必須在某些情況下執行雜湊函式的數千次反覆運算。(CVE-2023-50868)

  - 在 606 版之前的 less 中，filename.c 的 close_altfile 省略了對 LESSCLOSE 的 shell_quote 呼叫。(CVE-2022-48624)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 10/11 主機上安裝的多個套件受 dsa-4971 公告中提及的多個弱點影響。

    在 NTFS-3G (FUSE 的讀寫 NTFS 驅動程式) 中發現數個弱點。本機使用者可利用這些缺陷執行本機 root 特權提升。針對 oldstable 發行版本 (buster)，已在 1:2017.3.23AR.3-3+deb10u1 版本中修正這些問題。針對穩定的發行版本 (bullseye)，已在 1:2017.3.23AR.3-4+deb11u1 版本中修正這些問題。建議您升級 ntfs-3g 套件。如需有關 ntfs-3g 安全性狀態的詳細資訊，請參閱其安全追蹤頁面：https://security-tracker.debian.org/tracker/ntfs-3g

Tenable 已直接從 Debian 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2021：3703 公告中提及的多個弱點影響。

  - ntfs-3g: 因不正確檢查 MFT 記錄中的 bytes_in_use 值，而導致 ntfs_get_attribute_value() 中出現超出邊界堆積緩衝區存取問題 (CVE-2021-33285)

  - ntfs-3g: 透過特製 Unicode 字串觸發的堆積緩衝區溢位 (CVE-2021-33286)

  - ntfs-3g: 透過特製 NTFS 屬性在 ntfs_attr_pread_i() 中觸發的堆積緩衝區溢位 (CVE-2021-33287)

  - ntfs-3g: 透過特製 MFT 區段觸發的堆積緩衝區溢位 (CVE-2021-33289)

  - QEMU：net：回送模式下的無限迴圈可能導致堆疊溢位 (CVE-2021-3416)

  - ntfs-3g: 透過特製 NTFS inode 路徑名稱觸發的堆積緩衝區溢位 (CVE-2021-35266)

  - ntfs-3g: 更正 MFT 和 MFTMirror 區段之間的差異時觸發的堆疊緩衝區溢位 (CVE-2021-35267)

  - ntfs-3g: 透過特製 NTFS inode 在 ntfs_inode_real_open() 中觸發的堆積緩衝區溢位 (CVE-2021-35268)

  - ntfs-3g: 透過來自 MFT 的特製 NTFS 屬性在 ntfs_attr_setup_flag() 中觸發的堆積緩衝區溢位 (CVE-2021-35269)

  - libvirt：產生不安全的 sVirt 標籤 (CVE-2021-3631)

  - libvirt：在 virStoragePoolLookupByTargetPath API 中不當鎖定 ACL 時失敗 (CVE-2021-3667)

  - QEMU：usbredir: 對 bufp_alloc() 中的無效指標發出 free() 呼叫 (CVE-2021-3682)

  - ntfs-3g: ntfs_extent_inode_open() 中的 NULL 指標解除參照 (CVE-2021-39251)

  - ntfs-3g: ntfs_ie_lookup() 中的超出邊界讀取 (CVE-2021-39252)

  - ntfs-3g: ntfs_runlists_merge_i() 中的超出邊界讀取 (CVE-2021-39253)

  - ntfs-3g: memmove() 中的整數溢位導致 ntfs_attr_record_resize() 中出現堆積緩衝區溢位 (CVE-2021-39254)

  - ntfs-3g: 無效屬性觸發的超出邊界讀取 ntfs_attr_find_in_attrdef() (CVE-2021-39255)

  - ntfs-3g: ntfs_inode_lookup_by_name() 中的堆積緩衝區溢位 (CVE-2021-39256)

  - ntfs-3g: 透過未配置點陣圖觸發的 ntfs_attr_pwrite() 無限遞回 (CVE-2021-39257)

  - ntfs-3g: ntfs_attr_find() 和 ntfs_external_attr_find() 中的超出邊界讀取 (CVE-2021-39258)

  - ntfs-3g: 未清除的屬性長度造成 ntfs_inode_lookup_by_name() 中發生超出邊界存取 (CVE-2021-39259)

  - ntfs-3g: ntfs_inode_sync_standard_information() 中的超出邊界存取 (CVE-2021-39260)

  - ntfs-3g: ntfs_compressed_pwrite() 中的堆積緩衝區溢位 (CVE-2021-39261)

  - ntfs-3g: ntfs_decompress() 中的超出邊界存取 (CVE-2021-39262)

  - ntfs-3g: 未清除的屬性造成 ntfs_get_attribute_value() 中出現堆積緩衝區溢位 (CVE-2021-39263)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 8 主機上安裝的多個套件受到 CESA-2022: 1759 公告中提及的多個弱點影響。

  - QEMU：block：fdc：NULL 指標解除參照可能造成來賓機損毀 (CVE-2021-20196)

  - ntfs-3g：因不正確檢查 MFT 記錄中的 bytes_in_use 值，而導致 ntfs_get_attribute_value() 中出現超出邊界堆積緩衝區存取問題 (CVE-2021-33285)

  - ntfs-3g：透過特製 Unicode 字串觸發的堆積緩衝區溢位 (CVE-2021-33286)

  - ntfs-3g：透過特製 NTFS 屬性在 ntfs_attr_pread_i() 中觸發的堆積緩衝區溢位 (CVE-2021-33287)

  - ntfs-3g：透過特製 MFT 區段觸發的堆積緩衝區溢位 (CVE-2021-33289)

  - ntfs-3g：透過特製 NTFS inode 路徑名稱觸發的堆積緩衝區溢位 (CVE-2021-35266)

  - ntfs-3g：更正 MFT 和 MFTMirror 區段之間的差異時觸發的堆疊緩衝區溢位 (CVE-2021-35267)

  - ntfs-3g：透過特製 NTFS inode 在 ntfs_inode_real_open() 中觸發的堆積緩衝區溢位 (CVE-2021-35268)

  - ntfs-3g：透過來自 MFT 的特製 NTFS 屬性在 ntfs_attr_setup_flag() 中觸發的堆積緩衝區溢位 (CVE-2021-35269)

  - hivex：_get_children() 的遞回呼叫導致堆疊溢位 (CVE-2021-3622)

  - nbdkit：STARTTLS 上的 NBD_OPT_STRUCTURED_REPLY 插入弱點 (CVE-2021-3716)

  - QEMU：virtio-net：virtio_net_receive_rcu 中的堆積釋放後使用 (CVE-2021-3748)

  - ntfs-3g：ntfs_extent_inode_open() 中的 NULL 指標解除參照 (CVE-2021-39251)

  - ntfs-3g：ntfs_ie_lookup() 中的超出邊界讀取 (CVE-2021-39252)

  - ntfs-3g：ntfs_runlists_merge_i() 中的超出邊界讀取 (CVE-2021-39253)

  - ntfs-3g：memmove() 中的整數溢位導致 ntfs_attr_record_resize() 中出現堆積緩衝區溢位 (CVE-2021-39254)

  - ntfs-3g：無效屬性觸發的超出邊界讀取 ntfs_attr_find_in_attrdef() (CVE-2021-39255)

  - ntfs-3g：ntfs_inode_lookup_by_name() 中的堆積緩衝區溢位 (CVE-2021-39256)

  - ntfs-3g：透過未配置點陣圖觸發的 ntfs_attr_pwrite() 無限遞回 (CVE-2021-39257)

  - ntfs-3g：ntfs_attr_find() 和 ntfs_external_attr_find() 中的超出邊界讀取 (CVE-2021-39258)

  - ntfs-3g：未清除的屬性長度造成 ntfs_inode_lookup_by_name() 中發生超出邊界存取 (CVE-2021-39259)

  - ntfs-3g：ntfs_inode_sync_standard_information() 中的超出邊界存取 (CVE-2021-39260)

  - ntfs-3g：ntfs_compressed_pwrite() 中的堆積緩衝區溢位 (CVE-2021-39261)

  - ntfs-3g：ntfs_decompress() 中的超出邊界存取 (CVE-2021-39262)

  - ntfs-3g：未清除的屬性造成 ntfs_get_attribute_value() 中出現堆積緩衝區溢位 (CVE-2021-39263)

  - libvirt：VM 關機期間的分割錯誤可導致 vdsm 懸置 (CVE-2021-3975)

  - QEMU：block/mirror.c 的 mirror_wait_on_conflicts() 中發生 NULL 指標解除參照 (CVE-2021-4145)

  - QEMU：hw/acpi/pcihp.c 的 pci_write() 中發生 NULL 指標解除參照 (CVE-2021-4158)

  - libnbd：nbdcopy：遺漏處理錯誤可能會導致建立損毀的目標影像 (CVE-2022-0485)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161302	Oracle Linux 8：virt：ol / 和 / virt-devel: ol (ELSA-2022-1759)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/11/1	high
169841	GLSA-202301-01：NTFS-3G：多個弱點	Nessus	Gentoo Local Security Checks	2023/1/11	2023/9/8	high
153182	Debian DSA-4971-1 : ntfs-3g - security update	Nessus	Debian Local Security Checks	2021/9/9	2025/1/24	high
153803	RHEL 8 : virt:av and virt-devel:av (RHSA-2021:3703)	Nessus	Red Hat Local Security Checks	2021/10/1	2024/11/7	high
156304	EulerOS 2.0 SP8 : ntfs-3g (EulerOS-SA-2021-2807)	Nessus	Huawei Local Security Checks	2021/12/25	2023/4/17	high
160913	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2022:1759)	Nessus	CentOS Local Security Checks	2022/5/10	2023/4/17	high
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium
153195	openSUSE 15 Security Update : ntfs-3g_ntfsprogs (openSUSE-SU-2021:1244-1)	Nessus	SuSE Local Security Checks	2021/9/10	2023/4/17	high
155439	Debian DLA-2819-1 : ntfs-3g - LTS security update	Nessus	Debian Local Security Checks	2021/11/17	2023/4/17	high
184718	Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2022:1759)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/7	high
206823	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.100173)	Nessus	Misc.	2024/9/9	2025/2/17	low
206824	Nutanix AHV：多個弱點 (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium
153182	Debian DSA-4971-1：ntfs-3g - 安全性更新	Nessus	Debian Local Security Checks	2021/9/9	2025/1/24	high
153803	RHEL 8：virt：av 和 virt-devel：av (RHSA-2021：3703)	Nessus	Red Hat Local Security Checks	2021/10/1	2024/11/7	high
160913	CentOS 8：virt：rhel 和 virt-devel：rhel (CESA-2022: 1759)	Nessus	CentOS Local Security Checks	2022/5/10	2023/4/17	high

检测

插件搜索

high

high

high

high

high

high

medium

high

high

high

low

medium

high

high

high