According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP     address. To prevent this,cloud-init default configurations disable platform enumeration.(CVE-2024-6174)

Tenable has extracted the preceding description block directly from the EulerOS cloud-init security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2025-10645:08 advisory.

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance     initialization by Canonical.
     There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability     originates from cloud-init-hotplugd.socket#39;s default SocketMode permission is 0666, which may cause     unauthorized users to trigger commands.(CVE-2024-11584)

    cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance     initialization by Canonical.
     There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded     URLs during detection by non-x86 platforms.(CVE-2024-6174)

Tenable has extracted the preceding description block directly from the EulerOS cloud-init security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP     address. To prevent this,cloud-init default configurations disable platform enumeration.(CVE-2024-6174)

    cloud-initthrough 25.1.2 includes the systemd socket unitcloud-init-hotplugd.socket with     defaultSocketModethat grants 0666 permissions, making it world-writable.This is used for the     '/run/cloud-init/hook-hotplug-cmd' FIFO. An unprivileged user could triggerhotplug-hook     commands.(CVE-2024-11584)

Tenable has extracted the preceding description block directly from the EulerOS cloud-init security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace(CVE-2022-49932)

    drivers:md:fix a potential use-after-free bug(CVE-2022-50022)

    ceph: don't leak snap_rwsem in handle_cap_grant(CVE-2022-50059)

    posix-cpu-timers: Cleanup CPU timers before freeing them during exec(CVE-2022-50095)

    scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts(CVE-2022-50098)

    sched/core: Do not requeue task on CPU excluded from cpus_mask(CVE-2022-50100)

    sched, cpuset: Fix dl_cpu_busy() panic due to empty cs-cpus_allowed(CVE-2022-50103)

    An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2. There is a sleeping function     called from an invalid context in gsmld_write, which will block the kernel. Note: This has been disputed     by 3rd parties as not a valid vulnerability.(CVE-2023-31082)

    scsi: qla2xxx: Perform lockless command completion in abort path(CVE-2023-53041)

    drm/nouveau: prime: fix ttm_bo_delayed_delete oops(CVE-2025-37765)

    dmaengine: idxd: fix memory leak in error handling path of idxd_alloc(CVE-2025-38015)

    padata: do not leak refcount in reorder_work(CVE-2025-38031)

    nvmet-tcp: don't restore null sk_state_change(CVE-2025-38035)

    rseq: Fix segfault on registration when rseq_cs is non-zero(CVE-2025-38067)

    libnvdimm/labels: Fix divide error in nd_label_data_init()(CVE-2025-38072)

    HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()(CVE-2025-38103)

    net: openvswitch: Fix the dead loop of MPLS parse(CVE-2025-38146)

    calipso: Don't call calipso functions for AF_INET sk.(CVE-2025-38147)

    tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer(CVE-2025-38184)

    net: clear the dst when changing skb protocol(CVE-2025-38192)

    ipc: fix to protect IPCS lookups using RCU(CVE-2025-38212)

    fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var(CVE-2025-38215)

    sched/rt: Fix race in push_rt_task(CVE-2025-38234)

    nvme-tcp: sanitize request list handling(CVE-2025-38264)

    net: tipc: fix refcount warning in tipc_aead_encrypt(CVE-2025-38273)

    fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()(CVE-2025-38312)

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()(CVE-2025-38320)

    virtio-net: ensure the received length does not exceed allocated size(CVE-2025-38375)

    NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN(CVE-2025-38393)

    perf: Fix sample vs do_exit()(CVE-2025-38424)

    net/sched: Abort __tc_modify_qdisc if parent class does not exist(CVE-2025-38457)

    tipc: Fix use-after-free in tipc_conn_close().(CVE-2025-38464)

    netlink: Fix wraparounds of sk-sk_rmem_alloc.(CVE-2025-38465)

    perf: Revert to requiring CAP_SYS_ADMIN for uprobes(CVE-2025-38466)

    do_change_type(): refuse to operate on unmounted/not ours mounts(CVE-2025-38498)

    tracing: Add down_write(trace_event_sem) when adding trace event(CVE-2025-38539)

    perf/core: Prevent VMA split of buffer mappings(CVE-2025-38563)

    perf/core: Exit early on perf_mmap() fail(CVE-2025-38565)

    pptp: ensure minimal skb length in pptp_xmit()(CVE-2025-38574)

    pinmux: fix race causing mux_owner NULL with active mux_usecount(CVE-2025-38632)

    i2c: qup: jump out of the loop in case of timeout(CVE-2025-38671)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-RU-2026:20192-1 advisory.

    Changes in cloud-init:

    - Fix dependency replace -serial with -pyserial

    - Drop unneeded test dependency on httpretty, fixed long ago
      * https://github.com/canonical/cloud-init/pull/1720

    - Update to version 25.1.3 (bsc#1245401 , CVE-2024-6174, bsc#1245403, CVE-2024-11584)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-openSUSE-RU-2026:20129-1 advisory.

    Changes in cloud-init:

    - Fix dependency replace -serial with -pyserial

    - Drop unneeded test dependency on httpretty, fixed long ago
      * https://github.com/canonical/cloud-init/pull/1720

    - Update to version 25.1.3 (bsc#1245401 , CVE-2024-6174, bsc#1245403, CVE-2024-11584)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2025:11324 advisory.

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10879 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11324 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b93ee7b368 advisory.

    Backport fixes for CVE-2024-6174 and CVE-2024-11584

    - cloud-init included the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that     grants 0666 permissions, making it world-writable. An unprivelege user could trigger hotplug-hook commands     (CVE-2024-11584)

    - When a non-x86 platform is detected, cloud-init granted root access to a hardcoded url with a local IP     address. To prevent this, cloud-init default configurations disable platform enumeration (CVE-2024-6174)

    Note that the fix for CVE-2024-6174 includes a change that may break non-x86 OpenStack Nova users.
    Affected users may wish to use ConfigDrive as a workaround


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
274965	EulerOS 2.0 SP10 : cloud-init (EulerOS-SA-2025-2408)	Nessus	Huawei Local Security Checks	2025/11/12	2025/11/12	high
283118	MiracleLinux 9 : cloud-init-24.4-4.el9_6.3.ML.1 (AXSA:2025-10645:08)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	high
271326	EulerOS 2.0 SP13 : cloud-init (EulerOS-SA-2025-2284)	Nessus	Huawei Local Security Checks	2025/10/24	2025/10/24	medium
274960	EulerOS 2.0 SP12 : cloud-init (EulerOS-SA-2025-2348)	Nessus	Huawei Local Security Checks	2025/11/12	2025/11/12	medium
276490	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2025-2436)	Nessus	Huawei Local Security Checks	2025/11/22	2025/11/22	high
297842	SUSE SLES16 : Recommended update for cloud-init (SUSE-SU-SUSE-RU-2026:20192-1)	Nessus	SuSE Local Security Checks	2026/2/4	2026/2/4	medium
297845	openSUSE 16 : Recommended update for cloud-init (SUSE-SU-openSUSE-RU-2026:20129-1)	Nessus	SuSE Local Security Checks	2026/2/4	2026/2/4	medium
316360	RockyLinux 8 : cloud-init (RLSA-2025:11324)	Nessus	Rocky Linux Local Security Checks	2026/5/22	2026/5/22	high
242069	RHEL 9 : cloud-init (RHSA-2025:10879)	Nessus	Red Hat Local Security Checks	2025/7/14	2025/7/14	high
242203	RHEL 8 : cloud-init (RHSA-2025:11324)	Nessus	Red Hat Local Security Checks	2025/7/16	2025/7/16	high
243013	Fedora 42 : cloud-init (2025-b93ee7b368)	Nessus	Fedora Local Security Checks	2025/7/30	2025/7/30	high

检测

插件搜索

high

high

medium

medium

high

medium

medium

high

high

high

high