Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - mm/page_owner使用 strscpy() 而非 strlcpy() current->comm[] 不是字串 (不保證其中一定有零位元組)。 strlcpy(s1, s2, l) 正在呼叫 strlen(s2)其可能造成越界存取如 syzbot 報告的那樣在 __fortify_strlen 中偵測到緩衝區溢位 ------------[在此處截取] ------------ lib/string_helpers.c:980! 的核心錯誤無效 opcode0000 [#1] PREEMPT SMP KASAN CPU0 PID4087 Comm
    dhcpcd-run-hooks 未受污染的 5.18.0-rc3-syzkaller-01537-g20b87e7c29df #0 硬體名稱Google Google Compute Engine/Google Compute Engine、BIOS Google 01/01/2011 RIP0010:fortify_panic+0x18/0x1a lib/ string_helpers.c:980 代碼8c e8 c5 ba e1 fa e9 23 0f bf fa e8 0b 5d 8c f8 eb db 55 48 89 fd e8 e0 49 40 f8 48 89 ee 48 c7 c7 80 f5 26 8a e8 99 09 f1 ff <0f> 0b e8 ca 49 40 f8 48 8b 54 24 18 4c 89 f1 48 c7 c7 00 00 27 8a RSP0018:ffffc900000074a8 EFLAGS00010286 RAX000000000000002c RBXffff88888012266
    0000000000000000 RDX: ffff8880198e0000 RSI: ffffffff81600458 RDI: fffff52000000e87 RBP: ffffffff89da2aa0 R08: 000000000000002c R09: 0000000000000000 R10: ffffffff815fae2e R11: 0000000000000000 R12:
    ffff88801226b700 R13ffff8880198e0830 R140000000000000000 R150000000000000000 FS
    0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0
    0000000080050033 CR2: 00007f5876ad6ff8 CR3: 000000001a48c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000600 呼叫追踪 <IRQ> __fortify_strlen include/linux/fortify-string.h:128 [內嵌] strlcpy include/linux/fortify-string.h:143 [內嵌] __set_page_owner_handle+0x2b1/0x3e0 mm/page_owner.c:171
    __set_page_owner+0x3e/0x50 mm/page_owner.c:190 prep_new_page mm/page_alloc.c:2441 [內嵌] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 alloc_pages+0x1aa /0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1799 [內嵌] allocate_slab+0x26c/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [內嵌] ___slab_alloc+0x8df/0xf20 mm/ slub.c:3005 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092 slab_alloc_node mm/slub.c:3183 [內嵌] slab_alloc mm/slub.c:3225 [內嵌] __kmem_cache_alloc_lru mm/slub.c 3232 [內嵌] kmem_cache_alloc+0x360/0x3b0 mm/slub.c:3242 dst_alloc+0x146/0x1f0 net/core/dst.c:92 (CVE-2022-49401)

請注意，Nessus 依賴供應商報告的套件存在。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/page_owner: use strscpy() instead of strlcpy() current->comm[] is not a string (no guarantee for a zero     byte in it). strlcpy(s1, s2, l) is calling strlen(s2), potentially causing out-of-bound access, as     reported by syzbot: detected buffer overflow in __fortify_strlen ------------[ cut here ]------------     kernel BUG at lib/string_helpers.c:980! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 4087 Comm:
    dhcpcd-run-hooks Not tainted 5.18.0-rc3-syzkaller-01537-g20b87e7c29df #0 Hardware name: Google Google     Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:fortify_panic+0x18/0x1a     lib/string_helpers.c:980 Code: 8c e8 c5 ba e1 fa e9 23 0f bf fa e8 0b 5d 8c f8 eb db 55 48 89 fd e8 e0 49     40 f8 48 89 ee 48 c7 c7 80 f5 26 8a e8 99 09 f1 ff <0f> 0b e8 ca 49 40 f8 48 8b 54 24 18 4c 89 f1 48 c7 c7     00 00 27 8a RSP: 0018:ffffc900000074a8 EFLAGS: 00010286 RAX: 000000000000002c RBX: ffff88801226b728 RCX:
    0000000000000000 RDX: ffff8880198e0000 RSI: ffffffff81600458 RDI: fffff52000000e87 RBP: ffffffff89da2aa0     R08: 000000000000002c R09: 0000000000000000 R10: ffffffff815fae2e R11: 0000000000000000 R12:
    ffff88801226b700 R13: ffff8880198e0830 R14: 0000000000000000 R15: 0000000000000000 FS:
    0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 00007f5876ad6ff8 CR3: 000000001a48c000 CR4: 00000000003506f0 DR0: 0000000000000000     DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000600 Call Trace: <IRQ> __fortify_strlen include/linux/fortify-string.h:128 [inline] strlcpy     include/linux/fortify-string.h:143 [inline] __set_page_owner_handle+0x2b1/0x3e0 mm/page_owner.c:171
    __set_page_owner+0x3e/0x50 mm/page_owner.c:190 prep_new_page mm/page_alloc.c:2441 [inline]     get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408     alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1799 [inline]     allocate_slab+0x26c/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [inline] ___slab_alloc+0x8df/0xf20     mm/slub.c:3005 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092 slab_alloc_node mm/slub.c:3183 [inline]     slab_alloc mm/slub.c:3225 [inline] __kmem_cache_alloc_lru mm/slub.c:3232 [inline]     kmem_cache_alloc+0x360/0x3b0 mm/slub.c:3242 dst_alloc+0x146/0x1f0 net/core/dst.c:92 (CVE-2022-49401)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - mm/page_ownerstrlcpy() の代わりに strscpy() を使用します current->comm[] は文字列ではありません内部のゼロバイトの保証なしstrlcpy(s1, s2, l) は strlen(s2) を呼び出しており、syzbot によって報告されているように、領域外アクセスを引き起こす可能性があります __fortify_strlen でバッファオーバーフローを検出しました ------------[ カットここで ] ------------ lib/string_helpers.c:980! でカーネルのバグ無効な opcode: 0000 [#1] PREEMPT SMP KASAN CPU:0 PID:4087 Comm:
    dhcpcd-run-hooks 汚染されていない 5.18.0-rc3-syzkaller-01537-g20b87e7c29df #0 ハードウェア名Google Google Compute Engine/Google Compute Engine、BIOS Google 01/01/2011 RIP0010:fortify_panic+0x18/0x1a lib/ string_helpers.c:980 コード8c e8 c5 ba e1 fa e9 23 0f bf fa e8 0b 5d 8c f8 eb db 55 48 89 fd e8 e0 49 40 f8 48 89 ee 48 c7 c7 80 f5 26 8a e8 99 09 f1 ff <0f> 0b e8 ca 49 40 f8 48 8b 54 24 18 4c 89 f1 48 c7 c7 00 00 27 8a RSP 0018 :ffffc900000074a8 EFLAGS : 00010286 RAX : 00000000000002c RBX
    0000000000000000 RDX: ffff8880198e0000 RSI: ffffffff81600458 RDI: fffff52000000e87 RBP: ffffffff89da2aa0 R08: 000000000000002c R09: 0000000000000000 R10: ffffffff815fae2e R11: 0000000000000000 R12:
    ffff88801226b700 R13ffff8880198e0830 R14R15: 00000000000000000000000000000000000000000000000000000000000000000000000000000
    000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS:0010 DS:0000 ES:0000 CR0:
    0000000080050033 CR2: 00007f5876ad6ff8 CR3: 000000001a48c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    000000000000600 Call Trace: <IRQ> __fortify_strlen include/linux/fortify-string.h:128 [inline] strlcpy include/linux/fortify-string.h:143 [inline] __set_page_owner_handle+0x2b1/0x3e0 mm/page_owner.c:171
    __set_page_owner+0x3e/0x50 mm/page_owner.c:190 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 alloc_pages+0x1aa /0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1799 [インライン] allocate_slab+0x26c/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [インライン] __slab_alloc+0x8df/0xf20 mm/ slub.c:3005 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092 slab_alloc_node mm/slub.c:3183 [inline] slab_alloc mm/slub.c:3225 [inline] __kmem_cache_alloc_lru mm/slub.c:3092 3232 [インライン] kmem_cache_alloc+0x360/0x3b0 mm/slub.c:3242 dst_alloc+0x146/0x1f0 net/core/dst.c:92CVE-2022-49401

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - mm/page_owner使用 strscpy() 而非 strlcpy() current->comm[] 不是字符串不保证其中包含零字节。 strlcpy(s1, s2, l) 正在调用 strlen(s2)可能会造成越界访问syzbot 报告在 __fortify_strlen 中检测到缓冲区溢出 ------------[ cut here ] ------------ lib/string_helpers.c:980! 的内核缺陷无效的 opcode0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 4087 Comm
    dhcpcd-run-hooks 未受感染 5.18.0-rc3-syzkaller-01537-g20b87e7c29df #0 硬件名称Google Google Compute Engine/Google Compute Engine、BIOS Google 01/01/2011 RIP0010:fortify_panic+0x18/0x1a lib/ string_helpers.c:980 代码8c e8 c5 ba e1 fa e9 23 0f bf fa e8 0b 5d 8c f8 eb db 55 48 89 fd e8 e0 49 40 f8 48 89 ee 48 c7 c7 80 f5 26 8a e8 99 09 f1 ff <0f> 0b e8 ca 49 40 f8 48 8b 54 24 18 4c 89 f1 48 c7 c7 00 00 27 8a RSP0018:ffffc900000074a8 EFLAGS: 00010286 RAX: 000000000000002c RBX: ff2261b780
    0000000000000000 RDX: ffff8880198e0000 RSI: ffffffff81600458 RDI: fffff52000000e87 RBP: ffffffff89da2aa0 R08: 000000000000002c R09: 0000000000000000 R10: ffffffff815fae2e R11: 0000000000000000 R12:
    ffff88801226b700 R13ffff8880198e0830 R140000000000000000 R150000000000000000 FS
    0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 00007f5876ad6ff8 CR3: 000000001a48c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000600 调用跟踪 <IRQ> __fortify_strlen include/linux/fortify-string.h:128 [inline] strlcpy include/linux/fortify-string.h:143 [inline] __set_page_owner_handle+0x2b1/0x3e0 mm/page_owner.c:171
    __set_page_owner+0x3e/0x50 mm/page_owner.c:190 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 alloc_pages+0x1aa /0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1799 [内联] allocate_slab+0x26c/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [内联] ___slab_alloc+0x8df/0xf20 mm/ slub.c:3005 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092 slab_alloc_node mm/slub.c:3183 [内联] slab_alloc mm/slub.c:3225 [内联] __kmem_cache_alloc_lru mm/slub.c 3232 [inline] kmem_cache_alloc+0x360/0x3b0 mm/slub.c:3242 dst_alloc+0x146/0x1f0 net/core/dst.c:92 (CVE-2022-49401)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
225261	Linux Distros 未修補的弱點：CVE-2022-49401	Nessus	Misc.	2025/3/5	2025/9/1	high
225261	Linux Distros Unpatched Vulnerability : CVE-2022-49401	Nessus	Misc.	2025/3/5	2025/9/1	high
225261	Linux Distros のパッチ未適用の脆弱性: CVE-2022-49401	Nessus	Misc.	2025/3/5	2025/9/1	high
225261	Linux Distros 未修补的漏洞：CVE-2022-49401	Nessus	Misc.	2025/3/5	2025/9/1	high

检测

插件搜索

high

high

high

high