The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security     issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that     FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space.
    Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in     order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected     PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c     (mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte), we can use UFFDIO_CONTINUE to map     a shmem page R/O while marking the pte dirty. This can be used by unprivileged user space to modify     tmpfs/shmem file content even if the user does not have write permissions to the file, and to bypass memfd     write sealing -- Dirty COW restricted to tmpfs/shmem (CVE-2022-2590). To fix such security issues for     good, the insight is that we really only need that fancy retry logic (FOLL_COW) for COW mappings that are     not writable (!VM_WRITE). And in a COW mapping, we really only broke COW if we have an exclusive anonymous     page mapped. If we have something else mapped, or the mapped anonymous page might be shared     (!PageAnonExclusive), we have to trigger a write fault to break COW. If we don't find an exclusive     anonymous page when we retry, we have to trigger COW breaking once again because something intervened.
    Let's move away from this mandatory-retry + dirty handling and rely on our PageAnonExclusive() flag for     making a similar decision, to use the same COW logic as in other kernel parts here as well. In case we     stumble over a PTE in a COW mapping that does not map an exclusive anonymous page, COW was not properly     broken and we have to trigger a fake write-fault to break COW. Just like we do in     can_change_pte_writable() added via commit 64fe24a3e05e (mm/mprotect: try avoiding write faults for     exclusive anonymous pages when changing protection) and commit 76aefad628aa (mm/mprotect: fix soft-dirty     check in can_change_pte_writable()), take care of softdirty and uffd-wp manually. For example, a write()     via /proc/self/mem to a uffd-wp-protected range has to fail instead of silently granting write access and     bypassing the userspace fault handler. Note that FOLL_FORCE is not only used for debug access, but also     triggered by applications without debug intentions, for example, when pinning pages via RDMA. This fixes     CVE-2022-2590. Note that only x86_64 and aarch64 are affected, because only those support     CONFIG_HAVE_ARCH_USERFAULTFD_MINOR. Fortunately, FOLL_COW is no longer required to handle FOLL_FORCE. So     let's just get rid of it. Thanks to Nadav Amit for pointing out that the pte_dirty() check in FOLL_FORCE     code is problematic and might be exploitable. Note 1: We don't check for the PTE being dirty because it     doesn't matter for making a was COWed decision anymore, and whoever modifies the page has to set the     page dirty either way. Note 2: Kernels before extended uffd-wp support and before PageAnonExclusive (<     5.19) can simply revert the problematic commit instead and be safe regarding UFFDIO_CONTINUE. A backport     to v5.19 requires minor adjustments due to lack of vma_soft_dirty_enabled(). (CVE-2022-50014)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space.
    Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c (mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unprivileged user space to modify tmpfs/shmem file content even if the user does not have write permissions to the file, and to bypass memfd write sealing -- Dirty COW restricted to tmpfs/shmem (CVE-2022-2590). To fix such security issues for good, the insight is that we really only need that fancy retry logic (FOLL_COW) for COW mappings that are not writable (!VM_WRITE). And in a COW mapping, we really only broke COW if we have an exclusive anonymous page mapped. If we have something else mapped, or the mapped anonymous page might be shared (!PageAnonExclusive), we have to trigger a write fault to break COW. If we don't find an exclusive anonymous page when we retry, we have to trigger COW breaking once again because something intervened.
    Let's move away from this mandatory-retry + dirty handling and rely on our PageAnonExclusive() flag for making a similar decision, to use the same COW logic as in other kernel parts here as well. In case we stumble over a PTE in a COW mapping that does not map an exclusive anonymous page, COW was not properly broken and we have to trigger a fake write-fault to break COW. Just like we do in can_change_pte_writable() added via commit 64fe24a3e05e (mm/mprotect: try avoiding write faults for exclusive anonymous pages when changing protection) and commit 76aefad628aa (mm/mprotect: fix soft-dirty check in can_change_pte_writable()), take care of softdirty and uffd-wp manually. For example, a write() via /proc/self/mem to a uffd-wp-protected range has to fail instead of silently granting write access and bypassing the userspace fault handler. Note that FOLL_FORCE is not only used for debug access, but also triggered by applications without debug intentions, for example, when pinning pages via RDMA. This fixes CVE-2022-2590. Note that only x86_64 and aarch64 are affected, because only those support CONFIG_HAVE_ARCH_USERFAULTFD_MINOR. Fortunately, FOLL_COW is no longer required to handle FOLL_FORCE. So let's just get rid of it. Thanks to Nadav Amit for pointing out that the pte_dirty() check in FOLL_FORCE code is problematic and might be exploitable. Note 1: We don't check for the PTE being dirty because it doesn't matter for making a was COWed decision anymore, and whoever modifies the page has to set the page dirty either way. Note 2: Kernels before extended uffd-wp support and before PageAnonExclusive (< 5.19) can simply revert the problematic commit instead and be safe regarding UFFDIO_CONTINUE. A backport to v5.19 requires minor adjustments due to lack of vma_soft_dirty_enabled(). (CVE-2022-50014)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 已修复 Linux 内核中的下列漏洞：mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space.
    Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c (mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unprivileged user space to modify tmpfs/shmem file content even if the user does not have write permissions to the file, and to bypass memfd write sealing -- Dirty COW restricted to tmpfs/shmem (CVE-2022-2590). To fix such security issues for good, the insight is that we really only need that fancy retry logic (FOLL_COW) for COW mappings that are not writable (!VM_WRITE). And in a COW mapping, we really only broke COW if we have an exclusive anonymous page mapped. If we have something else mapped, or the mapped anonymous page might be shared (!PageAnonExclusive), we have to trigger a write fault to break COW. If we don't find an exclusive anonymous page when we retry, we have to trigger COW breaking once again because something intervened.
    Let's move away from this mandatory-retry + dirty handling and rely on our PageAnonExclusive() flag for making a similar decision, to use the same COW logic as in other kernel parts here as well. In case we stumble over a PTE in a COW mapping that does not map an exclusive anonymous page, COW was not properly broken and we have to trigger a fake write-fault to break COW. Just like we do in can_change_pte_writable() added via commit 64fe24a3e05e (mm/mprotect: try avoiding write faults for exclusive anonymous pages when changing protection) and commit 76aefad628aa (mm/mprotect: fix soft-dirty check in can_change_pte_writable()), take care of softdirty and uffd-wp manually. For example, a write() via /proc/self/mem to a uffd-wp-protected range has to fail instead of silently granting write access and bypassing the userspace fault handler. Note that FOLL_FORCE is not only used for debug access, but also triggered by applications without debug intentions, for example, when pinning pages via RDMA. This fixes CVE-2022-2590. Note that only x86_64 and aarch64 are affected, because only those support CONFIG_HAVE_ARCH_USERFAULTFD_MINOR. Fortunately, FOLL_COW is no longer required to handle FOLL_FORCE. So let's just get rid of it. Thanks to Nadav Amit for pointing out that the pte_dirty() check in FOLL_FORCE code is problematic and might be exploitable. Note 1: We don't check for the PTE being dirty because it doesn't matter for making a was COWed decision anymore, and whoever modifies the page has to set the page dirty either way. Note 2: Kernels before extended uffd-wp support and before PageAnonExclusive (< 5.19) can simply revert the problematic commit instead and be safe regarding UFFDIO_CONTINUE. A backport to v5.19 requires minor adjustments due to lack of vma_soft_dirty_enabled(). (CVE-2022-50014)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 已解決 Linux 核心中的下列弱點：mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space.
    Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c (mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unprivileged user space to modify tmpfs/shmem file content even if the user does not have write permissions to the file, and to bypass memfd write sealing -- Dirty COW restricted to tmpfs/shmem (CVE-2022-2590). To fix such security issues for good, the insight is that we really only need that fancy retry logic (FOLL_COW) for COW mappings that are not writable (!VM_WRITE). And in a COW mapping, we really only broke COW if we have an exclusive anonymous page mapped. If we have something else mapped, or the mapped anonymous page might be shared (!PageAnonExclusive), we have to trigger a write fault to break COW. If we don't find an exclusive anonymous page when we retry, we have to trigger COW breaking once again because something intervened.
    Let's move away from this mandatory-retry + dirty handling and rely on our PageAnonExclusive() flag for making a similar decision, to use the same COW logic as in other kernel parts here as well. In case we stumble over a PTE in a COW mapping that does not map an exclusive anonymous page, COW was not properly broken and we have to trigger a fake write-fault to break COW. Just like we do in can_change_pte_writable() added via commit 64fe24a3e05e (mm/mprotect: try avoiding write faults for exclusive anonymous pages when changing protection) and commit 76aefad628aa (mm/mprotect: fix soft-dirty check in can_change_pte_writable()), take care of softdirty and uffd-wp manually. For example, a write() via /proc/self/mem to a uffd-wp-protected range has to fail instead of silently granting write access and bypassing the userspace fault handler. Note that FOLL_FORCE is not only used for debug access, but also triggered by applications without debug intentions, for example, when pinning pages via RDMA. This fixes CVE-2022-2590. Note that only x86_64 and aarch64 are affected, because only those support CONFIG_HAVE_ARCH_USERFAULTFD_MINOR. Fortunately, FOLL_COW is no longer required to handle FOLL_FORCE. So let's just get rid of it. Thanks to Nadav Amit for pointing out that the pte_dirty() check in FOLL_FORCE code is problematic and might be exploitable. Note 1: We don't check for the PTE being dirty because it doesn't matter for making a was COWed decision anymore, and whoever modifies the page has to set the page dirty either way. Note 2: Kernels before extended uffd-wp support and before PageAnonExclusive (< 5.19) can simply revert the problematic commit instead and be safe regarding UFFDIO_CONTINUE. A backport to v5.19 requires minor adjustments due to lack of vma_soft_dirty_enabled(). (CVE-2022-50014)

請注意，Nessus 依賴供應商報告的套件存在。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
245107	Linux Distros Unpatched Vulnerability : CVE-2022-50014	Nessus	Misc.	2025/8/7	2025/8/7	high
245107	Linux Distros のパッチ未適用の脆弱性: CVE-2022-50014	Nessus	Misc.	2025/8/7	2025/8/7	high
245107	Linux Distros 未修补的漏洞：CVE-2022-50014	Nessus	Misc.	2025/8/7	2025/8/7	high
245107	Linux Distros 未修補的弱點：CVE-2022-50014	Nessus	Misc.	2025/8/7	2025/8/7	high

检测

插件搜索

high

high

high

high