Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - riscv在不精確的回溯堆疊模式中使用 READ_ONCE_NOCHECK 取消設定 CONFIG_FRAME_POINTER 時堆疊回溯函式 walk_stackframe 會隨機讀取堆疊然後在 KASAN 啟用的情況下可能會導致下列反向追踪[ 0.000000] ====== ================================================== ========== [ 0.000000] 錯誤KASANwalk_stackframe+0xa6/0x11a 中的堆疊超出邊界 [ 0.000000] 工作 swapper/0 在 addr ffffffff81807c40 讀取大小為 8 [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper 未受污染的 6.2.0-12919-g24203e6db61f #43 [ 0.000000] 硬體名稱 riscv-virtio,qemu (DT) [ 0.000000] 呼叫追踪[ 0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36 [ 0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8 [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/ 0xc8 [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84 [ 0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6 [ 0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76 [ 0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/ 0x32e [ 0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52 [ 0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84 [ 0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6 [ 0.000000] [<ffffffff8015ec52>] kasan_set_track+ 0x12/0x20 [ 0.000000] [<ffffffff8015f22e>]
    __kasan_slab_alloc+0x58/0x5e [ 0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a [ 0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c [ 0.000000] [<ffffffff80e17ab2>] ] kmem_cache_init+0x6c/0x11e [ 0.000000] ] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe [ 0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca [ 0.000000] [ 0.000000] 錯誤位址屬於工作 swapper/0 的堆疊 [ 0.000000]且位於 中的位移 0框架 [ 0.000000] stack_trace_save+0x0/0xa6 [0.000000] [ 0.000000] 此框架具有 1 個物件 [ 0.000000] [32, 56) 'c' [ 0.000000] [ 0.000000] 錯誤位址屬於實體頁面 [ 0.000000] page(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags0x1000(reserved|zone=0) [ 0.000000] raw
    0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000] [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 [ 0.000000] ^ [ 0.000000] ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807d00: 00 00 00 00 00 0 0 0 0000 00 00 00 00 00 00 00 [ 0.000000] ======================================= =========================== 在不精確的模式下讀取堆疊時使用 READ_ONCE_NOCHECK 修正此問題。 (CVE-2023-53135)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - riscv在不精确展开堆栈模式中使用 READ_ONCE_NOCHECK当未设置 CONFIG_FRAME_POINTER 时堆栈展开函数 walk_stackframe 会随机读取堆栈然后在启用了 KASAN 时可导致以下回溯[ 0.000000] ====== ================================================== ========== [ 0.000000] BUGKASANwalk_stackframe+0xa6/0x11a 中的堆栈越界 [ 0.000000] 通过任务 swapper/0 在地址 ffffffff81807c40 读取大小 8 的数据 [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000] 硬件名称riscv-virtio,qemu (DT) [ 0.000000] 调用跟踪 [ 0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36 [ 0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8 [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/ 0xc8 [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84 [ 0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6 [ 0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76 [ 0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/ 0x32e [ 0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52 [ 0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84 [ 0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6 [ 0.000000] [<ffffffff8015ec52>] kasan_set_track+ 0x12/0x20 [ 0.000000] [<ffffffff8015f22e>]
    __kasan_slab_alloc+0x58/0x5e [ 0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a [ 0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c [ 0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e [ 0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe [ 0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca [ 0.000000] [ 0.000000] 有缺陷的地址属于任务 swapper/0 的堆栈 [ 0.000000] 并且位于frame[ 0.000000] stack_trace_save+0x0/0xa6 [0.000000] [ 0.000000] 此帧有 1 个对象[ 0.000000] [32, 56) 'c' [ 0.000000] [ 0.000000] 此缺陷的地址属于物理页[ 0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags: 0x1000(reserved|zone=0) [ 0.000000] raw
    0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000] [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 [ 0.000000] ^ [ 0.000000] ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ======================================= =========================== 请在不精确模式下读取堆栈时使用 READ_ONCE_NOCHECK 来修复此问题。 (CVE-2023-53135)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - riscv不正確なアンワインドスタックモードで READ_ONCE_NOCHECK を使用します。CONFIG_FRAME_POINTER が設定されていない場合、スタックアンワインド関数 walk_stackframe はランダムにスタックを読み込み、KASAN が有効な場合、次のバックトレースを引き起こす可能性があります。[ 0.000000] ======= ======================================================== ======================= [ 0.000000BUG: KASANwalk_stackframe+0xa6/0x11a の stack-out-of-bounds 0.000000] タスク swapper/0 による addr ffffffff81807c40 でのサイズ 8 の読み取り 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not taint 6.2.0-12919-g24203e6db61f #43 [ 0.000000] ハードウェア名: riscv-virtio、qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a 0.000000、[<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000、[]<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36 [] 0.000000]<ffffffff80c3783e>] print_report+0x198/0x4a8 [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000、[<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a 0.000000[] 、 、<ffffffff8015f68a>] kasan_report+0x9a/ 0xc8 [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [] 0.000000]<ffffffff8006e99c>] desc_make_final+0x80/0x84 [ 0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6 0.000000、 [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76 [ 0.000000、<ffffffff8006b95e>] devkmsg_read+0x32a/ 0x32e [ 0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52 [ 0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84 0.000000、[]<ffffffff8009a04a>] stack_trace_save+0x84/0xa6 [ 0.000000、<ffffffff8015ec52>]、kasan_set_track+ 0x12/0x20 [ 0.000000] [<ffffffff8015f22e>]
    __kasan_slab_alloc+0x58/0x5e [ 0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a 0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c [ 0.000000] [<ffffffff80e17ab2> ] kmem_cache_init+0x6c/0x11e [ 0.000000]<ffffffff80e00fd6>mm_init+0xd8/0xfe [ 0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca [ 0.000000] [ 0.000000] バグのあるアドレスは、タスク swapper/0 のスタックに属しており [ 0.000000] のオフセット 0 にあります。 frame: [ 0.000000] stack_trace_save+0x0/0xa6 [0.000000] [ 0.000000] このフレームには 1 つのオブジェクトがあります[ 0.000000] [32、56) 'c' [ 0.000000] [ 0.000000] バグのあるアドレスは に属しますthe physical page: [ 0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags: 0x1000(reserved|zone=0) [ 0.000000] raw:
    0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000] [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 00 00 00 f3 [ 0.000000]^ [ 0.000000] ffffffff81807c80f3 f3 f3 00 00 00 0.00000000 00 00 00 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 00 00 00 00 00 00 00 [ 0.000000] ========================================= =================================== 不正確なモードでスタックを読み取るときに READ_ONCE_NOCHECK を使用して を修正します。CVE-2023-53135

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992949 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode

    When CONFIG_FRAME_POINTER is unset, the stack unwinding function     walk_stackframe randomly reads the stack and then, when KASAN is enabled,     it can lead to the following backtrace:

    [    0.000000] ==================================================================     [    0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a     [    0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0     [    0.000000]     [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43     [    0.000000] Hardware name: riscv-virtio,qemu (DT)     [    0.000000] Call Trace:
    [    0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a     [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36     [    0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8     [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/0xc8     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84     [    0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6     [    0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76     [    0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e     [    0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52     [    0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84     [    0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6     [    0.000000] [<ffffffff8015ec52>] kasan_set_track+0x12/0x20     [    0.000000] [<ffffffff8015f22e>] __kasan_slab_alloc+0x58/0x5e     [    0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a     [    0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c     [    0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e     [    0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe     [    0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca     [    0.000000]     [    0.000000] The buggy address belongs to stack of task swapper/0     [    0.000000]  and is located at offset 0 in frame:
    [    0.000000]  stack_trace_save+0x0/0xa6     [    0.000000]     [    0.000000] This frame has 1 object:
    [    0.000000]  [32, 56) 'c'     [    0.000000]     [    0.000000] The buggy address belongs to the physical page:
    [    0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07     [    0.000000] flags: 0x1000(reserved|zone=0)     [    0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000     [    0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff     [    0.000000] page dumped because: kasan: bad access detected     [    0.000000]     [    0.000000] Memory state around the buggy address:
    [    0.000000]  ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000]  ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3     [    0.000000]                                            ^     [    0.000000]  ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000]  ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000] ==================================================================

    Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise     mode.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER is unset, the     stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can     lead to the following backtrace: [ 0.000000]     ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-     bounds in walk_stackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0     [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000]     Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [<ffffffff80007ba8>]     walk_stackframe+0x0/0x11a [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000]     [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36     [ 0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8 [ 0.000000] [<ffffffff80099ecc>]     init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000]     [<ffffffff8015f68a>] kasan_report+0x9a/0xc8 [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [     0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8006e99c>]     desc_make_final+0x80/0x84 [ 0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6 [ 0.000000]     [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76 [ 0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e     [ 0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52 [ 0.000000] [<ffffffff8006e998>]     desc_make_final+0x7c/0x84 [ 0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6 [ 0.000000]     [<ffffffff8015ec52>] kasan_set_track+0x12/0x20 [ 0.000000] [<ffffffff8015f22e>]
    __kasan_slab_alloc+0x58/0x5e [ 0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a [ 0.000000]     [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c [ 0.000000] [<ffffffff80e17ab2>]     kmem_cache_init+0x6c/0x11e [ 0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe [ 0.000000]     [<ffffffff80e011d8>] start_kernel+0x190/0x3ca [ 0.000000] [ 0.000000] The buggy address belongs to stack     of task swapper/0 [ 0.000000] and is located at offset 0 in frame: [ 0.000000] stack_trace_save+0x0/0xa6 [     0.000000] [ 0.000000] This frame has 1 object: [ 0.000000] [32, 56) 'c' [ 0.000000] [ 0.000000] The buggy     address belongs to the physical page: [ 0.000000] page:(____ptrval____) refcount:1 mapcount:0     mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags: 0x1000(reserved|zone=0) [ 0.000000] raw:
    0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000     0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000]     [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00     00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [     0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 [ 0.000000] ^ [ 0.000000]     ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807d00: 00 00 00     00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000]     ================================================================== Fix that by using READ_ONCE_NOCHECK     when reading the stack in imprecise mode. (CVE-2023-53135)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990809 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode

    When CONFIG_FRAME_POINTER is unset, the stack unwinding function     walk_stackframe randomly reads the stack and then, when KASAN is enabled,     it can lead to the following backtrace:

    [    0.000000] ==================================================================     [    0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a     [    0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0     [    0.000000]     [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43     [    0.000000] Hardware name: riscv-virtio,qemu (DT)     [    0.000000] Call Trace:
    [    0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a     [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36     [    0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8     [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/0xc8     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a     [    0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84     [    0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6     [    0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76     [    0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e     [    0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52     [    0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84     [    0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6     [    0.000000] [<ffffffff8015ec52>] kasan_set_track+0x12/0x20     [    0.000000] [<ffffffff8015f22e>] __kasan_slab_alloc+0x58/0x5e     [    0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a     [    0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c     [    0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e     [    0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe     [    0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca     [    0.000000]     [    0.000000] The buggy address belongs to stack of task swapper/0     [    0.000000]  and is located at offset 0 in frame:
    [    0.000000]  stack_trace_save+0x0/0xa6     [    0.000000]     [    0.000000] This frame has 1 object:
    [    0.000000]  [32, 56) 'c'     [    0.000000]     [    0.000000] The buggy address belongs to the physical page:
    [    0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07     [    0.000000] flags: 0x1000(reserved|zone=0)     [    0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000     [    0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff     [    0.000000] page dumped because: kasan: bad access detected     [    0.000000]     [    0.000000] Memory state around the buggy address:
    [    0.000000]  ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000]  ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3     [    0.000000]                                            ^     [    0.000000]  ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000]  ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     [    0.000000] ==================================================================

    Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise     mode.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
246354	Linux Distros 未修補的弱點：CVE-2023-53135	Nessus	Misc.	2025/8/8	2026/1/14	high
246354	Linux Distros 未修补的漏洞：CVE-2023-53135	Nessus	Misc.	2025/8/8	2026/1/14	high
246354	Linux Distros のパッチ未適用の脆弱性: CVE-2023-53135	Nessus	Misc.	2025/8/8	2026/1/14	high
281263	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992949)	Nessus	Unity Linux Local Security Checks	2025/12/31	2025/12/31	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	2021/7/22	2026/3/23	high
246354	Linux Distros Unpatched Vulnerability : CVE-2023-53135	Nessus	Misc.	2025/8/8	2026/1/14	high
275069	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990809)	Nessus	Unity Linux Local Security Checks	2025/11/12	2025/11/12	high

检测

插件搜索

high

high

high

high

high

high

high