In the Linux kernel, the following vulnerability has been resolved: x86/mce: Work around an erratum on fast string copy instructions A rare kernel panic scenario can happen when the following conditions are met due to an erratum on fast string copy instructions: 1) An uncorrected error. 2) That error must be in first cache line of a page. 3) Kernel must execute page_copy from the page immediately before that page. The fast string copy instructions ("REP; MOVS*") could consume an uncorrectable memory error in the cache line _right after_ the desired region to copy and raise an MCE. Bit 0 of MSR_IA32_MISC_ENABLE can be cleared to disable fast string copy and will avoid such spurious machine checks. However, that is less preferable due to the permanent performance impact. Considering memory poison is rare, it's desirable to keep fast string copy enabled until an MCE is seen. Intel has confirmed the following: 1. The CPU erratum of fast string copy only applies to Skylake, Cascade Lake and Cooper Lake generations. Directly return from the MCE handler: 2. Will result in complete execution of the "REP; MOVS*" with no data loss or corruption. 3. Will not result in another MCE firing on the next poisoned cache line due to "REP; MOVS*". 4. Will resume execution from a correct point in code. 5. Will result in the same instruction that triggered the MCE firing a second MCE immediately for any other software recoverable data fetch errors. 6. Is not safe without disabling the fast string copy, as the next fast string copy of the same buffer on the same CPU would result in a PANIC MCE. This should mitigate the erratum completely with the only caveat that the fast string copy is disabled on the affected hyper thread thus performance degradation. This is still better than the OS crashing on MCEs raised on an irrelevant process due to "REP; MOVS*' accesses in a kernel context, e.g., copy_page. Injected errors on 1st cache line of 8 anonymous pages of process 'proc1' and observed MCE consumption from 'proc2' with no panic (directly returned). Without the fix, the host panicked within a few minutes on a random 'proc2' process due to kernel access from copy_page. [ bp: Fix comment style + touch ups, zap an unlikely(), improve the quirk function's readability. ]

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0834-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM (bsc#1186482).
    - CVE-2021-47634: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (bsc#1237758).
    - CVE-2021-47644: media: staging: media: zoran: move videodev alloc (bsc#1237766).
    - CVE-2022-48953: rtc: cmos: fix build on non-ACPI platforms (bsc#1231941).
    - CVE-2022-48975: gpiolib: fix memory leak in gpiochip_setup_dev() (bsc#1231885).
    - CVE-2022-49006: tracing: Free buffers when a used dynamic event is removed (bsc#1232163).
    - CVE-2022-49076: RDMA/hfi1: Fix use-after-free bug for mm struct (bsc#1237738).
    - CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033).
    - CVE-2022-49089: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition (bsc#1238041).
    - CVE-2022-49124: x86/mce: Work around an erratum on fast string copy instructions (bsc#1238148).
    - CVE-2022-49134: mlxsw: spectrum: Guard against invalid local ports (bsc#1237982).
    - CVE-2022-49135: drm/amd/display: Fix memory leak (bsc#1238006).
    - CVE-2022-49151: can: mcba_usb: properly check endpoint type (bsc#1237778).
    - CVE-2022-49178: memstick/mspro_block: fix handling of read-only devices (bsc#1238107).
    - CVE-2022-49182: net: hns3: add vlan list lock to protect vlan list (bsc#1238260).
    - CVE-2022-49201: ibmvnic: fix race between xmit and reset (bsc#1238256).
    - CVE-2022-49247: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED     (bsc#1237783).
    - CVE-2022-49490: drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is (bsc#1238275).
    - CVE-2022-49626: sfc: fix use after free when disabling sriov (bsc#1238270).
    - CVE-2022-49661: can: gs_usb: gs_usb_open/close(): fix memory leak (bsc#1237788).
    - CVE-2023-52572: Fixed UAF in cifs_demultiplex_thread() in cifs (bsc#1220946).
    - CVE-2023-52853: hid: cp2112: Fix duplicate workqueue initialization (bsc#1224988).
    - CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
    - CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a     server (bsc#1217947).
    - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5     modules (bsc#1219169).
    - CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
    - CVE-2024-49963: mailbox: bcm2835: Fix timeout during suspend mode (bsc#1232147).
    - CVE-2024-49975: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1232104).
    - CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
    - CVE-2024-50067: uprobe: avoid out-of-bounds memory access of fetching args (bsc#1232416).
    - CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum()     (bsc#1233248).
    - CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
    - CVE-2024-53217: nfsd: restore callback functionality for NFSv4.0 (bsc#1234999).
    - CVE-2024-56633: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data (bsc#1235485).
    - CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
    - CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
    - CVE-2024-56688: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (bsc#1235538).
    - CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
    - CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
    - CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
    - CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
    - CVE-2025-21689: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (bsc#1237017).
    - CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025).
    - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
    - CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - x86/mce: Work around an erratum on fast string copy instructions A rare kernel panic scenario can happen     when the following conditions are met due to an erratum on fast string copy instructions: 1) An     uncorrected error. 2) That error must be in first cache line of a page. 3) Kernel must execute page_copy     from the page immediately before that page. The fast string copy instructions (REP; MOVS*) could consume     an uncorrectable memory error in the cache line _right after_ the desired region to copy and raise an MCE.
    Bit 0 of MSR_IA32_MISC_ENABLE can be cleared to disable fast string copy and will avoid such spurious     machine checks. However, that is less preferable due to the permanent performance impact. Considering     memory poison is rare, it's desirable to keep fast string copy enabled until an MCE is seen. Intel has     confirmed the following: 1. The CPU erratum of fast string copy only applies to Skylake, Cascade Lake and     Cooper Lake generations. Directly return from the MCE handler: 2. Will result in complete execution of the     REP; MOVS* with no data loss or corruption. 3. Will not result in another MCE firing on the next     poisoned cache line due to REP; MOVS*. 4. Will resume execution from a correct point in code. 5. Will     result in the same instruction that triggered the MCE firing a second MCE immediately for any other     software recoverable data fetch errors. 6. Is not safe without disabling the fast string copy, as the next     fast string copy of the same buffer on the same CPU would result in a PANIC MCE. This should mitigate the     erratum completely with the only caveat that the fast string copy is disabled on the affected hyper thread     thus performance degradation. This is still better than the OS crashing on MCEs raised on an irrelevant     process due to REP; MOVS*' accesses in a kernel context, e.g., copy_page. Injected errors on 1st cache     line of 8 anonymous pages of process 'proc1' and observed MCE consumption from 'proc2' with no panic     (directly returned). Without the fix, the host panicked within a few minutes on a random 'proc2' process     due to kernel access from copy_page. [ bp: Fix comment style + touch ups, zap an unlikely(), improve the     quirk function's readability. ] (CVE-2022-49124)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
232643	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:0834-1)	Nessus	SuSE Local Security Checks	high
225666	Linux Distros Unpatched Vulnerability : CVE-2022-49124	Nessus	Misc.	medium
210815	RHEL 9 : kernel (RHSA-2024:9315)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-49124

medium

Tenable Plugins

high

medium

high