In the Linux kernel, the following vulnerability has been resolved: ext2: Add sanity checks for group and filesystem size Add sanity check that filesystem size does not exceed the underlying device size and that group size is big enough so that metadata can fit into it. This avoid trying to mount some crafted filesystems with extremely large group counts.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792245431 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: virtio_console: eliminate anonymous     module_init & module_exit Eliminate anonymous module_init() and module_exit(), which can lead to confusion     or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init     and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map)     ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log)     calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1     initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned     0 after 74 usecs (CVE-2022-49100)

  - In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when     register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced     object 0xffff888101aab550 (size 8): comm insmod, pid 3922, jiffies 4295277753 (age 925.408s) hex dump     (first 8 bytes): 6d 74 64 30 00 88 ff ff mtd0.... backtrace: [<00000000bde26724>]
    __kmalloc_node_track_caller+0x4e/0x150 [<000000003c32b416>] kvasprintf+0xb0/0x130 [<000000001f7a8f15>]     kobject_set_name_vargs+0x2f/0xb0 [<000000006e781163>] dev_set_name+0xab/0xe0 [<00000000e30d0c78>]     add_mtd_device+0x4bb/0x700 [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0 [<00000000c0d88488>]     0xffffffffa0238457 [<00000000b40d0922>] 0xffffffffa02a008f [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0     [<00000000770f6ca6>] do_init_module+0xdf/0x320 [<000000007b6768fe>] load_module+0x2f98/0x3330     [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0 [<00000000674c2290>] do_syscall_64+0x35/0x80     [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 If register device failed, should call     put_device() to give up the reference. (CVE-2022-50566)

  - In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: fix leak of     memory fw (CVE-2022-50664)

  - In the Linux kernel, the following vulnerability has been resolved: acct: fix potential integer overflow     in encode_comp_t() The integer overflow is descripted with following codes: > 317 static comp_t     encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; >     343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of     'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535. (CVE-2022-50749)

  - In the Linux kernel, the following vulnerability has been resolved: ext2: Add sanity checks for group and     filesystem size Add sanity check that filesystem size does not exceed the underlying device size and that     group size is big enough so that metadata can fit into it. This avoid trying to mount some crafted     filesystems with extremely large group counts. (CVE-2022-50815)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ext2: Add sanity checks for group and filesystem size Add sanity check that filesystem size does not     exceed the underlying device size and that group size is big enough so that metadata can fit into it. This     avoid trying to mount some crafted filesystems with extremely large group counts. (CVE-2022-50815)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
369516	CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792245431)	Nessus	CentOS Local Security Checks	Local	medium
280726	Linux Distros Unpatched Vulnerability : CVE-2022-50815	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2022-50815

high

Tenable Plugins

medium

medium