In the Linux kernel, the following vulnerability has been resolved: bpf: Silence a warning in btf_type_id_size() syzbot reported a warning in [1] with the following stacktrace: WARNING: CPU: 0 PID: 5005 at kernel/bpf/btf.c:1988 btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... RIP: 0010:btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... Call Trace: <TASK> map_check_btf kernel/bpf/syscall.c:1024 [inline] map_create+0x1157/0x1860 kernel/bpf/syscall.c:1198 __sys_bpf+0x127f/0x5420 kernel/bpf/syscall.c:5040 __do_sys_bpf kernel/bpf/syscall.c:5162 [inline] __se_sys_bpf kernel/bpf/syscall.c:5160 [inline] __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5160 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd With the following btf [1] DECL_TAG 'a' type_id=4 component_idx=-1 [2] PTR '(anon)' type_id=0 [3] TYPE_TAG 'a' type_id=2 [4] VAR 'a' type_id=3, linkage=static and when the bpf_attr.btf_key_type_id = 1 (DECL_TAG), the following WARN_ON_ONCE in btf_type_id_size() is triggered: if (WARN_ON_ONCE(!btf_type_is_modifier(size_type) && !btf_type_is_var(size_type))) return NULL; Note that 'return NULL' is the correct behavior as we don't want a DECL_TAG type to be used as a btf_{key,value}_type_id even for the case like 'DECL_TAG -> STRUCT'. So there is no correctness issue here, we just want to silence warning. To silence the warning, I added DECL_TAG as one of kinds in btf_type_nosize() which will cause btf_type_id_size() returning NULL earlier without the warning. [1] https://lore.kernel.org/bpf/000000000000e0df8d05fc75ba86@google.com/

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: Silence a warning in btf_type_id_size() syzbot reported a warning in [1] with the following     stacktrace: WARNING: CPU: 0 PID: 5005 at kernel/bpf/btf.c:1988 btf_type_id_size+0x2d9/0x9d0     kernel/bpf/btf.c:1988 ... RIP: 0010:btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... Call Trace:
    <TASK> map_check_btf kernel/bpf/syscall.c:1024 [inline] map_create+0x1157/0x1860 kernel/bpf/syscall.c:1198
    __sys_bpf+0x127f/0x5420 kernel/bpf/syscall.c:5040 __do_sys_bpf kernel/bpf/syscall.c:5162 [inline]
    __se_sys_bpf kernel/bpf/syscall.c:5160 [inline] __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5160     do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd With the following btf [1] DECL_TAG 'a' type_id=4     component_idx=-1 [2] PTR '(anon)' type_id=0 [3] TYPE_TAG 'a' type_id=2 [4] VAR 'a' type_id=3,     linkage=static and when the bpf_attr.btf_key_type_id = 1 (DECL_TAG), the following WARN_ON_ONCE in     btf_type_id_size() is triggered: if (WARN_ON_ONCE(!btf_type_is_modifier(size_type) &&     !btf_type_is_var(size_type))) return NULL; Note that 'return NULL' is the correct behavior as we don't     want a DECL_TAG type to be used as a btf_{key,value}_type_id even for the case like 'DECL_TAG -> STRUCT'.
    So there is no correctness issue here, we just want to silence warning. To silence the warning, I added     DECL_TAG as one of kinds in btf_type_nosize() which will cause btf_type_id_size() returning NULL earlier     without the warning. [1] https://lore.kernel.org/bpf/000000000000e0df8d05fc75ba86@google.com/     (CVE-2023-54247)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-744 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Silence a warning in btf_type_id_size() (CVE-2023-54247)

    In the Linux kernel, the following vulnerability has been resolved:

    memcg: protect concurrent access to mem_cgroup_idr (CVE-2024-43892)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/aux: Fix AUX buffer serialization (CVE-2024-46713)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix race between direct IO write and fsync when using same fd (CVE-2024-46734)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: Fix use-after-free when removing resource in vmci_resource_remove() (CVE-2024-46738)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind (CVE-2024-46739)

    In the Linux kernel, the following vulnerability has been resolved:

    of/irq: Prevent device address out-of-bounds read in interrupt map walk (CVE-2024-46743)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: sanity check symbolic link size (CVE-2024-46744)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - reject requests with unreasonable number of slots (CVE-2024-46745)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Add missing bridge lock to pci_bus_lock() (CVE-2024-46750)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: replace BUG_ON() with error handling at update_ref_for_cow() (CVE-2024-46752)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Avoid excessive partition lengths (CVE-2024-46777)

    In the Linux kernel, the following vulnerability has been resolved:

    ila: call nf_unregister_net_hooks() sooner (CVE-2024-46782)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp_bpf: fix return value of tcp_bpf_sendmsg() (CVE-2024-46783)

    In the Linux kernel, the following vulnerability has been resolved:

    sch/netem: fix use after free in netem_dequeue (CVE-2024-46800)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (CVE-2024-46822)

    In the Linux kernel, the following vulnerability has been resolved:

    ELF: fix kernel.randomize_va_space double read (CVE-2024-46826)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: sch_cake: fix bulk flow accounting logic for host fairness (CVE-2024-46828)

    In the Linux kernel, the following vulnerability has been resolved:

    rtmutex: Drop rt_mutex::wait_lock before scheduling (CVE-2024-46829)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (CVE-2024-46830)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: clean up our handling of refs == 0 in snapshot delete (CVE-2024-46840)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel: Limit the period on Haswell (CVE-2024-46848)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix bridge mode operations when there are no VFs (CVE-2024-46857)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858)

    In the Linux kernel, the following vulnerability has been resolved:

    fou: fix initialization of grc (CVE-2024-46865)

    In the Linux kernel, the following vulnerability has been resolved:

    i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup (CVE-2024-47665)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (CVE-2024-47668)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: avoid leaving partial pfn mappings around in error case (CVE-2024-47674)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333846	Photon OS 5.0: Linux PHSA-2024-5.0-91-0378	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
297194	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:0315-1)	Nessus	SuSE Local Security Checks	Local	high
296680	SUSE SLES15: cluster-md-kmp-64kb / cluster-md-kmp-default / dlm-kmp-64kb / etc (SUSE-SU-2026:0293-1)	Nessus	SuSE Local Security Checks	Local	high
296676	SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2026:0281-1)	Nessus	SuSE Local Security Checks	Local	high
296481	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0278-1)	Nessus	SuSE Local Security Checks	Local	high
280705	Linux Distros Unpatched Vulnerability : CVE-2023-54247	Nessus	Misc.	Local	medium
209999	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-744)	Nessus	Amazon Linux Local Security Checks	Local	high
207904	Photon OS 5.0: Linux PHSA-2024-5.0-0378	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2023-54247

info

Tenable Plugins

high

high

high

high

high

high

high

medium

high

high