Detections
Analytics

Echo: linux: security update to 6.1.140-1

high Tenable Self-Hosted Container Security Plugin ID 465494

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the out of bound issue
 of vmemmap address In sparse vmemmap model, the virtual address of vmemmap is calculated as: ((struct page
 *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT)). And the struct page's va can be calculated with an
 offset: (vmemmap + (pfn)). However, when initializing struct pages, kernel actually starts from the first
 page from the same section that phys_ram_base belongs to. If the first page's physical address is not
 (phys_ram_base >> PAGE_SHIFT), then we get an va below VMEMMAP_START when calculating va for it's struct
 page. For example, if phys_ram_base starts from 0x82000000 with pfn 0x82000, the first page in the same
 section is actually pfn 0x80000. During init_unavailable_range(), we will initialize struct page for pfn
 0x80000 with virtual address ((struct page *)VMEMMAP_START - 0x2000), which is below VMEMMAP_START as well
 as PCI_IO_END. This commit fixes this bug by introducing a new variable 'vmemmap_start_pfn' which is
 aligned with memory section size and using it to calculate vmemmap address instead of phys_ram_base.
 (CVE-2024-57945)

Solution

Update the linux library and its related packages to version 6.1.140-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-57945

Plugin Details

Severity: High

ID: 465494

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.06

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2024-57945

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/28/2026

Vulnerability Publication Date: 1/21/2025

Reference Information

CVE: CVE-2024-57945