The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - btrfs: use latest_dev in btrfs_show_devname The test case btrfs/238 reports the warning below: WARNING:
    CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfs_show_devname+0x104/0x1e8 [btrfs] CPU: 2 PID: 1 Comm:
    systemd Tainted: G W O 5.14.0-rc1-custom #72 Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0     02/06/2015 Call trace: btrfs_show_devname+0x108/0x1b4 [btrfs] show_mountinfo+0x234/0x2c4 m_show+0x28/0x34     seq_read_iter+0x12c/0x3c4 vfs_read+0x29c/0x2c8 ksys_read+0x80/0xec __arm64_sys_read+0x28/0x34     invoke_syscall+0x50/0xf8 do_el0_svc+0x88/0x138 el0_svc+0x2c/0x8c el0t_64_sync_handler+0x84/0xe4     el0t_64_sync+0x198/0x19c Reason: While btrfs_prepare_sprout() moves the fs_devices::devices into     fs_devices::seed_list, the btrfs_show_devname() searches for the devices and found none, leading to the     warning as in above. Fix: latest_dev is updated according to the changes to the device list. That means we     could use the latest_dev->name to show the device name in /proc/self/mounts, the pointer will be always     valid as it's assigned before the device is deleted from the list in remove or replace. The RCU protection     is sufficient as the device structure is freed after synchronization. (CVE-2021-47599)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2021-47599

medium Nessus Plugin ID 230180

Version 1.29