The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe extended     capability should be hidden from the user. For example, an unknown capability (i.e., capability with ID     greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally chosen to be hidden from the user.
    Hiding a capability is done by virtualizing and modifying the 'Next Capability Offset' field of the     previous capability so it points to the capability after the one that should be hidden. The special case     where the first capability in the list should be hidden is handled differently because there is no     previous capability that can be modified. In this case, the capability ID and version are zeroed while     leaving the next pointer intact. This hides the capability and leaves an anchor for the rest of the     capability list. However, today, hiding the first capability in the list is not done properly if the     capability is unknown, as struct vfio_pci_core_device->pci_config_map is set to the capability ID during     initialization but the capability ID is not properly checked later when used in vfio_config_do_rw(). This     leads to the following warning [1] and to an out-of-bounds access to ecap_perms array. Fix it by checking     cap_id in vfio_config_do_rw(), and if it is greater than PCI_EXT_CAP_ID_MAX, use an alternative struct     perm_bits for direct read only access instead of the ecap_perms array. Note that this is safe since the     above is the only case where cap_id can exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities,     which are already checked before). [1] WARNING: CPU: 118 PID: 5329 at     drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] CPU: 118 UID: 0     PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1 (snip) Call Trace: <TASK> ? show_regs+0x69/0x80 ?
    __warn+0x8d/0x140 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? report_bug+0x18f/0x1a0 ?     handle_bug+0x63/0xa0 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ?     vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core]     vfio_pci_rw+0x101/0x1b0 [vfio_pci_core] vfio_pci_core_read+0x1d/0x30 [vfio_pci_core]     vfio_device_fops_read+0x27/0x40 [vfio] vfs_read+0xbd/0x340 ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio]     ? __rseq_handle_notify_resume+0xa4/0x4b0 __x64_sys_pread64+0x96/0xc0 x64_sys_call+0x1c3d/0x20d0     do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2024-53214)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2024-53214

medium Nessus Plugin ID 231815

Version 1.2

Version 1.1

Version 1.2 Aug 8, 2025, 1:31 AM CVSS metrics ("CVSSv2 score" set to 1.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:H/Au:S/C:P/I:N/A:N") CVSS metrics ("CVSSv3 score" set to 4.4) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on CVE-2024-53214, severity decreased from "Medium" to "Low") CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508080131
Version 1.1 Mar 6, 2025, 5:02 PM New Plugin Feed: 202503061702