The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: <TASK> __dump_stack     lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description     mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180     mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058     [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310     fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190     fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter     fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write     fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250     fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0     arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted     image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to     access block address in dnode at offset 934, however it parses the dnode as inode node, so that     get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes.
    To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().
    (CVE-2025-38677)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-38677

medium Nessus Plugin ID 261115

Version 1.10

Version 1.9

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Oct 29, 2025, 3:03 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510290303
Version 1.9 Oct 27, 2025, 11:56 PM Detection (updated detection logic) Plugin Feed: 202510272356
Version 1.5 Sep 25, 2025, 11:29 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509252329
Version 1.4 Sep 21, 2025, 8:29 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509210829
Version 1.3 Sep 6, 2025, 7:55 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509061955
Version 1.2 Sep 6, 2025, 2:03 AM CVSS metrics ("CVSSv2 score" set to 7.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 6.6) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509060203
Version 1.1 Sep 3, 2025, 4:10 PM New Plugin Feed: 202509031610