The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vfio/type1: fix cap_migration information leak Fix an information leak where an uninitialized hole in     struct vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace. The definition of struct     vfio_iommu_type1_info_cap_migration contains a hole as shown in this pahole(1) output: struct     vfio_iommu_type1_info_cap_migration { struct vfio_info_cap_header header; /* 0 8 */ __u32 flags; /* 8 4 */     /* XXX 4 bytes hole, try to pack */ __u64 pgsize_bitmap; /* 16 8 */ __u64 max_dirty_bitmap_size; /* 24 8
    */ /* size: 32, cachelines: 1, members: 4 */ /* sum members: 28, holes: 1, sum holes: 4 */ /* last     cacheline: 32 bytes */ }; The cap_mig variable is filled in without initializing the hole: static int     vfio_iommu_migration_build_caps(struct vfio_iommu *iommu, struct vfio_info_cap *caps) { struct     vfio_iommu_type1_info_cap_migration cap_mig; cap_mig.header.id = VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION;
    cap_mig.header.version = 1; cap_mig.flags = 0; /* support minimum pgsize */ cap_mig.pgsize_bitmap =     (size_t)1 << __ffs(iommu->pgsize_bitmap); cap_mig.max_dirty_bitmap_size = DIRTY_BITMAP_SIZE_MAX; return     vfio_info_add_capability(caps, &cap_mig.header, sizeof(cap_mig)); } The structure is then copied to a     temporary location on the heap. At this point it's already too late and ioctl(VFIO_IOMMU_GET_INFO) copies     it to userspace later: int vfio_info_add_capability(struct vfio_info_cap *caps, struct     vfio_info_cap_header *cap, size_t size) { struct vfio_info_cap_header *header; header =     vfio_info_cap_add(caps, size, cap->id, cap->version); if (IS_ERR(header)) return PTR_ERR(header);
    memcpy(header + 1, cap + 1, size - sizeof(*header)); return 0; } This issue was found by code inspection.
    (CVE-2023-54137)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2023-54137

low Nessus Plugin ID 279720

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.9 Feb 5, 2026, 2:38 AM Plugin metadata Plugin Feed: 202602050238
Version 1.8 Feb 4, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602040631
Version 1.7 Feb 3, 2026, 10:27 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602032227
Version 1.6 Jan 15, 2026, 2:04 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601151404
Version 1.5 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601101958
Version 1.4 Jan 7, 2026, 1:59 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601071359
Version 1.3 Jan 6, 2026, 11:29 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601062329
Version 1.2 Dec 26, 2025, 4:55 PM CVSS metrics ("CVSSv3 score" set to 3.3) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N") CVSSv3 severity (based on None, severity decreased from "Medium" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202512261655
Version 1.1 Dec 25, 2025, 7:38 AM New Plugin Feed: 202512250738