The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - dm: fix a race condition in retrieve_deps There's a race condition in the multipath target when     retrieve_deps races with multipath_message calling dm_get_device and dm_put_device. retrieve_deps walks     the list of open devices without holding any lock but multipath may add or remove devices to the list     while it is running. The end result may be memory corruption or use-after-free memory access. See this     description of a UAF with multipath_message(): https://listman.redhat.com/archives/dm-     devel/2022-October/052373.html Fix this bug by introducing a new rw semaphore devices_lock. We grab     devices_lock for read in retrieve_deps and we grab it for write in dm_get_device and dm_put_device.
    (CVE-2023-54324)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2023-54324

high Nessus Plugin ID 280695

Version 1.3