The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1777614769 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in     asix_mdio_read() asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be     uninitialized. Fail log: BUG: KMSAN: uninit-value in asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in     asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497     asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] asix_check_host_enable     drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 asix_mdio_read+0x3c1/0xb00     drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497 (CVE-2021-47101)

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer     overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd     thread by combining the RPC receive and send buffers into a single array of pages. This works because     there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same     time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of     rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks     when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by     sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full     maximum payload size cannot be constructed in that case. (CVE-2022-50410)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix use-after-free bug     in smp_execute_task_sg() When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to     delete slow_task->timer. However, if the timer handler sas_task_internal_timedout() is running, the     del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:
    (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ...
    sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling     del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the     task->slow_task is deallocated. (CVE-2022-50422)

  - In the Linux kernel, the following vulnerability has been resolved: VMCI: check context->notify_page after     call to get_user_pages_fast() to avoid GPF The call to get_user_pages_fast() in vmci_host_setup_notify()     can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and     return error if so. general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000     [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300-     0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat     KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace:
    <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40 __x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90     entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2023-53259)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix not validating     setsockopt user input Check user input length before copying data. (CVE-2024-35965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1777614769)

high Nessus Plugin ID 361340

Version 1.3