The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792245431 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: virtio_console: eliminate anonymous     module_init & module_exit Eliminate anonymous module_init() and module_exit(), which can lead to confusion     or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init     and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map)     ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log)     calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1     initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned     0 after 74 usecs (CVE-2022-49100)

  - In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when     register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced     object 0xffff888101aab550 (size 8): comm insmod, pid 3922, jiffies 4295277753 (age 925.408s) hex dump     (first 8 bytes): 6d 74 64 30 00 88 ff ff mtd0.... backtrace: [<00000000bde26724>]
    __kmalloc_node_track_caller+0x4e/0x150 [<000000003c32b416>] kvasprintf+0xb0/0x130 [<000000001f7a8f15>]     kobject_set_name_vargs+0x2f/0xb0 [<000000006e781163>] dev_set_name+0xab/0xe0 [<00000000e30d0c78>]     add_mtd_device+0x4bb/0x700 [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0 [<00000000c0d88488>]     0xffffffffa0238457 [<00000000b40d0922>] 0xffffffffa02a008f [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0     [<00000000770f6ca6>] do_init_module+0xdf/0x320 [<000000007b6768fe>] load_module+0x2f98/0x3330     [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0 [<00000000674c2290>] do_syscall_64+0x35/0x80     [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 If register device failed, should call     put_device() to give up the reference. (CVE-2022-50566)

  - In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: fix leak of     memory fw (CVE-2022-50664)

  - In the Linux kernel, the following vulnerability has been resolved: acct: fix potential integer overflow     in encode_comp_t() The integer overflow is descripted with following codes: > 317 static comp_t     encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; >     343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of     'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535. (CVE-2022-50749)

  - In the Linux kernel, the following vulnerability has been resolved: ext2: Add sanity checks for group and     filesystem size Add sanity check that filesystem size does not exceed the underlying device size and that     group size is big enough so that metadata can fit into it. This avoid trying to mount some crafted     filesystems with extremely large group counts. (CVE-2022-50815)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792245431)

high Nessus Plugin ID 369516

Version 1.2