Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - tty序列fsl_lpuart停用 lpuart_dma_shutdown 中的 dma rx/tx 使用旗標 lpuart_dma_shutdown 中斷 lpuart dma但 lpuart_flush_buffer 仍會發生若 lpuart_dma_tx_use 旗標為 true則其會嘗試存取 dma api。此時由於 dma 已關閉這些 dma api 可能會中止。將 lpuart_dma_shutdown 中的 lpuart_dma_tx_use 和對應的 rx 旗標 lpuart_dma_rx_use 設為 false如此 dma 便不會在其釋放後遭到存取。否則當嘗試終止 btattach 時核心可能發生錯誤。
    此修補程式可修正此問題。 root@imx8ulpevk:~# btattach -B /dev/ttyLP2 -S 115200 ^C[ 90.182296] 內部錯誤同步外部中止96000210 [#1] PREEMPT SMP [ 90.189806] 連結於的模組
    moal(O) mlan(O) [ 90.194258] CPU0 PID503 Commbtattach 污染GO 5.15.32-06136-g34eecdf2f9e4 #37 [90.203554] 硬體名稱 NXP i.MX8ULP 9X9 EVK (DT) [ 90.208513] pstate600000c5 (nZCv daIF -PAN -UAO
    -TCO -DIT -SSBS BTYPE=--) [ 90.215470] pc fsl_edma3_disable_request+0x8/0x60 [ 90.220358] lr
    fsl_edma3_terminate_all+0x34/0x20c [ 90.225237] sp : ffff800013f0bac0 [ 90.228548] x29: ffff800013f0bac0 x28: 0000000000000001 x27: ffff000008404800 [ 90.235681] x26: ffff000008404960 x25: ffff000008404a08 x24:
    ffff000008404a00 [ 90.242813] x23: ffff000008404a60 x22: 0000000000000002 x21: 0000000000000000 [90.249946] x20: ffff800013f0baf8 x19: ffff00000559c800 x18: 0000000000000000 [ 90.257078] x17:
    0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 90.264211] x14: 0000000000000003 x13:
    0000000000000000 x120000000000000040 [ 90.271344] x11ffff00000600c248 x10ffff800013f0bb10 x9
    ffff000057bcb090 [ 90.278477] x8 : fffffc0000241a08 x7 : ffff00000534ee00 x6 : ffff000008404804 [90.285609] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff0000055b3480 [ 90.292742] x2 :
    ffff8000135c0000 x1 : ffff00000534ee00 x0 : ffff00000559c800 [ 90.299876] Call trace: [ 90.302321] fsl_edma3_disable_request+0x8/0x60 [ 90.306851] lpuart_flush_buffer+0x40/0x160 [ 90.311037] uart_flush_buffer+0x88/0x120 [ 90.315050] tty_driver_flush_buffer+0x20/0x30 [ 90.319496] hci_uart_flush+0x44/0x90 [ 90.323162] +0x34/0x12c [ 90.327253] tty_ldisc_close+0x38/0x70 [ 90.331005] tty_ldisc_release+0xa8/0x190 [ 90.335018] tty_release_struct+0x24/0x8c [ 90.339022] tty_release+ 0x3ec/0x4c0 [ 90.342593] __fput+0x70/0x234 [ 90.345652]__fput+0x14/0x20 [ 90.348790] task_work_run+0x84/0x17c [ 90.352455] do_exit+0x310/0x96c [ 90.355688] do_group_exit+0x3c/0xa0 [90.359259] __arm64_sys_exit_group+0x1c/0x20 [ 90.363609] invoke_syscall+0x48/0x114 [ 90.367362] el0_svc_common.constprop.0+0xd4/0xfc [ 90.372068] do_el0_svc+0x2c/0x94 [ 90.375379] el0_svc+0x28/0x80 [90.378438] el0t_64_sync_handler+0xa8/0x130 [ 90.382711] el0t_64_sync+0x1a0/0x1a4 [ 90.386376] 程式碼
    17ffffda d503201f d503233f f9409802 (b9400041) [ 90.392467] ---[ end trace 2f60524b4a43f1f6 ]--- [90.397073] 注意btattach[503] 以 preempt_count 1 結束 [ 90.402636] 修正遞回錯誤但需要重新開機(CVE-2022-50375)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown lpuart_dma_shutdown tears down     lpuart dma, but lpuart_flush_buffer can still occur which in turn tries to access dma apis if     lpuart_dma_tx_use flag is true. At this point since dma is torn down, these dma apis can abort. Set     lpuart_dma_tx_use and the corresponding rx flag lpuart_dma_rx_use to false in lpuart_dma_shutdown so that     dmas are not accessed after they are relinquished. Otherwise, when try to kill btattach, kernel may panic.
    This patch may fix this issue. root@imx8ulpevk:~# btattach -B /dev/ttyLP2 -S 115200 ^C[ 90.182296]     Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP [ 90.189806] Modules linked in:
    moal(O) mlan(O) [ 90.194258] CPU: 0 PID: 503 Comm: btattach Tainted: G O 5.15.32-06136-g34eecdf2f9e4 #37 [     90.203554] Hardware name: NXP i.MX8ULP 9X9 EVK (DT) [ 90.208513] pstate: 600000c5 (nZCv daIF -PAN -UAO
    -TCO -DIT -SSBS BTYPE=--) [ 90.215470] pc : fsl_edma3_disable_request+0x8/0x60 [ 90.220358] lr :
    fsl_edma3_terminate_all+0x34/0x20c [ 90.225237] sp : ffff800013f0bac0 [ 90.228548] x29: ffff800013f0bac0     x28: 0000000000000001 x27: ffff000008404800 [ 90.235681] x26: ffff000008404960 x25: ffff000008404a08 x24:
    ffff000008404a00 [ 90.242813] x23: ffff000008404a60 x22: 0000000000000002 x21: 0000000000000000 [     90.249946] x20: ffff800013f0baf8 x19: ffff00000559c800 x18: 0000000000000000 [ 90.257078] x17:
    0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 90.264211] x14: 0000000000000003 x13:
    0000000000000000 x12: 0000000000000040 [ 90.271344] x11: ffff00000600c248 x10: ffff800013f0bb10 x9 :
    ffff000057bcb090 [ 90.278477] x8 : fffffc0000241a08 x7 : ffff00000534ee00 x6 : ffff000008404804 [     90.285609] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff0000055b3480 [ 90.292742] x2 :
    ffff8000135c0000 x1 : ffff00000534ee00 x0 : ffff00000559c800 [ 90.299876] Call trace: [ 90.302321]     fsl_edma3_disable_request+0x8/0x60 [ 90.306851] lpuart_flush_buffer+0x40/0x160 [ 90.311037]     uart_flush_buffer+0x88/0x120 [ 90.315050] tty_driver_flush_buffer+0x20/0x30 [ 90.319496]     hci_uart_flush+0x44/0x90 [ 90.323162] +0x34/0x12c [ 90.327253] tty_ldisc_close+0x38/0x70 [ 90.331005]     tty_ldisc_release+0xa8/0x190 [ 90.335018] tty_release_struct+0x24/0x8c [ 90.339022]     tty_release+0x3ec/0x4c0 [ 90.342593] __fput+0x70/0x234 [ 90.345652] ____fput+0x14/0x20 [ 90.348790]     task_work_run+0x84/0x17c [ 90.352455] do_exit+0x310/0x96c [ 90.355688] do_group_exit+0x3c/0xa0 [     90.359259] __arm64_sys_exit_group+0x1c/0x20 [ 90.363609] invoke_syscall+0x48/0x114 [ 90.367362]     el0_svc_common.constprop.0+0xd4/0xfc [ 90.372068] do_el0_svc+0x2c/0x94 [ 90.375379] el0_svc+0x28/0x80 [     90.378438] el0t_64_sync_handler+0xa8/0x130 [ 90.382711] el0t_64_sync+0x1a0/0x1a4 [ 90.386376] Code:
    17ffffda d503201f d503233f f9409802 (b9400041) [ 90.392467] ---[ end trace 2f60524b4a43f1f6 ]--- [     90.397073] note: btattach[503] exited with preempt_count 1 [ 90.402636] Fixing recursive fault but reboot     is needed! (CVE-2022-50375)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ttyシリアルfsl_lpuartlpuart_dma_shutdown で dma rx/tx 使用フラグを無効にします lpuart_dma_shutdown は lpuart dma をティアダウンしますが、lpuart_flush_buffer は引き続き発生し、lpuart_dma_tx_use フラグが真の場合に dma apis にアクセスしようとします。この時点で dma が切り捨てられるため、これらの dma apis は中止されます。破棄された後に dmas がアクセスされないように、lpuart_dma_tx_use および対応する rx フラグ lpuart_dma_rx_use を lpuart_dma_shutdown で設定します。そうしないと、btattach を kill しようとすると、カーネルがパニックになる可能性があります。
    このパッチにより、この問題が修正される場合があります。 root@imx8ulpevk:~# btattach -B /dev/ttyLP2 -S 115200^C[ 90.182296] 内部エラー同期外部中止96000210 [#1] PREEMPT SMP [ 90.189806] モジュールのリンク
    moal(O) mlan(O) [ 90.194258] CPU: 0 PID503 Comm: btattach 汚染: GO 5.15.32-06136-g34eecdf2f9e4 #3790.203554] ハードウェア名: NXP i.MX8ULP 9X9 EVK (DT) [ 90.208513] pstate600000c5nZCv daIF -PAN -UAO
    -TCO -DIT -SSBS BTYPE=--) [ 90.215470] pcfsl_edma3_disable_request+0x8/0x60 [ 90.220358] lr
    fsl_edma3_terminate_all+0x34/0x20c [ 90.225237] sp : ffff800013f0bac0 [ 90.228548] x29: ffff800013f0bac0 x28: 0000000000000001 x27: ffff000008404800 [ 90.235681] x26: ffff000008404960 x25: ffff000008404a08 x24:
    ffff000008404a00 [ 90.242813] x23: ffff000008404a60 x22: 0000000000000002 x21: 0000000000000000 [90.249946] x20: ffff800013f0baf8 x19: ffff00000559c800 x18: 0000000000000000 [ 90.257078] x17:
    0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 90.264211] x14: 0000000000000003 x13:
    0000000000000000 x12: 0000000000000040 [ 90.271344] x11: ffff000000600c248 x10: ffff800013f0bb10 x9:
    ffff000057bcb090 [ 90.278477] x8 : fffffc0000241a08 x7 : ffff00000534ee00 x6 : ffff000008404804 [90.285609] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff0000055b3480 [ 90.292742] x2 :
    ffff8000135c0000 x1 : ffff00000534ee00 x0 : ffff00000559c800 [ 90.299876] Call trace: [ 90.302321] fsl_edma3_disable_request+0x8/0x60 [ 90.306851] lpuart_flush_buffer+0x40/0x160 [ 90.311037] uart_flush_buffer+0x88/0x120 [ 90.315050] tty_driver_flush_buffer+0x20/0x30 [ 90.319496] hci_uart_flush+0x44/0x90 [ 90.323162] +0x34/0x12c [ 90.327253] tty_ldisc_close+0x38/0x70 [ 90.331005] tty_ldisc_release+0xa8/0x190 [ 90.335018] tty_release_struct+0x24/0x8c [ 90.339022] tty_release+ 0x3ec/0x4c0 [ 90.342593] __fput+0x70/0x234 [ 90.345652 ] ___fput+0x14/0x20 [ 90.348790 ] task_work_run+0x84/0x17c [ 90.352455] do_exit+0x310/0x96c [ 90.355688] do_group_exit+0x3c/0xa0 [90.359259] __arm64_sys_exit_group+0x1c/0x20 [ 90.363609] invoke_syscall+0x48/0x114 [ 90.367362 ] el0_svc_common.constprop.0+0xd4/0xfc [ 90.372068] do_el0_svc+0x2c/0x94 [ 90.375379] el0_svc+0x28/0x80 [90.378438] el0t_64_sync_handler+0xa8/0x130 [ 90.382711] el0t_64_sync+0x1a0/0x1a4 [ 90.386376] コード
    17ffffda d503201f d503233f f9409802 (b9400041) [ 90.392467] ---[ 終了トレース 2f60524b4a43f1f6 ]--- [90.397073] 注btattach[503] preempt_count 1 で終了しました 90.402636再帰障害を修正しますが、再起動が必要です!CVE-2022-50375

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ttyserialfsl_lpuart在 lpuart_dma_shutdown 中禁用 dma rx/tx 使用标记 lpuart_dma_shutdown 会破坏 lpuart dma但仍会发生 lpuart_flush_buffer如果 lpuart_dma_tx_use 标记为真则其转而尝试访问 dma api。此时由于 dma 已破坏这些 dma api 可能中止。在 lpuart_dma_shutdown 中将 lpuart_dma_tx_use 和相应的 rx 标记 lpuart_dma_rx_use 设置为 false以便在释放 dmas 后不会对其进行访问。否则在尝试终止 btattach 时内核可能会发生错误。
    此修补程序可以修复此问题。 root@imx8ulpevk:~# btattach -B /dev/ttyLP2 -S 115200 ^C[ 90.182296] 内部错误同步外部中止96000210 [#1] PREEMPT SMP [ 90.189806] 链接的模块用于
    moal(O) mlan(O) [ 90.194258] CPU: 0 PID: 503 Comm: btattach 受感染GO 5.15.32-06136-g34eecdf2f9e4 #37 [90.203554] 硬件名称NXP i.MX8ULP 9X9 EVK (DT) [ 90.208513] pstate600000c5 (nZCv daIF -PAN -UAO
    -TCO -DIT -SSBS BTYPE=--) [ 90.215470] pc fsl_edma3_disable_request+0x8/0x60 [ 90.220358] lr
    fsl_edma3_terminate_all+0x34/0x20c [ 90.225237] sp : ffff800013f0bac0 [ 90.228548] x29: ffff800013f0bac0 x28: 0000000000000001 x27: ffff000008404800 [ 90.235681] x26: ffff000008404960 x25: ffff000008404a08 x24:
    ffff000008404a00 [ 90.242813] x23: ffff000008404a60 x22: 0000000000000002 x21: 0000000000000000 [90.249946] x20: ffff800013f0baf8 x19: ffff00000559c800 x18: 0000000000000000 [ 90.257078] x17:
    0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 90.264211] x14: 0000000000000003 x13:
    0000000000000000 x120000000000000040 [ 90.271344] x11ffff00000600c248 x10ffff800013f0bb10 x9
    ffff000057bcb090 [ 90.278477] x8 : fffffc0000241a08 x7 : ffff00000534ee00 x6 : ffff000008404804 [90.285609] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff0000055b3480 [ 90.292742] x2 :
    ffff8000135c0000 x1 : ffff00000534ee00 x0 : ffff00000559c800 [ 90.299876] Call trace: [ 90.302321] fsl_edma3_disable_request+0x8/0x60 [ 90.306851] lpuart_flush_buffer+0x40/0x160 [ 90.311037] uart_flush_buffer+0x88/0x120 [ 90.315050] tty_driver_flush_buffer+0x20/0x30 [ 90.319496] hci_uart_flush+0x44/0x90 [ 90.323162] +0x34/0x12c [ 90.327253] tty_ldisc_close+0x38/0x70 [ 90.331005] tty_ldisc_release+0xa8/0x190 [ 90.335018] tty_release_struct+0x24/0x8c [ 90.339022] tty_release+ 0x3ec/0x4c0 [ 90.342593] __fput+0x70/0x234 [ 90.345652]____fput+0x14/0x20 [ 90.348790] task_work_run+0x84/0x17c [ 90.352455] do_exit+0x310/0x96c [ 90.355688] do_group_exit+0x3c/0xa0 [90.359259] __arm64_sys_exit_group+0x1c/0x20 [ 90.363609] invoke_syscall+0x48/0x114 [ 90.367362] el0_svc_common.constprop.0+0xd4/0xfc [ 90.372068] do_el0_svc+0x2c/0x94 [ 90.375379] el0_svc+0x28/0x80 [90.378438] el0t_64_sync_handler+0xa8/0x130 [ 90.382711] el0t_64_sync+0x1a0/0x1a4 [ 90.386376] Code
    17ffffda d503201f d503233f f9409802 (b9400041) [ 90.392467] ---[ 结束跟踪 2f60524b4a43f1f6 ]--- [90.397073] 注意btattach[503] 因 preempt_count 1 退出 [ 90.402636] 修复了递归错误但需要重新启动(CVE-2022-50375)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	Name	Product	Family	Published	Updated	Severity
265606	Linux Distros 未修補的弱點：CVE-2022-50375	Nessus	Misc.	9/20/2025	9/30/2025	medium
265606	Linux Distros Unpatched Vulnerability : CVE-2022-50375	Nessus	Misc.	9/20/2025	9/30/2025	medium
265606	Linux Distros のパッチ未適用の脆弱性: CVE-2022-50375	Nessus	Misc.	9/20/2025	9/30/2025	medium
265606	Linux Distros 未修补的漏洞：CVE-2022-50375	Nessus	Misc.	9/20/2025	9/30/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium