The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0436 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2024-42104:
    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: add missing check for inode numbers on directory entries

    Syzbot reported that mounting and unmounting a specific pattern of     corrupted nilfs2 filesystem images causes a use-after-free of metadata     file inodes, which triggers a kernel bug in lru_add_fn().

    As Jan Kara pointed out, this is because the link count of a metadata file     gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(),     tries to delete that inode (ifile inode in this case).

    The inconsistency occurs because directories containing the inode numbers     of these metadata files that should not be visible in the namespace are     read without checking.

    Fix this issue by treating the inode numbers of these internal files as     errors in the sanity check helper when reading directory folios/pages.

    Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer     analysis.

    CVE-2024-38599:
    In the Linux kernel, the following vulnerability has been resolved:

    jffs2: prevent xattr node from overflowing the eraseblock

    Add a check to make sure that the requested xattr node size is no larger     than the eraseblock minus the cleanmarker.

    Unlike the usual inode nodes, the xattr nodes aren't split into parts     and spread across multiple eraseblocks, which means that a xattr node     must not occupy more than one eraseblock. If the requested xattr value is     too large, the xattr node can spill onto the next eraseblock, overwriting     the nodes and causing errors such as:

    jffs2: argh. node added in wrong place at 0x0000b050(2)     jffs2: nextblock 0x0000a000, expected at 0000b00c     jffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050,     read=0xfc892c93, calc=0x000000     jffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed     at 0x01e00c. {848f,2fc4,0fef511f,59a3d171}     jffs2: Node at 0x0000000c with length 0x00001044 would run over the     end of the erase block     jffs2: Perhaps the file system was created with the wrong erase size?     jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found     at 0x00000010: 0x1044 instead

    This breaks the filesystem and can lead to KASAN crashes such as:

    BUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0     Read of size 4 at addr ffff88802c31e914 by task repro/830     CPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),     BIOS Arch Linux 1.16.3-1-1 04/01/2014     Call Trace:
     <TASK>      dump_stack_lvl+0xc6/0x120      print_report+0xc4/0x620      ? __virt_addr_valid+0x308/0x5b0      kasan_report+0xc1/0xf0      ? jffs2_sum_add_kvec+0x125e/0x15d0      ? jffs2_sum_add_kvec+0x125e/0x15d0      jffs2_sum_add_kvec+0x125e/0x15d0      jffs2_flash_direct_writev+0xa8/0xd0      jffs2_flash_writev+0x9c9/0xef0      ? __x64_sys_setxattr+0xc4/0x160      ? do_syscall_64+0x69/0x140      ? entry_SYSCALL_64_after_hwframe+0x76/0x7e      [...]

    Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

    CVE-2024-38583:
    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of timer for log writer thread

    Patch series nilfs2: fix log writer related issues.

    This bug fix series covers three nilfs2 log writer-related issues,     including a timer use-after-free issue and potential deadlock issue on     unmount, and a potential freeze issue in event synchronization found     during their analysis.  Details are described in each commit log.


    This patch (of 3):

    A use-after-free issue has been reported regarding the timer sc_timer on     the nilfs_sc_info structure.

    The problem is that even though it is used to wake up a sleeping log     writer thread, sc_timer is not shut down until the nilfs_sc_info structure     is about to be freed, and is used regardless of the thread's lifetime.

    Fix this issue by limiting the use of sc_timer only while the log writer     thread is alive.

    CVE-2024-36964:
    In the Linux kernel, the following vulnerability has been resolved:

    fs/9p: only translate RWX permissions for plain 9P2000

    Garbage in plain 9P2000's perm bits is allowed through, which causes it     to be able to set (among others) the suid bit. This was presumably not     the intent since the unix extended bits are handled explicitly and     conditionally on .u.

    CVE-2021-47505:
    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix use-after-free due to missing POLLFREE handling

    signalfd_poll() and binder_poll() are special in that they use a     waitqueue whose lifetime is the current task, rather than the struct     file as is normally the case.  This is okay for blocking polls, since a     blocking poll occurs within one task; however, non-blocking polls     require another solution.  This solution is for the queue to be cleared     before it is freed, by sending a POLLFREE notification to all waiters.

    Unfortunately, only eventpoll handles POLLFREE.  A second type of     non-blocking poll, aio poll, was added in kernel v4.18, and it doesn't     handle POLLFREE.  This allows a use-after-free to occur if a signalfd or     binder fd is polled with aio poll, and the waitqueue gets freed.

    Fix this by making aio poll handle POLLFREE.

    A patch by Ramji Jiyani <ramjiyani@google.com>     (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)     tried to do this by making aio_poll_wake() always complete the request     inline if POLLFREE is seen.  However, that solution had two bugs.
    First, it introduced a deadlock, as it unconditionally locked the aio     context while holding the waitqueue lock, which inverts the normal     locking order.  Second, it didn't consider that POLLFREE notifications     are missed while the request has been temporarily de-queued.

    The second problem was solved by my previous patch.  This patch then     properly fixes the use-after-free by handling POLLFREE in a     deadlock-free way.  It does this by taking advantage of the fact that     freeing of the waitqueue is RCU-delayed, similar to what eventpoll does.

    CVE-2021-46993:
    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix out-of-bound access in uclamp

    Util-clamp places tasks in different buckets based on their clamp values     for performance reasons. However, the size of buckets is currently     computed using a rounding division, which can lead to an off-by-one     error in some configurations.

    For instance, with 20 buckets, the bucket size will be 1024/20=51. A     task with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,     correct indexes are in range [0,19], hence leading to an out of bound     memory access.

    Clamp the bucket id to fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.129-62.227. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-004 advisory.

    A flaw was found in the Linux kernels implementation of wifi fragmentation handling. An attacker with the     ability to transmit within the wireless transmission range of an access point can abuse a flaw where     previous contents of wifi fragments can be unintentionally transmitted to another device. (CVE-2020-24586)

    A flaw was found in the Linux kernel's WiFi implementation. An attacker within the wireless range can     abuse a logic flaw in the WiFi implementation by reassembling packets from multiple fragments under     different keys, treating them as valid. This flaw allows an attacker to send a fragment under an incorrect     key, treating them as a valid fragment under the new key. The highest threat from this vulnerability is to     confidentiality. (CVE-2020-24587)

    A flaw was found in the Linux kernels wifi implementation. An attacker within wireless broadcast range can     inject custom data into the wireless communication circumventing checks on the data.  This can cause the     frame to pass checks and be considered a valid frame of a different type. (CVE-2020-24588)

    Frames used for authentication and key management between the AP and connected clients.  Some clients may     take these redirected frames masquerading as control mechanisms from the AP. (CVE-2020-26139)

    A vulnerability was found in Linux kernel's WiFi implementation.  An attacker within wireless range can     inject a control packet fragment where the kernel does not verify the Message Integrity Check     (authenticity) of fragmented TKIP frames. (CVE-2020-26141)

    A flaw was found in ath10k_htt_rx_proc_rx_frag_ind_hl in drivers/net/wireless/ath/ath10k/htt_rx.c in the     Linux kernel WiFi implementations, where it accepts a second (or subsequent) broadcast fragments even when     sent in plaintext and then process them as full unfragmented frames. The highest threat from this     vulnerability is to integrity. (CVE-2020-26145)

    A flaw was found in ieee80211_rx_h_defragment in net/mac80211/rx.c in the Linux Kernel's WiFi     implementation. This vulnerability can be abused to inject packets or exfiltrate selected fragments when     another device sends fragmented frames, and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
    The highest threat from this vulnerability is to integrity. (CVE-2020-26147)

    A flaw was found in the Linux kernel in certs/blacklist.c, When signature entries for EFI_CERT_X509_GUID     are contained in the Secure Boot Forbidden Signature Database, the entries are skipped. This can cause a     security threat and breach system integrity, confidentiality and even lead to a denial of service problem.
    (CVE-2020-26541)

    A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing (SSP),     Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable     to an impersonation attack where an active attacker can impersonate the initiating device without any     previous knowledge. (CVE-2020-26558)

    A flaw was found in the Linux kernel. Improper access control in BlueZ may allow an authenticated user to     potentially enable information disclosure via adjacent access. The highest threat from this vulnerability     is to data confidentiality and integrity. (CVE-2021-0129)

    A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VM_IO|VM_PFNMAP     VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest.
    This flaw allows users who can start and control a VM to read/write random pages of memory, resulting in     local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity,     and system availability. (CVE-2021-22543)

    A flaw was found in the Linux kernel's handling of the removal of Bluetooth HCI controllers. This flaw     allows an attacker with a local account to exploit a race condition, leading to corrupted memory and     possible privilege escalation. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-32399)

    A use-after-free flaw was found in hci_send_acl in the bluetooth host controller interface (HCI) in Linux     kernel, where a local attacker with an access rights could cause a denial of service problem on the system     The issue results from the object hchan, freed in hci_disconn_loglink_complete_evt, yet still used in     other places. The highest threat from this vulnerability is to data integrity, confidentiality and system     availability. (CVE-2021-33034)

    The canbus filesystem in the Linux kernel contains an information leak of kernel memory to devices on the     CAN bus network link layer.  An attacker with the ability to dump messages on the CAN bus is able to learn     of uninitialized stack values by dumbing messages on the can bus. (CVE-2021-34693)

    An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux     kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a     system crash or a leak of internal kernel information. The highest threat from this vulnerability is to     system availability. (CVE-2021-3506)

    A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. (CVE-2021-3564)

    A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in     the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call     hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(),     hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system     or escalate their privileges on the system. (CVE-2021-3573)

    A flaw was found in the Linux kernels NFC implementation, A NULL pointer dereference and BUG leading to a     denial of service can be triggered by a local unprivileged user causing a kernel panic. (CVE-2021-38208)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: fix info leak in hid_submit_ctrl

    In hid_submit_ctrl(), the way of calculating the report length doesn'ttake into account that report->size     can be zero. When running thesyzkaller reproducer, a report of size 0 causes hid_submit_ctrl) tocalculate     transfer_buffer_length as 16384. When this urb is passed tothe usb core layer, KMSAN reports an info leak     of 16384 bytes.

    To fix this, first modify hid_report_len() to account for the zeroreport size case by using DIV_ROUND_UP     for the division. Then, call itfrom hid_submit_ctrl(). (CVE-2021-46906)

    In the Linux kernel, the following vulnerability has been resolved:

    dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (CVE-2021-46938)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: properly indicate failure when ending a failed write request

    This patch addresses a data corruption bug in raid1 arrays using bitmaps.Without this fix, the bitmap bits     for the failed I/O end up being cleared.

    Since we are in the failure leg of raid1_end_write_request, the requesteither needs to be retried     (R1BIO_WriteError) or failed (R1BIO_Degraded). (CVE-2021-46950)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: efi: Use local variable for calculating final log size (CVE-2021-46951)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (CVE-2021-46953)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: fix stack OOB read while fragmenting IPv4 packets (CVE-2021-46955)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix memory leak in virtio_fs_probe() (CVE-2021-46956)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: Fix use-after-free with devm_spi_alloc_* (CVE-2021-46959)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Return correct error code from smb2_get_enc_key (CVE-2021-46960)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Do not enable irqs when handling spurious interrups (CVE-2021-46961)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() (CVE-2021-46963)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: Fix NULL pointer in flush_workqueue (CVE-2021-46981)

    In the Linux kernel, the following vulnerability has been resolved:

    kyber: fix out of bounds access when preempted (CVE-2021-46984)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: scan: Fix a memory leak in an error handling path (CVE-2021-46985)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: release page in error path to avoid BUG_ON (CVE-2021-46988)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: prevent corruption in shrinking truncate (CVE-2021-46989)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix use-after-free in i40e_client_subtask() (CVE-2021-46991)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: avoid overflows in nft_hash_buckets() (CVE-2021-46992)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix out-of-bound access in uclamp (CVE-2021-46993)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: do asoc update earlier in sctp_sf_do_dupcook_a (CVE-2021-46999)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix inode leak on getattr error in __fh_to_dentry (CVE-2021-47000)

    In the Linux kernel, the following vulnerability has been resolved:

    ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook (CVE-2021-47006)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Only allow init netns to set default tcp cong to a restricted algo (CVE-2021-47010)

    In the Linux kernel, the following vulnerability has been resolved:

    net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Fix RX consumer index logic in the error path. (CVE-2021-47015)

    In the Linux kernel, the following vulnerability has been resolved:

    bus: qcom: Put child node before return (CVE-2021-47054)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: set debugfs_name to NULL after it is freed (CVE-2021-47058)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Stop looking for coalesced MMIO zones if the bus is destroyed (CVE-2021-47060)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Fix a memory leak in error handling paths (CVE-2021-47071)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Clear all QP fields if creation failed (CVE-2021-47078)

    In the Linux kernel, the following vulnerability has been resolved:

    neighbour: allow NUD_NOARP entries to be forced GCed (CVE-2021-47109)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Disable kvmclock on all CPUs on shutdown (CVE-2021-47110)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Teardown PV features on boot CPU as well (CVE-2021-47112)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed (CVE-2021-47117)

    In the Linux kernel, the following vulnerability has been resolved:

    pid: take a reference when initializing `cad_pid` (CVE-2021-47118)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: magicmouse: fix NULL-deref on disconnect (CVE-2021-47120)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (CVE-2021-47126)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: skip expectations for confirmed conntrack (CVE-2021-47129)

    In the Linux kernel, the following vulnerability has been resolved:

    cxgb4: avoid accessing registers when clearing filters (CVE-2021-47138)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix a use-after-free (CVE-2021-47142)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not BUG_ON in link_to_fixup_dir (CVE-2021-47145)

    In the Linux kernel, the following vulnerability has been resolved:

    mld: fix panic in mld_newpack() (CVE-2021-47146)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: fix a crash if ->get_sset_count() fails (CVE-2021-47159)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: skb_linearize the head skb when reassembling msgs (CVE-2021-47162)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: wait and exit until all work queues are done (CVE-2021-47163)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() (CVE-2021-47166)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (CVE-2021-47167)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: fix an incorrect limit in filelayout_decode_layout() (CVE-2021-47168)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: usbfs: Don't WARN about excessively large memory allocations (CVE-2021-47170)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix sysfs leak in alloc_iommu() (CVE-2021-47177)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst refcnt when egressing (CVE-2021-47222)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst null pointer dereference (CVE-2021-47223)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Immediately reset the MMU context when the SMM flag is cleared (CVE-2021-47230)

    In the Linux kernel, the following vulnerability has been resolved:

    net: cdc_eem: fix tx fixup skb leak (CVE-2021-47236)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in ip_mc_add1_src (CVE-2021-47238)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: synproxy: Fix out of bounds when parsing TCP options (CVE-2021-47245)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix page reclaim for dead peer hairpin (CVE-2021-47246)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: fix race between close() and udp_abort() (CVE-2021-47248)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: fix memory leak in rds_recvmsg (CVE-2021-47249)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in netlbl_cipsov4_add_std (CVE-2021-47250)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix use-after-free in gfs2_glock_shrink_scan (CVE-2021-47254)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: LAPIC: Restore guard to prevent illegal APIC register access (CVE-2021-47255)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: make sure wait for page writeback in memory_failure (CVE-2021-47256)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix error handling of scsi_host_alloc() (CVE-2021-47258)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix use-after-free in nfs4_init_client() (CVE-2021-47259)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a potential NULL dereference in nfs_get_client() (CVE-2021-47260)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/mlx5: Fix initializing CQ fragments buffer (CVE-2021-47261)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message (CVE-2021-47262)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ipoib: Fix warning caused by destroying non-initial netns (CVE-2021-47266)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Correct the length check which causes memory corruption (CVE-2021-47274)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Do not blindly read the ip address in ftrace_bug() (CVE-2021-47276)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: avoid speculation-based attacks from out-of-range memslot accesses (CVE-2021-47277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix use-after-free read in drm_getunique() (CVE-2021-47280)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0434 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-42104:
    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: add missing check for inode numbers on directory entries

    Syzbot reported that mounting and unmounting a specific pattern of     corrupted nilfs2 filesystem images causes a use-after-free of metadata     file inodes, which triggers a kernel bug in lru_add_fn().

    As Jan Kara pointed out, this is because the link count of a metadata file     gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(),     tries to delete that inode (ifile inode in this case).

    The inconsistency occurs because directories containing the inode numbers     of these metadata files that should not be visible in the namespace are     read without checking.

    Fix this issue by treating the inode numbers of these internal files as     errors in the sanity check helper when reading directory folios/pages.

    Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer     analysis.

    CVE-2024-38599:
    In the Linux kernel, the following vulnerability has been resolved:

    jffs2: prevent xattr node from overflowing the eraseblock

    Add a check to make sure that the requested xattr node size is no larger     than the eraseblock minus the cleanmarker.

    Unlike the usual inode nodes, the xattr nodes aren't split into parts     and spread across multiple eraseblocks, which means that a xattr node     must not occupy more than one eraseblock. If the requested xattr value is     too large, the xattr node can spill onto the next eraseblock, overwriting     the nodes and causing errors such as:

    jffs2: argh. node added in wrong place at 0x0000b050(2)     jffs2: nextblock 0x0000a000, expected at 0000b00c     jffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050,     read=0xfc892c93, calc=0x000000     jffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed     at 0x01e00c. {848f,2fc4,0fef511f,59a3d171}     jffs2: Node at 0x0000000c with length 0x00001044 would run over the     end of the erase block     jffs2: Perhaps the file system was created with the wrong erase size?     jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found     at 0x00000010: 0x1044 instead

    This breaks the filesystem and can lead to KASAN crashes such as:

    BUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0     Read of size 4 at addr ffff88802c31e914 by task repro/830     CPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),     BIOS Arch Linux 1.16.3-1-1 04/01/2014     Call Trace:
     <TASK>      dump_stack_lvl+0xc6/0x120      print_report+0xc4/0x620      ? __virt_addr_valid+0x308/0x5b0      kasan_report+0xc1/0xf0      ? jffs2_sum_add_kvec+0x125e/0x15d0      ? jffs2_sum_add_kvec+0x125e/0x15d0      jffs2_sum_add_kvec+0x125e/0x15d0      jffs2_flash_direct_writev+0xa8/0xd0      jffs2_flash_writev+0x9c9/0xef0      ? __x64_sys_setxattr+0xc4/0x160      ? do_syscall_64+0x69/0x140      ? entry_SYSCALL_64_after_hwframe+0x76/0x7e      [...]

    Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

    CVE-2024-38583:
    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of timer for log writer thread

    Patch series nilfs2: fix log writer related issues.

    This bug fix series covers three nilfs2 log writer-related issues,     including a timer use-after-free issue and potential deadlock issue on     unmount, and a potential freeze issue in event synchronization found     during their analysis.  Details are described in each commit log.


    This patch (of 3):

    A use-after-free issue has been reported regarding the timer sc_timer on     the nilfs_sc_info structure.

    The problem is that even though it is used to wake up a sleeping log     writer thread, sc_timer is not shut down until the nilfs_sc_info structure     is about to be freed, and is used regardless of the thread's lifetime.

    Fix this issue by limiting the use of sc_timer only while the log writer     thread is alive.

    CVE-2024-36964:
    In the Linux kernel, the following vulnerability has been resolved:

    fs/9p: only translate RWX permissions for plain 9P2000

    Garbage in plain 9P2000's perm bits is allowed through, which causes it     to be able to set (among others) the suid bit. This was presumably not     the intent since the unix extended bits are handled explicitly and     conditionally on .u.

    CVE-2021-47505:
    In the Linux kernel, the following vulnerability has been resolved:

    aio: fix use-after-free due to missing POLLFREE handling

    signalfd_poll() and binder_poll() are special in that they use a     waitqueue whose lifetime is the current task, rather than the struct     file as is normally the case.  This is okay for blocking polls, since a     blocking poll occurs within one task; however, non-blocking polls     require another solution.  This solution is for the queue to be cleared     before it is freed, by sending a POLLFREE notification to all waiters.

    Unfortunately, only eventpoll handles POLLFREE.  A second type of     non-blocking poll, aio poll, was added in kernel v4.18, and it doesn't     handle POLLFREE.  This allows a use-after-free to occur if a signalfd or     binder fd is polled with aio poll, and the waitqueue gets freed.

    Fix this by making aio poll handle POLLFREE.

    A patch by Ramji Jiyani <ramjiyani@google.com>     (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)     tried to do this by making aio_poll_wake() always complete the request     inline if POLLFREE is seen.  However, that solution had two bugs.
    First, it introduced a deadlock, as it unconditionally locked the aio     context while holding the waitqueue lock, which inverts the normal     locking order.  Second, it didn't consider that POLLFREE notifications     are missed while the request has been temporarily de-queued.

    The second problem was solved by my previous patch.  This patch then     properly fixes the use-after-free by handling POLLFREE in a     deadlock-free way.  It does this by taking advantage of the fact that     freeing of the waitqueue is RCU-delayed, similar to what eventpoll does.

    CVE-2021-46993:
    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix out-of-bound access in uclamp

    Util-clamp places tasks in different buckets based on their clamp values     for performance reasons. However, the size of buckets is currently     computed using a rounding division, which can lead to an off-by-one     error in some configurations.

    For instance, with 20 buckets, the bucket size will be 1024/20=51. A     task with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,     correct indexes are in range [0,19], hence leading to an out of bound     memory access.

    Clamp the bucket id to fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: sched: Fix out-of-bound access in     uclamp Util-clamp places tasks in different buckets based on their clamp values for performance reasons.
    However, the size of buckets is currently computed using a rounding division, which can lead to an off-by-     one error in some configurations. For instance, with 20 buckets, the bucket size will be 1024/20=51. A     task with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly, correct indexes are in range     [0,19], hence leading to an out of bound memory access. Clamp the bucket id to fix the issue.
    (CVE-2021-46993)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
275982	TencentOS Server 2: kernel (TSSA-2025:0436)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	high
160440	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-004 (ALASKERNEL-5.4-2022-004)	Nessus	Amazon Linux Local Security Checks	5/2/2022	2/9/2026	high
160459	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-002 (ALASKERNEL-5.10-2022-002)	Nessus	Amazon Linux Local Security Checks	5/2/2022	2/9/2026	high
276021	TencentOS Server 3: kernel (TSSA-2025:0434)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	high
246304	Linux Distros Unpatched Vulnerability : CVE-2021-46993	Nessus	Misc.	8/8/2025	11/25/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high