The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987661 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to do sanity check on curseg->alloc_type

    As Wenqing Liu reported in bugzilla:

    https://bugzilla.kernel.org/show_bug.cgi?id=215657

    - Overview     UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image

    - Reproduce     tested on kernel 5.17-rc4, 5.17-rc6

    1. mkdir test_crash     2. cd test_crash     3. unzip tmp2.zip     4. mkdir mnt     5. ./single_test.sh f2fs 2

    - Kernel dump     [   46.434454] loop0: detected capacity change from 0 to 131072     [   46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9     [   46.738319] ================================================================================     [   46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2     [   46.738475] index 231 is out of range for type 'unsigned int [2]'     [   46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1     [   46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014     [   46.738551] Call Trace:
    [   46.738556]  <TASK>     [   46.738563]  dump_stack_lvl+0x47/0x5c     [   46.738581]  ubsan_epilogue+0x5/0x50     [   46.738592]  __ubsan_handle_out_of_bounds+0x68/0x80     [   46.738604]  f2fs_allocate_data_block+0xdff/0xe60 [f2fs]     [   46.738819]  do_write_page+0xef/0x210 [f2fs]     [   46.738934]  f2fs_do_write_node_page+0x3f/0x80 [f2fs]     [   46.739038]  __write_node_page+0x2b7/0x920 [f2fs]     [   46.739162]  f2fs_sync_node_pages+0x943/0xb00 [f2fs]     [   46.739293]  f2fs_write_checkpoint+0x7bb/0x1030 [f2fs]     [   46.739405]  kill_f2fs_super+0x125/0x150 [f2fs]     [   46.739507]  deactivate_locked_super+0x60/0xc0     [   46.739517]  deactivate_super+0x70/0xb0     [   46.739524]  cleanup_mnt+0x11a/0x200     [   46.739532]  __cleanup_mnt+0x16/0x20     [   46.739538]  task_work_run+0x67/0xa0     [   46.739547]  exit_to_user_mode_prepare+0x18c/0x1a0     [   46.739559]  syscall_exit_to_user_mode+0x26/0x40     [   46.739568]  do_syscall_64+0x46/0xb0     [   46.739584]  entry_SYSCALL_64_after_hwframe+0x44/0xae

    The root cause is we missed to do sanity check on curseg->alloc_type,     result in out-of-bound accessing on sbi->block_count[] array, fix it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - f2fsccurseg->alloc_type でサニティチェックを行うように修正します Wenqing Liu 氏が bugzilla で報告したもの
    https://bugzilla.kernel.org/show_bug.cgi?id=215657 - 概要 UBSAN: array-index-out-of-bounds 破損したイメージをマウントして操作するときの fs/f2fs/segment.c:3460:2 の [] - カーネル 5.17-rc4、5.17-rc6 でテストされたものを再生成 1. mkdir test_crash 2. cd test_crash 3. unzip tmp2.zip 4. mkdir mnt 5. ./single_test.sh f2fs 2 - カーネルダンプ [ 46.434454] loop00 から 131072 の能力変更を検出しました [ 46.529839] F2FS-fsloop0
    チェックポイントバージョン = 7548c2d9 でマウントされています 46.738319] ============================================ ============================================================== [ 46.738412] UBSAN
    array-index-out-of-bounds fs/f2fs/segment.c:3460:2 の [ 46.738475 ] インデックス 231 はタイプ「unsigned int [2]」の範囲外です [ 46.738539] CPU2 PID939 通信umount 5.17 に汚染されていません。 0-rc6 #1 [ 46.738547] ハードウェア名 QEMU Standard PCQ35 + ICH9、2009、BIOS 1.13.0-1ubuntu1.1 2014 年 4 月 1 日 [ 46.738551] コールトレース [ 46.738556] <TASK> [ 46.738563dump_stack_lvl+0x47/0x5c [ 46.738581] ubsan_epilog+0x5/0x5046.738592__ubsan_handle_out_of_bounds+0x68/0x80 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs] [] 46.738819] do_write_page+0xef/0x10100000000000000000000 ] 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs] [46.739038] __write_node_page+0x2b7/0x920 [f2fs] [ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs] []46.739293f2fs_write_checkpoint+0x7bb/0x10300000000000000000000000000000000000000000000000000 46.739405] kill_f2fs_super+0x125/0x150 [f2fs] [46.739507] deactivate_locked_super+0x60/0xc0 46.739517deactivate_super+0x70/0xb0 [ 46.739524] cleanup_mnt+0x11a/0x200 [ 46.739532] __cleanup_mnt+0x16/0x20 [ 46.739538task_work_run+0x67/0xa0 [46.739547] exit_to_user_mode_prepare+0x18c/0x1a0 [ 46.739559] syscall_exit_to_user_mode+0x26/0x40 [46.739568] do_syscall_64+0x46/0xb0 [ 46.739584] e ntry_SYSCALL_64_after_hwframe+0x44/0xae 原因は次のとおりです。curseg->alloc_type のサニティチェックを行うことに失敗していました。この結果、sbi->block_count[] 配列で領域外アクセスが発生し、それを修正します。CVE-2022-49170

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - f2fs修正以對 curseg->alloc_type 進行功能健全檢查。如 Wenqing Liu 在 bugzilla 中所報告
    https://bugzilla.kernel.org/show_bug.cgi?id=215657 - 掛載和操作損毀影像時fs/f2fs/segment.c:3460:2 中的 UBSAN 概覽 array-index-out-of-bounds - 在核心 5.17-rc4、5.17-rc6 上測試的複製品1. mkdir test_crash 2. cd test_crash 3. unzip tmp2.zip 4. mkdir mnt 5. ./single_test.sh f2fs 2 - 核心轉儲存 [ 46.434454] loop0偵測到從 0 到 131072 的容量變更 [ 46.529839] F2FS-fs (loop0)
    以檢查點版本 = 7548c2d9 掛載 [ 46.738319] ======================================== ======================================== [ 46.738412] UBSAN
    array-index-out-of-bounds 在 fs/f2fs/segment.c:3460:2 中 [ 46.738475] 索引 231 超出類型 'unsigned int [2]' 的範圍 [ 46.738539] CPU2 PID939 通訊卸載未受污染 5.17。 0-rc6 #1 [ 46.738547] 硬體名稱QEMU Standard PC (Q35 + ICH9, 2009)BIOS 1.13.0-1ubuntu1.1 2014 年 4 月 1 日 [ 46.738551] 呼叫追踪 [ 46.738556] <TASK> [ 46.738563] dump_stack_lvl+0x47/0x5c [ 46.738581] ubsan_epilogue+0x5/0x50 [46.738592] __ubsan_handle_out_of_bounds+0x68/0x80 [ 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs] [ 46.738819] do_write_page+0xef/0x210 [f2fs ] [ 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs] [46.739038] __write_node_page+0x2b7/0x920 [f2fs] [ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs] [46.739293] f2fs_write_checkpoint+0x7bb/0x1030 [f2f7bb/0x1030s] 46.739405] kill_f2fs_super+0x125/0x150 [f2fs] [46.739507] deactivate_locked_super+0x60/0xc0 [ 46.739517] deactivate_super+0x70/0xb0 [ 46.739524] cleanup_mnt+0x11a/0x200 [ 46.739532] __cleanup_mnt+0x16/0x20 [ 46.739538] task_work_run+0x67/0xa0 [46.739547] exit_to_user_mode_prepare+0x18c/0x1a0 [ 46.739559] syscall_exit_to_user_mode+0x26/0x40 [46.739568] do_syscall_64+0x46/0xb0 [ 46.739584] e ntry_SYSCALL_64_after_hwframe+0x44/0xae 根本原因是我們未對 curseg->alloc_type 執行功能健全檢查導致在 sbi->block_count[] 陣列上發生超出邊界存取請將其修正。 (CVE-2022-49170)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - f2fs已修复以对 curleg->alloc_type 进行健全性检查按照 Wenqing Liu 在 bugzilla 中的报告
    https://bugzilla.kernel.org/show_bug.cgi?id=215657 - UBSAN 概览挂载并操作损坏的图像时 fs/f2fs/segment.c:3460:2 中的 array-index-out-of-bounds ] - 已在 kernel 5.17-rc4、5.17-rc6 1. mkdir test_crash 2. cd test_crash 3. unzip 上进行测试。 tmp2.zip 4. mkdir mnt 5. ./single_test.sh f2fs 2 - 内核转储 [ 46.434454] loop0检测到的容量从 0 变更为 131072 [ 46.529839] F2FS-fs (loop0)
    挂载了检查点版本 = 7548c2d9 [ 46.738319] ======================================== ======================================== [ 46.738412] UBSAN
    fs/f2fs/segment.c:3460:2 中的array-index-out-of-bounds [ 46.738475] 索引 231 超出类型“unsigned int [2]”的范围 [ 46.738539] CPU: 2 PID: 939 Commumount 未受感染 5.17. 0-rc6 #1 [ 46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 46.738551] Call Trace[ 46.738556] <TASK> [ 46.738563] dump_stack_lvl+0x47/0x5c [ 46.738581] ubsan_epilogue+0x5/0x50 [46.738592] __ubsan_handle_out_of_bounds+0x68/0x80 [ 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs] [ 46.738819] do_write_page+0xef/0x210 [f2fs] ] [ 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs] [46.739038] __write_node_page+0x2b7/0x920 [f2fs] [ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs] [46.739293] f2fs_write_checkpoint+0x7bb/0x1030 [f2fs_write_checkpoint+0x7bb/0x1030 [f2fs] 46.739405] kill_f2fs_super+0x125/0x150 [f2fs] [46.739507] deactivate_locked_super+0x60/0xc0 [ 46.739517] deactivate_super+0x70/0xb0 [ 46.739524] cleanup_mnt+0x11a/0x200 [ 46.739532] __cleanup_mnt+0x16/0x20 [ 46.739538] task_work_run+0x67/0xa0 [46.739547] exit_to_user_mode_prepare+0x18c/0x1a0 [ 46.739559] syscall_exit_to_user_mode+0x26/0x40 [46.739568] do_syscall_64+0x46/0xb0 [ 46.739584] e ntry_SYSCALL_64_after_hwframe+0x44/0xae 的根本原因是我们缺少对 curleg->alloc_type 进行健全性检查导致对 sbi->block_count[] 数组进行越界访问修复之。 (CVE-2022-49170)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - f2fs: fix to do sanity check on curseg->alloc_type As Wenqing Liu reported in bugzilla:
    https://bugzilla.kernel.org/show_bug.cgi?id=215657 - Overview UBSAN: array-index-out-of-bounds in     fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image - Reproduce tested on kernel 5.17-rc4,     5.17-rc6 1. mkdir test_crash 2. cd test_crash 3. unzip tmp2.zip 4. mkdir mnt 5. ./single_test.sh f2fs 2 -     Kernel dump [ 46.434454] loop0: detected capacity change from 0 to 131072 [ 46.529839] F2FS-fs (loop0):
    Mounted with checkpoint version = 7548c2d9 [ 46.738319]     ================================================================================ [ 46.738412] UBSAN:
    array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 [ 46.738475] index 231 is out of range for type     'unsigned int [2]' [ 46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1 [ 46.738547]     Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 46.738551] Call     Trace: [ 46.738556] <TASK> [ 46.738563] dump_stack_lvl+0x47/0x5c [ 46.738581] ubsan_epilogue+0x5/0x50 [     46.738592] __ubsan_handle_out_of_bounds+0x68/0x80 [ 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs]     [ 46.738819] do_write_page+0xef/0x210 [f2fs] [ 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs] [     46.739038] __write_node_page+0x2b7/0x920 [f2fs] [ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs] [     46.739293] f2fs_write_checkpoint+0x7bb/0x1030 [f2fs] [ 46.739405] kill_f2fs_super+0x125/0x150 [f2fs] [     46.739507] deactivate_locked_super+0x60/0xc0 [ 46.739517] deactivate_super+0x70/0xb0 [ 46.739524]     cleanup_mnt+0x11a/0x200 [ 46.739532] __cleanup_mnt+0x16/0x20 [ 46.739538] task_work_run+0x67/0xa0 [     46.739547] exit_to_user_mode_prepare+0x18c/0x1a0 [ 46.739559] syscall_exit_to_user_mode+0x26/0x40 [     46.739568] do_syscall_64+0x46/0xb0 [ 46.739584] entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is     we missed to do sanity check on curseg->alloc_type, result in out-of-bound accessing on sbi->block_count[]     array, fix it. (CVE-2022-49170)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988914 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to do sanity check on curseg->alloc_type

    As Wenqing Liu reported in bugzilla:

    https://bugzilla.kernel.org/show_bug.cgi?id=215657

    - Overview     UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image

    - Reproduce     tested on kernel 5.17-rc4, 5.17-rc6

    1. mkdir test_crash     2. cd test_crash     3. unzip tmp2.zip     4. mkdir mnt     5. ./single_test.sh f2fs 2

    - Kernel dump     [   46.434454] loop0: detected capacity change from 0 to 131072     [   46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9     [   46.738319] ================================================================================     [   46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2     [   46.738475] index 231 is out of range for type 'unsigned int [2]'     [   46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1     [   46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014     [   46.738551] Call Trace:
    [   46.738556]  <TASK>     [   46.738563]  dump_stack_lvl+0x47/0x5c     [   46.738581]  ubsan_epilogue+0x5/0x50     [   46.738592]  __ubsan_handle_out_of_bounds+0x68/0x80     [   46.738604]  f2fs_allocate_data_block+0xdff/0xe60 [f2fs]     [   46.738819]  do_write_page+0xef/0x210 [f2fs]     [   46.738934]  f2fs_do_write_node_page+0x3f/0x80 [f2fs]     [   46.739038]  __write_node_page+0x2b7/0x920 [f2fs]     [   46.739162]  f2fs_sync_node_pages+0x943/0xb00 [f2fs]     [   46.739293]  f2fs_write_checkpoint+0x7bb/0x1030 [f2fs]     [   46.739405]  kill_f2fs_super+0x125/0x150 [f2fs]     [   46.739507]  deactivate_locked_super+0x60/0xc0     [   46.739517]  deactivate_super+0x70/0xb0     [   46.739524]  cleanup_mnt+0x11a/0x200     [   46.739532]  __cleanup_mnt+0x16/0x20     [   46.739538]  task_work_run+0x67/0xa0     [   46.739547]  exit_to_user_mode_prepare+0x18c/0x1a0     [   46.739559]  syscall_exit_to_user_mode+0x26/0x40     [   46.739568]  do_syscall_64+0x46/0xb0     [   46.739584]  entry_SYSCALL_64_after_hwframe+0x44/0xae

    The root cause is we missed to do sanity check on curseg->alloc_type,     result in out-of-bound accessing on sbi->block_count[] array, fix it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
270964	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987661)	Nessus	Unity Linux Local Security Checks	10/21/2025	10/21/2025	high
225698	Linux Distros のパッチ未適用の脆弱性: CVE-2022-49170	Nessus	Misc.	3/5/2025	10/28/2025	high
225698	Linux Distros 未修補的弱點：CVE-2022-49170	Nessus	Misc.	3/5/2025	10/28/2025	high
225698	Linux Distros 未修补的漏洞：CVE-2022-49170	Nessus	Misc.	3/5/2025	10/28/2025	high
225698	Linux Distros Unpatched Vulnerability : CVE-2022-49170	Nessus	Misc.	3/5/2025	10/28/2025	high
273701	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988914)	Nessus	Unity Linux Local Security Checks	11/5/2025	11/5/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high