Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - net/schedFlower修复过滤器 idr 初始化 引用的提交在 fl_change() 中过早移动 idr 初始化其允许并发用户访问仍在初始化且状态不一致的过滤器反过来可导致 NULL指针取消引用 [0]。由于没有明显的方法在不恢复整个引用的提交的情况下修复排序因此采取了首先将空指针插入 idr 中的替代方法以便分配句柄但仍然导致 fl_get() 返回 NULL 并阻止并发用户查看过滤器同时在 fl_change() 中及早提供具有有效句柄 ID 的未执行操作基础架构。 [ 152.434728] 一般保护错误可能是非规范地址 0xdffffc0000000000: 0000 [#1] SMP KASAN [ 152.436163] KASAN: 范围 [0x0000000000000000-0x0000000000000007] 中存在 null-ptr-deref [ 152.437269] CPU: 4 PID 3877 Commtc Not tainted 6.3.0-rc4+ #5 [ 152.438110] Hardware nameQEMU Standard PC (Q35 + ICH9, 2009)BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/ 01/2014 [ 152.439644] RIP0010:fl_dump_key+0x8b/0x1d10 [cls_Flower] [ 152.440461] Code01 f2 02 f2 c7 40 08 04 f2 04 f2 c7 40 0c 04 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 84 24 00 01 00 00 48 89 c8 48 c1 e8 03 <0f> b6 04 10 84 c0 74 08 3c 03 0f 8e 98 19 00 00 8b 13 85 d2 74 57 [ 152.442885] RSP: 00818:ffLAff158 00010246 [ 152.443851] RAX
    0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 152.444826] RDX: dffffc0000000000 RSI
    ffffffff8500ae80 RDIffff88810a987900 [ 152.445791] RBPffff888179d88240 R08ffff888179d8845c R09
    ffff888179d88240 [ 152.446780] R10] ffffed102f451e48 R11] 00000000ffffff2 R12: ffff88810a987900 [152.447741] R13: ffffffff8500ae80 R14: ffff88810a987900 R15: ffff38814 [FS] 152.44875689b [FS ] 88810a987900
    00007f5eb2a34800(0000) GS:ffff88881ec00000(0000) knlGS:0000000000000000 [ 152.449888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 152.450685] CR2: 000000000046ad19 CR3: 000000010b0bd006 CR4:
    0000000000370ea0 [ 152.451641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [152.452628] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 152.453588] Call Trace: [152.454032] <TASK> [ 152.454447] ? netlink_sendmsg+0x7a1/0xcb0 [ 152.455109] ? sock_sendmsg+0xc5/0x190 [152.455689] ? ____sys_sendmsg+0x535/0x6b0 [ 152.456320] ? ___sys_sendmsg+0xeb/0x170 [ 152.456916] ? do_syscall_64+0x3d/0x90 [ 152.457529] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.458321] ?
    ___sys_sendmsg+0xeb/0x170 [ 152.458958] ? __sys_sendmsg+0xb5/0x140 [ 152.459564] ? do_syscall_64+0x3d/0x90 [ 152.460122] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.460852] ? fl_dump_key_options.part.0+0xea0/0xea0 [cls_Flower] [ 152.461710] ? _raw_spin_lock+0x7a/0xd0 [ 152.462299] ? _raw_read_lock_irq+0x30/0x30 [ 152.462924] nla_put+0x15e/0x1c0 [ 152.463480] fl_dump+0x228/0x650 [cls_Flower] [ 152.464112] ? fl_tmplt_dump+0x210/0x210 [cls_Flower] [ 152.464854]
    __kmem_cache_alloc_node+0x1a7/0x330 [ 152.465592] ? nla_put+0x15e/0x1c0 [ 152.466160] tcf_fill_node+0x515/0x9a0 [ 152.466766] ? tc_setup_offload_action+0xf0/0xf0 [ 152.467463]
    __alloc_skb+0x13c/0x2a0 [ 152.468067] ? __build_skb_around+0x330/0x330 [ 152.468814] ? fl_get+0x107/0x1a0 [cls_Flower] [ 152.469503] tc_del_tfilter+0x718/0x1330 [ 152.470115] ? is_bpf_text_address+0xa/0x20 [152.470765] ? tc_ctl_chain+0xee0/0xee0 [ 152.471335] ? __kernel_text_address+0xe/0x30 [ 152.471948] ? unwind_get_return_address+0x56/0xa0 [ 152.472639] ? __thaw_task+0x150/0x150 [ 152.473218] ? arch_stack_walk+0x98/0xf0 [ 152.473839] ? __stack_depot_save+0x35/0x4c0 [ 152.474501] ? stack_trace_save+0x91/0xc0 [ 152.475119] ? security_capable+0x51/0x90 [ 152.475741] rtnetlink_rcv_msg+0x2c1/0x9d0 [ 152.476387] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 152.477042] ---truncated--- (CVE-2023-54206)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - net/schedFlower修正篩選器 idr 初始化 引用的認可過早移動 fl_change() 中的 idr 初始化其允許並行使用者存取仍在初始化且處於不一致狀態的篩選器進而可造成 NULL指標解除參照 [0]。由於在不還原整個引用認可的情況下沒有明顯的方式可修正排序因此採取替代方法先將 NULL 指標插入 idr 以便配置處理但仍會造成 fl_get() 傳回 NULL 並防止並行使用者查看篩選同時在 fl_change() 中提早提供具有有效處理 id 的「遺漏動作」基礎結構。 [ 152.434728] 一般保護錯誤可能針對非正式位址 0xdffffc0000000000: 0000 [#1] SMP KASAN [ 152.436163] KASAN null-ptr-deref in 範圍 [0x0000000000000000-0x0000000000000007] [ 152.437269] CPU4 PID 3877 Commtc 未受污染的 6.3.0-rc4+ #5 [ 152.438110] 硬體名稱QEMU Standard PC (Q35 + ICH9, 2009)BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/ 01/2014 [ 152.439644] RIP 0010:fl_dump_key+0x8b/0x1d10 [cls_flow] [ 152.440461] 代碼01 f2 02 f2 c7 40 08 04 f2 04 f2 c7 40 0c 04 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 84 24 00 01 00 00 48 89 c8 48 c1 e8 03 <0f> b6 04 10 84 c0 74 08 3c 03 0f 8e 98 19 00 00 8b 13 85 d2 74 57 [ 152.442885] RSP001815888817ffa 888817ff 00010246 [ 152.443851] RAX
    0000000000000000 RBX0000000000000000 RCX0000000000000000 [ 152.444826] RDXdffffc0000000000 RSI
    ffffffff8500ae80 RDIffff88810a987900 [ 152.445791] RBPffff888179d88240 R08ffff888179d8845c R09
    ffff888179d88240 [ 152.446780] R10: ffffed102f451e48 R11: 00000000fffffff2 R12: ffff88810a987900 [152.447741] R13: ffffffff8500ae80 R14: ffff88810a987900 R15: ffff888149b3c738 [ 152.448756] FS:
    00007f5eb2a34800(0000) GS:ffff88881ec00000(0000) knlGS:0000000000000000 [ 152.449888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 152.450685] CR2: 000000000046ad19 CR3: 000000010b0bd006 CR4:
    0000000000370ea0 [ 152.451641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [152.452628] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 152.453588] Call Trace: [152.454032] <TASK> [ 152.454447] ? netlink_sendmsg+0x7a1/0xcb0 [ 152.455109] ? sock_sendmsg+0xc5/0x190 [152.455689] ? ____sys_sendmsg+0x535/0x6b0 [ 152.456320] ? ___sys_sendmsg+0xeb/0x170 [ 152.456916] ? do_syscall_64+0x3d/0x90 [ 152.457529] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.458321] ?
    ___sys_sendmsg+0xeb/0x170 [ 152.458958] ? __sys_sendmsg+0xb5/0x140 [ 152.459564] ? do_syscall_64+0x3d/0x90 [ 152.460122] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.460852] ? fl_dump_key_options.part.0+0xea0/0xea0 [cls_flow] [ 152.461710] _raw_spin_lock+0x7a/0xd0 [ 152.462299] ? _raw_read_lock_irq+0x30/0x30 [ 152.462924] ? nla_put+0x15e/0x1c0 [ 152.463480] fl_dump+0x228/0x650 [cls_flow] [ 152.464112] ? fl_tmplt_dump+0x210/0x210 [cls_flow] [ 152.464854]
    __kmem_cache_alloc_node+0x1a7/0x330 [ 152.465592] nla_put+0x15e/0x1c0 [ 152.466160] tcf_fill_node+0x515/0x9a0 [ 152.466766] ? tc_setup_offload_action+0xf0/0xf0 [ 152.467463] ?
    __alloc_skb+0x13c/0x2a0 [ 152.468067] ? __build_skb_around+0x330/0x330 [ 152.468814] ? fl_get+0x107/0x1a0 [cls_flow] [ 152.469503] tc_del_tfilter+0x718/0x1330 [ 152.470115] ? is_bpf_text_address+0xa/0x20 [152.470765] ? tc_ctl_chain+0xee0/0xee0 [ 152.471335] ? __kernel_text_address+0xe/0x30 [ 152.471948] ? unwind_get_return_address+0x56/0xa0 [ 152.472639] ? __thaw_task+0x150/0x150 [ 152.473218] ? arch_stack_walk+0x98/0xf0 [ 152.473839] ? __stack_depot_save+0x35/0x4c0 [ 152.474501] ? stack_trace_save+0x91/0xc0 [ 152.475119] ? security_capable+0x51/0x90 [ 152.475741] rtnetlink_rcv_msg+0x2c1/0x9d0 [ 152.476387] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 152.477042] ---truncated--- (CVE-2023-54206)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - net/schedflowフィルター idr 初期化を修正します。引用されているコミットが fl_change() で idr 初期化を早すぎました。これにより、同時ユーザーが、まだ初期化されており、一貫性のない状態にあるフィルターにアクセスすることが可能です。これにより、NULL を引き起こす可能性がありますポインターデリファレンス [0]。引用されているコミット全体を取り消さずに順序を修正する明らかな方法はないため、ハンドルを割り当てるために、まず NULL ポインターを idr に挿入する代替アプローチが採用されています。ただし、fl_get() は NULL を返し、同時ユーザーがフィルターを閲覧できないようにします。 fl_change() で、有効なハンドル ID を使ってアクションに対応しないインフラストラクチャを提供することも可能です。 [ 152.434728] 一般保護違反。おそらく 152.436163非標準 152.437269的な#1アドレス用です 0xdffffc0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 3877 通信tc 汚染されていない 6.3.0-rc4+ #5152.438110] ハードウェア名QEMU Standard PCQ35 + ICH9、2009、BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/ 01/2014 [ 152.439644] RIP: 0010:fl_dump_key+0x8b/0x1d10 [cls_flow] [ 152.440461] コード: 01 f2 02 f2 c7 40 08 04 f2 04 f2 c7 40 0c 04 f3 f3 f3 65 48 8b 04 28 00 00 00 48 89 84 24 00 01 00 00 48 89 c8 48 c1 e8 03 <0f> b6 04 10 84 c0 74 08 3c 03 0f 8e 98 19 00 00 8b 13 85 d2 74 57 [ 152.442885] RSP : 0018 : ffff8817 00010246 [ 152.443851] RAX
    000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 152.444826] RDX: dffffc0000000000 RSI:
    ffffffff8500ae80 RDIffff88810a987900 [ 152.445791] RBP ffff888179d88240 R08ffff888179d8845c R09
    ffff888179d88240 152.446780、、、 ffffed102f451e48 R11R10、 00000000fffffff2 R12、ffff88810a987900 [ 152.448756、 ] R15、152.447741] ffffff8500ae80 R14R13、ffff88810a98790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    00007f5eb2a34800(0000) GS:ffff88881ec00000(0000) knlGS:0000000000000000 [ 152.449888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 152.450685] CR2: 000000000046ad19 CR3: 000000010b0bd006 CR4:
    0000000000370ea0 [ 152.451641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [152.452628] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 152.453588] Call Trace: [152.454032] <TASK> [ 152.454447] ? netlink_sendmsg+0x7a1/0xcb0 [ 152.455109] ? sock_sendmsg+0xc5/0x190 [152.455689] ? __sys_sendmsg+0x535/0x6b0 [ 152.456320] ? __sys_sendmsg+0xeb/0x170 [ 152.456916] ? do_syscall_64+0x3d/0x90 [ 152.457529] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.458321] ?
    __sys_sendmsg+0xeb/0x170 [ 152.458958] ? __sys_sendmsg+0xb5/0x140 [ 152.459564] ? do_syscall_64+0x3d/0x90 [ 152.460122] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.460852] ? fl_dump_key_options.part.0+0xea0/0xea0 [cls_flow] [ 152.461710] ? _raw_spin_lock+0x7a/0xd0 [ 152.462299] ? _raw_read_lock_irq+0x30/0x30 [ 152.462924] ? nla_put+0x15e/0x1c0 [ 152.463480] fl_dump+0x228/0x650 [cls_flow] [ 152.464112] ? fl_tmplt_dump+0x210/0x210 [cls_flow] [ 152.464854] ?
    __kmem_cache_alloc_node+0x1a7/0x330 152.465592] ? nla_put+0x15e/0x1c0 [ 152.466160] tcf_fill_node+0x515/0x9a0 [ 152.466766] ? tc_setup_offload_action+0xf0/0xf0 [ 152.467463] ?
    __alloc_skb+0x13c/0x2a0 [ 152.468067] ? __build_skb_around+0x330/0x330 152.468814] ? fl_get+0x107/0x1a0 [cls_flow] [ 152.469503] tc_del_tfilter+0x718/0x1330 [ 152.470115] ? is_bpf_text_address+0xa/0x20 [152.470765] ? tc_ctl_chain+0xee0/0xee0 [ 152.471335] ? __kernel_text_address+0xe/0x30 [ 152.471948] ? unwind_get_return_address+0x56/0xa0 [ 152.472639] ? __thaw_task+0x150/0x150 [ 152.473218] ? arch_stack_walk+0x98/0xf0 [ 152.473839] ? __stack_depot_save+0x35/0x4c0 [ 152.474501] ? stack_trace_save+0x91/0xc0 [ 152.475119] ? security_capable+0x51/0x90 [ 152.475741] rtnetlink_rcv_msg+0x2c1/0x9d0 [ 152.476387] ? rtnl_calcit.isra.0+0x2b0/0x2b0 152.477042] ---truncated---CVE-2023-54206]

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/sched: flower: fix filter idr initialization The cited commit moved idr initialization too early in     fl_change() which allows concurrent users to access the filter that is still being initialized and is in     inconsistent state, which, in turn, can cause NULL pointer dereference [0]. Since there is no obvious way     to fix the ordering without reverting the whole cited commit, alternative approach taken to first insert     NULL pointer into idr in order to allocate the handle but still cause fl_get() to return NULL and prevent     concurrent users from seeing the filter while providing miss-to-action infrastructure with valid handle id     early in fl_change(). [ 152.434728] general protection fault, probably for non-canonical address     0xdffffc0000000000: 0000 [#1] SMP KASAN [ 152.436163] KASAN: null-ptr-deref in range     [0x0000000000000000-0x0000000000000007] [ 152.437269] CPU: 4 PID: 3877 Comm: tc Not tainted 6.3.0-rc4+ #5     [ 152.438110] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS     rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 152.439644] RIP: 0010:fl_dump_key+0x8b/0x1d10     [cls_flower] [ 152.440461] Code: 01 f2 02 f2 c7 40 08 04 f2 04 f2 c7 40 0c 04 f3 f3 f3 65 48 8b 04 25 28     00 00 00 48 89 84 24 00 01 00 00 48 89 c8 48 c1 e8 03 <0f> b6 04 10 84 c0 74 08 3c 03 0f 8e 98 19 00 00 8b     13 85 d2 74 57 [ 152.442885] RSP: 0018:ffff88817a28f158 EFLAGS: 00010246 [ 152.443851] RAX:
    0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 152.444826] RDX: dffffc0000000000 RSI:
    ffffffff8500ae80 RDI: ffff88810a987900 [ 152.445791] RBP: ffff888179d88240 R08: ffff888179d8845c R09:
    ffff888179d88240 [ 152.446780] R10: ffffed102f451e48 R11: 00000000fffffff2 R12: ffff88810a987900 [     152.447741] R13: ffffffff8500ae80 R14: ffff88810a987900 R15: ffff888149b3c738 [ 152.448756] FS:
    00007f5eb2a34800(0000) GS:ffff88881ec00000(0000) knlGS:0000000000000000 [ 152.449888] CS: 0010 DS: 0000     ES: 0000 CR0: 0000000080050033 [ 152.450685] CR2: 000000000046ad19 CR3: 000000010b0bd006 CR4:
    0000000000370ea0 [ 152.451641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [     152.452628] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 152.453588] Call Trace: [     152.454032] <TASK> [ 152.454447] ? netlink_sendmsg+0x7a1/0xcb0 [ 152.455109] ? sock_sendmsg+0xc5/0x190 [     152.455689] ? ____sys_sendmsg+0x535/0x6b0 [ 152.456320] ? ___sys_sendmsg+0xeb/0x170 [ 152.456916] ?     do_syscall_64+0x3d/0x90 [ 152.457529] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.458321] ?
    ___sys_sendmsg+0xeb/0x170 [ 152.458958] ? __sys_sendmsg+0xb5/0x140 [ 152.459564] ? do_syscall_64+0x3d/0x90     [ 152.460122] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 152.460852] ?     fl_dump_key_options.part.0+0xea0/0xea0 [cls_flower] [ 152.461710] ? _raw_spin_lock+0x7a/0xd0 [ 152.462299]     ? _raw_read_lock_irq+0x30/0x30 [ 152.462924] ? nla_put+0x15e/0x1c0 [ 152.463480] fl_dump+0x228/0x650     [cls_flower] [ 152.464112] ? fl_tmplt_dump+0x210/0x210 [cls_flower] [ 152.464854] ?
    __kmem_cache_alloc_node+0x1a7/0x330 [ 152.465592] ? nla_put+0x15e/0x1c0 [ 152.466160]     tcf_fill_node+0x515/0x9a0 [ 152.466766] ? tc_setup_offload_action+0xf0/0xf0 [ 152.467463] ?
    __alloc_skb+0x13c/0x2a0 [ 152.468067] ? __build_skb_around+0x330/0x330 [ 152.468814] ? fl_get+0x107/0x1a0     [cls_flower] [ 152.469503] tc_del_tfilter+0x718/0x1330 [ 152.470115] ? is_bpf_text_address+0xa/0x20 [     152.470765] ? tc_ctl_chain+0xee0/0xee0 [ 152.471335] ? __kernel_text_address+0xe/0x30 [ 152.471948] ?     unwind_get_return_address+0x56/0xa0 [ 152.472639] ? __thaw_task+0x150/0x150 [ 152.473218] ?     arch_stack_walk+0x98/0xf0 [ 152.473839] ? __stack_depot_save+0x35/0x4c0 [ 152.474501] ?     stack_trace_save+0x91/0xc0 [ 152.475119] ? security_capable+0x51/0x90 [ 152.475741]     rtnetlink_rcv_msg+0x2c1/0x9d0 [ 152.476387] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 152.477042] ---truncated---     (CVE-2023-54206)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
280769	Linux Distros 未修补的漏洞：CVE-2023-54206	Nessus	Misc.	12/31/2025	7/25/2026	medium
280769	Linux Distros 未修補的弱點：CVE-2023-54206	Nessus	Misc.	12/31/2025	7/25/2026	medium
280769	Linux Distros のパッチ未適用の脆弱性: CVE-2023-54206	Nessus	Misc.	12/31/2025	7/25/2026	medium
280769	Linux Distros Unpatched Vulnerability : CVE-2023-54206	Nessus	Misc.	12/31/2025	7/25/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium