openEuler 20.03 LTS SP1 update for kernel



Risk High
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2021-3656
CVE-2021-4157
CVE-2022-0322
CVE-2021-45868
CVE-2022-3202
CWE-ID CWE-264
CWE-119
CWE-704
CWE-416
CWE-476
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

perf
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

bpftool
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

python2-perf-debuginfo
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

bpftool-debuginfo
Operating systems & Components / Operating system package or component

python2-perf
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Security restrictions bypass

EUVDB-ID: #VU56929

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3656

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions within the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest.

The vulnerability allows the L2 guest to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1

perf: before 4.19.90-2209.5.0.0169

kernel-debuginfo: before 4.19.90-2209.5.0.0169

perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-source: before 4.19.90-2209.5.0.0169

bpftool: before 4.19.90-2209.5.0.0169

kernel-debugsource: before 4.19.90-2209.5.0.0169

kernel-tools: before 4.19.90-2209.5.0.0169

python2-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-devel: before 4.19.90-2209.5.0.0169

python3-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-devel: before 4.19.90-2209.5.0.0169

bpftool-debuginfo: before 4.19.90-2209.5.0.0169

python2-perf: before 4.19.90-2209.5.0.0169

python3-perf: before 4.19.90-2209.5.0.0169

kernel: before 4.19.90-2209.5.0.0169

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1940


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU63323

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-4157

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the Linux kernel NFS subsystem. A remote attacker can create a specially crafted data and crash the system or escalate privileges on the system

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1

perf: before 4.19.90-2209.5.0.0169

kernel-debuginfo: before 4.19.90-2209.5.0.0169

perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-source: before 4.19.90-2209.5.0.0169

bpftool: before 4.19.90-2209.5.0.0169

kernel-debugsource: before 4.19.90-2209.5.0.0169

kernel-tools: before 4.19.90-2209.5.0.0169

python2-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-devel: before 4.19.90-2209.5.0.0169

python3-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-devel: before 4.19.90-2209.5.0.0169

bpftool-debuginfo: before 4.19.90-2209.5.0.0169

python2-perf: before 4.19.90-2209.5.0.0169

python3-perf: before 4.19.90-2209.5.0.0169

kernel: before 4.19.90-2209.5.0.0169

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1940


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Type conversion

EUVDB-ID: #VU63856

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-0322

CWE-ID: CWE-704 - Type conversion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a type conversion error in the sctp_make_strreset_req() function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel. A local user can perform a denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1

perf: before 4.19.90-2209.5.0.0169

kernel-debuginfo: before 4.19.90-2209.5.0.0169

perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-source: before 4.19.90-2209.5.0.0169

bpftool: before 4.19.90-2209.5.0.0169

kernel-debugsource: before 4.19.90-2209.5.0.0169

kernel-tools: before 4.19.90-2209.5.0.0169

python2-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-devel: before 4.19.90-2209.5.0.0169

python3-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-devel: before 4.19.90-2209.5.0.0169

bpftool-debuginfo: before 4.19.90-2209.5.0.0169

python2-perf: before 4.19.90-2209.5.0.0169

python3-perf: before 4.19.90-2209.5.0.0169

kernel: before 4.19.90-2209.5.0.0169

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1940


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU63422

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-45868

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial-of-service attack.

The vulnerability exists due to fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). A local user can trigger use-after-free error and perform a denial-of-service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1

perf: before 4.19.90-2209.5.0.0169

kernel-debuginfo: before 4.19.90-2209.5.0.0169

perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-source: before 4.19.90-2209.5.0.0169

bpftool: before 4.19.90-2209.5.0.0169

kernel-debugsource: before 4.19.90-2209.5.0.0169

kernel-tools: before 4.19.90-2209.5.0.0169

python2-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-devel: before 4.19.90-2209.5.0.0169

python3-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-devel: before 4.19.90-2209.5.0.0169

bpftool-debuginfo: before 4.19.90-2209.5.0.0169

python2-perf: before 4.19.90-2209.5.0.0169

python3-perf: before 4.19.90-2209.5.0.0169

kernel: before 4.19.90-2209.5.0.0169

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1940


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) NULL pointer dereference

EUVDB-ID: #VU67810

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3202

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in diFree in fs/jfs/inode.c in Journaled File System (JFS) in the Linux kernel. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1

perf: before 4.19.90-2209.5.0.0169

kernel-debuginfo: before 4.19.90-2209.5.0.0169

perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-source: before 4.19.90-2209.5.0.0169

bpftool: before 4.19.90-2209.5.0.0169

kernel-debugsource: before 4.19.90-2209.5.0.0169

kernel-tools: before 4.19.90-2209.5.0.0169

python2-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-devel: before 4.19.90-2209.5.0.0169

python3-perf-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-debuginfo: before 4.19.90-2209.5.0.0169

kernel-tools-devel: before 4.19.90-2209.5.0.0169

bpftool-debuginfo: before 4.19.90-2209.5.0.0169

python2-perf: before 4.19.90-2209.5.0.0169

python3-perf: before 4.19.90-2209.5.0.0169

kernel: before 4.19.90-2209.5.0.0169

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1940


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###