Anolis OS update for kernel

Published: 2023-01-13 | Updated: 2025-03-29

Risk	Low
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2022-2964 CVE-2022-4139 CVE-2021-47580 CVE-2022-48918 CVE-2022-48738 CVE-2022-48765 CVE-2022-48915 CVE-2022-48943
CWE-ID	CWE-787 CWE-119 CWE-125 CWE-476 CWE-399 CWE-667
Exploitation vector	Local
Public exploit	N/A
Vulnerable software	Anolis OS Operating systems & Components / Operating system kernel-doc Operating systems & Components / Operating system package or component kernel-abi-stablelists Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component kernel-tools-libs Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component kernel-modules-extra Operating systems & Components / Operating system package or component kernel-modules Operating systems & Components / Operating system package or component kernel-headers Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel-debug-modules-extra Operating systems & Components / Operating system package or component kernel-debug-modules Operating systems & Components / Operating system package or component kernel-debug-devel Operating systems & Components / Operating system package or component kernel-debug-core Operating systems & Components / Operating system package or component kernel-debug Operating systems & Components / Operating system package or component kernel-cross-headers Operating systems & Components / Operating system package or component kernel-core Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component bpftool Operating systems & Components / Operating system package or component
Vendor	OpenAnolis

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Out-of-bounds write

EUVDB-ID: #VU67811

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-2964

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices driver in Linux kernel. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-425.10.1

kernel-abi-stablelists: before 4.18.0-425.10.1

python3-perf: before 4.18.0-425.10.1

perf: before 4.18.0-425.10.1

kernel-tools-libs: before 4.18.0-425.10.1

kernel-tools: before 4.18.0-425.10.1

kernel-modules-extra: before 4.18.0-425.10.1

kernel-modules: before 4.18.0-425.10.1

kernel-headers: before 4.18.0-425.10.1

kernel-devel: before 4.18.0-425.10.1

kernel-debug-modules-extra: before 4.18.0-425.10.1

kernel-debug-modules: before 4.18.0-425.10.1

kernel-debug-devel: before 4.18.0-425.10.1

kernel-debug-core: before 4.18.0-425.10.1

kernel-debug: before 4.18.0-425.10.1

kernel-cross-headers: before 4.18.0-425.10.1

kernel-core: before 4.18.0-425.10.1

kernel: before 4.18.0-425.10.1

bpftool: before 4.18.0-425.10.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0008

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU70460

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-4139

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the i915 kernel driver on Linux kernel. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-425.10.1

kernel-abi-stablelists: before 4.18.0-425.10.1

python3-perf: before 4.18.0-425.10.1

perf: before 4.18.0-425.10.1

kernel-tools-libs: before 4.18.0-425.10.1

kernel-tools: before 4.18.0-425.10.1

kernel-modules-extra: before 4.18.0-425.10.1

kernel-modules: before 4.18.0-425.10.1

kernel-headers: before 4.18.0-425.10.1

kernel-devel: before 4.18.0-425.10.1

kernel-debug-modules-extra: before 4.18.0-425.10.1

kernel-debug-modules: before 4.18.0-425.10.1

kernel-debug-devel: before 4.18.0-425.10.1

kernel-debug-core: before 4.18.0-425.10.1

kernel-debug: before 4.18.0-425.10.1

kernel-cross-headers: before 4.18.0-425.10.1

kernel-core: before 4.18.0-425.10.1

kernel: before 4.18.0-425.10.1

bpftool: before 4.18.0-425.10.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0008

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU92318

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47580

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the p_fill_from_dev_buffer(), resp_inquiry(), resp_requests(), resp_mode_sense(), resp_ie_l_pg(), resp_log_sense() and resp_report_zones() functions in drivers/scsi/scsi_debug.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-425.10.1

kernel-abi-stablelists: before 4.18.0-425.10.1

python3-perf: before 4.18.0-425.10.1

perf: before 4.18.0-425.10.1

kernel-tools-libs: before 4.18.0-425.10.1

kernel-tools: before 4.18.0-425.10.1

kernel-modules-extra: before 4.18.0-425.10.1

kernel-modules: before 4.18.0-425.10.1

kernel-headers: before 4.18.0-425.10.1

kernel-devel: before 4.18.0-425.10.1

kernel-debug-modules-extra: before 4.18.0-425.10.1

kernel-debug-modules: before 4.18.0-425.10.1

kernel-debug-devel: before 4.18.0-425.10.1

kernel-debug-core: before 4.18.0-425.10.1

kernel-debug: before 4.18.0-425.10.1

kernel-cross-headers: before 4.18.0-425.10.1

kernel-core: before 4.18.0-425.10.1

kernel: before 4.18.0-425.10.1

bpftool: before 4.18.0-425.10.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0008

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) NULL pointer dereference

EUVDB-ID: #VU96423

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48918

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the iwl_mvm_sta_add_debugfs() and iwl_mvm_dbgfs_register() functions in drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-425.10.1

kernel-abi-stablelists: before 4.18.0-425.10.1

python3-perf: before 4.18.0-425.10.1

perf: before 4.18.0-425.10.1

kernel-tools-libs: before 4.18.0-425.10.1

kernel-tools: before 4.18.0-425.10.1

kernel-modules-extra: before 4.18.0-425.10.1

kernel-modules: before 4.18.0-425.10.1

kernel-headers: before 4.18.0-425.10.1

kernel-devel: before 4.18.0-425.10.1

kernel-debug-modules-extra: before 4.18.0-425.10.1

kernel-debug-modules: before 4.18.0-425.10.1

kernel-debug-devel: before 4.18.0-425.10.1

kernel-debug-core: before 4.18.0-425.10.1

kernel-debug: before 4.18.0-425.10.1

kernel-cross-headers: before 4.18.0-425.10.1

kernel-core: before 4.18.0-425.10.1

kernel: before 4.18.0-425.10.1

bpftool: before 4.18.0-425.10.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0008

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU92903

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48738

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the snd_soc_put_volsw() function in sound/soc/soc-ops.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-425.10.1

kernel-abi-stablelists: before 4.18.0-425.10.1

python3-perf: before 4.18.0-425.10.1

perf: before 4.18.0-425.10.1

kernel-tools-libs: before 4.18.0-425.10.1

kernel-tools: before 4.18.0-425.10.1

kernel-modules-extra: before 4.18.0-425.10.1

kernel-modules: before 4.18.0-425.10.1

kernel-headers: before 4.18.0-425.10.1

kernel-devel: before 4.18.0-425.10.1

kernel-debug-modules-extra: before 4.18.0-425.10.1

kernel-debug-modules: before 4.18.0-425.10.1

kernel-debug-devel: before 4.18.0-425.10.1

kernel-debug-core: before 4.18.0-425.10.1

kernel-debug: before 4.18.0-425.10.1

kernel-cross-headers: before 4.18.0-425.10.1

kernel-core: before 4.18.0-425.10.1

kernel: before 4.18.0-425.10.1

bpftool: before 4.18.0-425.10.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0008

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource management error

EUVDB-ID: #VU93276

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48765

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the kvm_apic_set_state() function in arch/x86/kvm/lapic.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-425.10.1

kernel-abi-stablelists: before 4.18.0-425.10.1

python3-perf: before 4.18.0-425.10.1

perf: before 4.18.0-425.10.1

kernel-tools-libs: before 4.18.0-425.10.1

kernel-tools: before 4.18.0-425.10.1

kernel-modules-extra: before 4.18.0-425.10.1

kernel-modules: before 4.18.0-425.10.1

kernel-headers: before 4.18.0-425.10.1

kernel-devel: before 4.18.0-425.10.1

kernel-debug-modules-extra: before 4.18.0-425.10.1

kernel-debug-modules: before 4.18.0-425.10.1

kernel-debug-devel: before 4.18.0-425.10.1

kernel-debug-core: before 4.18.0-425.10.1

kernel-debug: before 4.18.0-425.10.1

kernel-cross-headers: before 4.18.0-425.10.1

kernel-core: before 4.18.0-425.10.1

kernel: before 4.18.0-425.10.1

bpftool: before 4.18.0-425.10.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0008

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) NULL pointer dereference

EUVDB-ID: #VU96422

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48915

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the thermal_genl_cmd_tz_get_trip() function in drivers/thermal/thermal_netlink.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-425.10.1

kernel-abi-stablelists: before 4.18.0-425.10.1

python3-perf: before 4.18.0-425.10.1

perf: before 4.18.0-425.10.1

kernel-tools-libs: before 4.18.0-425.10.1

kernel-tools: before 4.18.0-425.10.1

kernel-modules-extra: before 4.18.0-425.10.1

kernel-modules: before 4.18.0-425.10.1

kernel-headers: before 4.18.0-425.10.1

kernel-devel: before 4.18.0-425.10.1

kernel-debug-modules-extra: before 4.18.0-425.10.1

kernel-debug-modules: before 4.18.0-425.10.1

kernel-debug-devel: before 4.18.0-425.10.1

kernel-debug-core: before 4.18.0-425.10.1

kernel-debug: before 4.18.0-425.10.1

kernel-cross-headers: before 4.18.0-425.10.1

kernel-core: before 4.18.0-425.10.1

kernel: before 4.18.0-425.10.1

bpftool: before 4.18.0-425.10.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0008

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper locking

EUVDB-ID: #VU96433

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48943

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the shadow_page_table_clear_flood() function in arch/x86/kvm/mmu/mmu.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-425.10.1

kernel-abi-stablelists: before 4.18.0-425.10.1

python3-perf: before 4.18.0-425.10.1

perf: before 4.18.0-425.10.1

kernel-tools-libs: before 4.18.0-425.10.1

kernel-tools: before 4.18.0-425.10.1

kernel-modules-extra: before 4.18.0-425.10.1

kernel-modules: before 4.18.0-425.10.1

kernel-headers: before 4.18.0-425.10.1

kernel-devel: before 4.18.0-425.10.1

kernel-debug-modules-extra: before 4.18.0-425.10.1

kernel-debug-modules: before 4.18.0-425.10.1

kernel-debug-devel: before 4.18.0-425.10.1

kernel-debug-core: before 4.18.0-425.10.1

kernel-debug: before 4.18.0-425.10.1

kernel-cross-headers: before 4.18.0-425.10.1

kernel-core: before 4.18.0-425.10.1

kernel: before 4.18.0-425.10.1

bpftool: before 4.18.0-425.10.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0008

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.