openEuler 22.03 LTS SP1 update for kernel

Published: 2023-03-10

Risk	Low
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2023-0240 CVE-2023-0615 CVE-2023-0045 CVE-2023-23586
CWE-ID	CWE-416 CWE-369 CWE-254
Exploitation vector	Local
Public exploit	Public exploit code for vulnerability #3 is available.
Vulnerable software	openEuler Operating systems & Components / Operating system bpftool-debuginfo Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component bpftool Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component python3-perf-debuginfo Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel-debugsource Operating systems & Components / Operating system package or component kernel-debuginfo Operating systems & Components / Operating system package or component kernel-headers Operating systems & Components / Operating system package or component kernel-tools-debuginfo Operating systems & Components / Operating system package or component perf-debuginfo Operating systems & Components / Operating system package or component kernel-tools-devel Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU82895

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0240

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local authenticated user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the io_uring's implementation in io_prep_async_work function. A local authenticated user can trigger a use-after-free error and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

bpftool-debuginfo: before 5.10.0-136.21.0.97

perf: before 5.10.0-136.21.0.97

bpftool: before 5.10.0-136.21.0.97

kernel-source: before 5.10.0-136.21.0.97

kernel-tools: before 5.10.0-136.21.0.97

python3-perf-debuginfo: before 5.10.0-136.21.0.97

kernel-devel: before 5.10.0-136.21.0.97

kernel-debugsource: before 5.10.0-136.21.0.97

kernel-debuginfo: before 5.10.0-136.21.0.97

kernel-headers: before 5.10.0-136.21.0.97

kernel-tools-debuginfo: before 5.10.0-136.21.0.97

perf-debuginfo: before 5.10.0-136.21.0.97

kernel-tools-devel: before 5.10.0-136.21.0.97

python3-perf: before 5.10.0-136.21.0.97

kernel: before 5.10.0-136.21.0.97

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1157

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Divide by zero

EUVDB-ID: #VU92736

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0615

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

A memory leak flaw and potential divide by 0 and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

bpftool-debuginfo: before 5.10.0-136.21.0.97

perf: before 5.10.0-136.21.0.97

bpftool: before 5.10.0-136.21.0.97

kernel-source: before 5.10.0-136.21.0.97

kernel-tools: before 5.10.0-136.21.0.97

python3-perf-debuginfo: before 5.10.0-136.21.0.97

kernel-devel: before 5.10.0-136.21.0.97

kernel-debugsource: before 5.10.0-136.21.0.97

kernel-debuginfo: before 5.10.0-136.21.0.97

kernel-headers: before 5.10.0-136.21.0.97

kernel-tools-debuginfo: before 5.10.0-136.21.0.97

perf-debuginfo: before 5.10.0-136.21.0.97

kernel-tools-devel: before 5.10.0-136.21.0.97

python3-perf: before 5.10.0-136.21.0.97

kernel: before 5.10.0-136.21.0.97

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1157

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security features bypass

EUVDB-ID: #VU72469

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-0045

CWE-ID: CWE-254 - Security Features

Exploit availability: Yes

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to Linux kernel does not correctly mitigate SMT attacks. A local user can bypass Spectre-BTI user space mitigations and gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

bpftool-debuginfo: before 5.10.0-136.21.0.97

perf: before 5.10.0-136.21.0.97

bpftool: before 5.10.0-136.21.0.97

kernel-source: before 5.10.0-136.21.0.97

kernel-tools: before 5.10.0-136.21.0.97

python3-perf-debuginfo: before 5.10.0-136.21.0.97

kernel-devel: before 5.10.0-136.21.0.97

kernel-debugsource: before 5.10.0-136.21.0.97

kernel-debuginfo: before 5.10.0-136.21.0.97

kernel-headers: before 5.10.0-136.21.0.97

kernel-tools-debuginfo: before 5.10.0-136.21.0.97

perf-debuginfo: before 5.10.0-136.21.0.97

kernel-tools-devel: before 5.10.0-136.21.0.97

python3-perf: before 5.10.0-136.21.0.97

kernel: before 5.10.0-136.21.0.97

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1157

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Use-after-free

EUVDB-ID: #VU77256

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-23586

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in the io_uring subsystem. A local user can gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

bpftool-debuginfo: before 5.10.0-136.21.0.97

perf: before 5.10.0-136.21.0.97

bpftool: before 5.10.0-136.21.0.97

kernel-source: before 5.10.0-136.21.0.97

kernel-tools: before 5.10.0-136.21.0.97

python3-perf-debuginfo: before 5.10.0-136.21.0.97

kernel-devel: before 5.10.0-136.21.0.97

kernel-debugsource: before 5.10.0-136.21.0.97

kernel-debuginfo: before 5.10.0-136.21.0.97

kernel-headers: before 5.10.0-136.21.0.97

kernel-tools-debuginfo: before 5.10.0-136.21.0.97

perf-debuginfo: before 5.10.0-136.21.0.97

kernel-tools-devel: before 5.10.0-136.21.0.97

python3-perf: before 5.10.0-136.21.0.97

kernel: before 5.10.0-136.21.0.97

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1157

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.