SB2023072149 - openEuler 22.03 LTS SP1 update for kernel

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Time-of-check time-of-use (toctou) race condition (CVE-ID: CVE-2023-1295)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to time-of-check time-of-use (toctou) race condition error within the io_close_prep(), io_req_defer_prep(), io_issue_sqe() and io_grab_files() functions in fs/io_uring.c. A local user can execute arbitrary code.

2) Out-of-bounds write (CVE-ID: CVE-2023-3090)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the ipvlan network driver in Linux kernel. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

3) Use-after-free (CVE-ID: CVE-2023-3117)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Netfilter subsystem. A local user with CAP_NET_ADMIN capability can trigger the use-after-free error and execute arbitrary code on the system.

4) Use-after-free (CVE-ID: CVE-2023-31248)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in nft_chain_lookup_byid() function, which failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace. A local user ca trigger a use-after-free error and execute arbitrary code with elevated privileges.

5) NULL pointer dereference (CVE-ID: CVE-2023-3220)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the dpu_crtc_atomic_check() function in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

6) NULL pointer dereference (CVE-ID: CVE-2023-3338)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the DECnet socket in net/decnet/dn_nsp_out.c. A local user can trigger a NULL pointer dereference and perform a denial of service (DoS) attack.

7) NULL pointer dereference (CVE-ID: CVE-2023-3358)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Linux kernel's Integrated Sensor Hub (ISH) driver. A local user and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1436