Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU75336
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-45886
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS SP2
perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools: before 4.19.90-2307.5.0.0211
python3-perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools-devel: before 4.19.90-2307.5.0.0211
kernel-devel: before 4.19.90-2307.5.0.0211
python2-perf: before 4.19.90-2307.5.0.0211
python3-perf: before 4.19.90-2307.5.0.0211
kernel-source: before 4.19.90-2307.5.0.0211
python2-perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools-debuginfo: before 4.19.90-2307.5.0.0211
kernel-debuginfo: before 4.19.90-2307.5.0.0211
perf: before 4.19.90-2307.5.0.0211
bpftool: before 4.19.90-2307.5.0.0211
bpftool-debuginfo: before 4.19.90-2307.5.0.0211
kernel-debugsource: before 4.19.90-2307.5.0.0211
kernel: before 4.19.90-2307.5.0.0211
CPE2.3http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1448
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU78007
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-3390
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within net/netfilter/nf_tables_api.c in the Linux kernel netfilter subsystem. A local user can trigger a use-after-fee error and escalate privileges on the system.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS SP2
perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools: before 4.19.90-2307.5.0.0211
python3-perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools-devel: before 4.19.90-2307.5.0.0211
kernel-devel: before 4.19.90-2307.5.0.0211
python2-perf: before 4.19.90-2307.5.0.0211
python3-perf: before 4.19.90-2307.5.0.0211
kernel-source: before 4.19.90-2307.5.0.0211
python2-perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools-debuginfo: before 4.19.90-2307.5.0.0211
kernel-debuginfo: before 4.19.90-2307.5.0.0211
perf: before 4.19.90-2307.5.0.0211
bpftool: before 4.19.90-2307.5.0.0211
bpftool-debuginfo: before 4.19.90-2307.5.0.0211
kernel-debugsource: before 4.19.90-2307.5.0.0211
kernel: before 4.19.90-2307.5.0.0211
CPE2.3http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1448
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU78326
Risk: Low
CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2023-35001
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: Yes
Description The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the nft_byteorder() function. A local user can trigger an out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS SP2
perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools: before 4.19.90-2307.5.0.0211
python3-perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools-devel: before 4.19.90-2307.5.0.0211
kernel-devel: before 4.19.90-2307.5.0.0211
python2-perf: before 4.19.90-2307.5.0.0211
python3-perf: before 4.19.90-2307.5.0.0211
kernel-source: before 4.19.90-2307.5.0.0211
python2-perf-debuginfo: before 4.19.90-2307.5.0.0211
kernel-tools-debuginfo: before 4.19.90-2307.5.0.0211
kernel-debuginfo: before 4.19.90-2307.5.0.0211
perf: before 4.19.90-2307.5.0.0211
bpftool: before 4.19.90-2307.5.0.0211
bpftool-debuginfo: before 4.19.90-2307.5.0.0211
kernel-debugsource: before 4.19.90-2307.5.0.0211
kernel: before 4.19.90-2307.5.0.0211
CPE2.3http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1448
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.