SB2023100814 - Anolis OS update for virt:an module

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2022-40284)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due in libntfs-3g/runlist.c to application incorrectly validates certain NTFS metadata, related to zero-sized runs. A local user can abuse application behavior to escalate privileges on the system.

2) NULL pointer dereference (CVE-ID: CVE-2023-3354)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in NULL pointer dereference and denial of service.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2023:0549