openEuler 20.03 LTS SP3 update for kernel

Published: 2023-10-13

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2020-36766 CVE-2023-42753
CWE-ID	CWE-401 CWE-787
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system kernel-debugsource Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component python2-perf-debuginfo Operating systems & Components / Operating system package or component python3-perf-debuginfo Operating systems & Components / Operating system package or component perf-debuginfo Operating systems & Components / Operating system package or component kernel-tools-devel Operating systems & Components / Operating system package or component bpftool-debuginfo Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component bpftool Operating systems & Components / Operating system package or component kernel-debuginfo Operating systems & Components / Operating system package or component kernel-tools-debuginfo Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component python2-perf Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Memory leak

EUVDB-ID: #VU81922

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-36766

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in drivers/media/cec/core/cec-api.c in Linux kernel. A local user can force the system to leak memory.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP3

kernel-debugsource: before 4.19.90-2310.2.0.0221

kernel-devel: before 4.19.90-2310.2.0.0221

python3-perf: before 4.19.90-2310.2.0.0221

python2-perf-debuginfo: before 4.19.90-2310.2.0.0221

python3-perf-debuginfo: before 4.19.90-2310.2.0.0221

perf-debuginfo: before 4.19.90-2310.2.0.0221

kernel-tools-devel: before 4.19.90-2310.2.0.0221

bpftool-debuginfo: before 4.19.90-2310.2.0.0221

perf: before 4.19.90-2310.2.0.0221

bpftool: before 4.19.90-2310.2.0.0221

kernel-debuginfo: before 4.19.90-2310.2.0.0221

kernel-tools-debuginfo: before 4.19.90-2310.2.0.0221

kernel-tools: before 4.19.90-2310.2.0.0221

kernel-source: before 4.19.90-2310.2.0.0221

python2-perf: before 4.19.90-2310.2.0.0221

kernel: before 4.19.90-2310.2.0.0221

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP3:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1728

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU81663