openEuler 22.03 LTS SP1 update for kernel

Published: 2024-05-08

Risk	Medium
Patch available	YES
Number of vulnerabilities	17
CVE-ID	CVE-2021-46926 CVE-2021-47037 CVE-2023-52443 CVE-2023-52454 CVE-2023-52456 CVE-2023-52467 CVE-2023-52469 CVE-2023-52476 CVE-2023-52479 CVE-2023-52484 CVE-2024-26585 CVE-2024-26589 CVE-2024-26593 CVE-2024-26597 CVE-2024-26600 CVE-2024-26603 CVE-2024-26606
CWE-ID	CWE-399 CWE-476 CWE-667 CWE-416 CWE-125 CWE-362 CWE-119 CWE-835
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system kernel-debugsource Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component kernel-tools-devel Operating systems & Components / Operating system package or component kernel-debuginfo Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component perf-debuginfo Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component kernel-tools-debuginfo Operating systems & Components / Operating system package or component kernel-headers Operating systems & Components / Operating system package or component python3-perf-debuginfo Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 17 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU89253

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46926

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the sdw_intel_acpi_cb() function in sound/hda/intel-sdw-acpi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource management error

EUVDB-ID: #VU89246

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47037

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in sound/soc/qcom/qdsp6/q6afe-clocks.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU89245

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52443

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the unpack_profile() function in security/apparmor/policy_unpack.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) NULL pointer dereference

EUVDB-ID: #VU89244

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52454

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the nvmet_tcp_build_pdu_iovec() function in drivers/nvme/target/tcp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper locking

EUVDB-ID: #VU89243

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52456

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to double-locking error within the imx_uart_stop_tx() function in drivers/tty/serial/imx.c. A local user can crash the OS kernel.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU89236

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52467

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the of_syscon_register() function in drivers/mfd/syscon.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU89235

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52469

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kv_parse_power_table() function in drivers/gpu/drm/amd/amdgpu/kv_dpm.c. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU88821

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52476

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the branch_type() and get_branch_type() functions in arch/x86/events/utils.c. A local user can trigger an out-of-bounds read error and crash the kernel.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU88818

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52479

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smb20_oplock_break_ack() function in fs/ksmbd/smb2pdu.c and fs/smb/server/smb2pdu.c. A local user can trigger a use-after-free error and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource management error

EUVDB-ID: #VU89252

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52484

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the arm_smmu_free_shared_cd() function in drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Race condition

EUVDB-ID: #VU89251

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26585

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the tls_encrypt_done() function in net/tls/tls_sw.c. A remote attacker user can send specially crafted requests to the system and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Buffer overflow

EUVDB-ID: #VU88886

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26589

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the adjust_ptr_min_max_vals() function in kernel/bpf/verifier.c. A local user can crash the OS kernel.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU89250

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26593

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the i801_block_transaction_by_block() function in drivers/i2c/busses/i2c-i801.c. A local user can trigger an out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Out-of-bounds read

EUVDB-ID: #VU87682

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26597

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c when parsing the netlink attributes. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU89249

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26600

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in drivers/phy/ti/phy-omap-usb2.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Infinite loop

EUVDB-ID: #VU89248

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26603

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in arch/x86/kernel/fpu/signal.c. A local user can consume all available system resources and cause denial of service conditions.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Resource management error

EUVDB-ID: #VU89247

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26606

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the binder_enqueue_thread_work_ilocked() function in drivers/android/binder.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-debugsource: before 5.10.0-136.71.0.151

kernel-source: before 5.10.0-136.71.0.151

kernel-tools-devel: before 5.10.0-136.71.0.151

kernel-debuginfo: before 5.10.0-136.71.0.151

python3-perf: before 5.10.0-136.71.0.151

perf-debuginfo: before 5.10.0-136.71.0.151

kernel-devel: before 5.10.0-136.71.0.151

kernel-tools: before 5.10.0-136.71.0.151

perf: before 5.10.0-136.71.0.151

kernel-tools-debuginfo: before 5.10.0-136.71.0.151

kernel-headers: before 5.10.0-136.71.0.151

python3-perf-debuginfo: before 5.10.0-136.71.0.151

kernel: before 5.10.0-136.71.0.151

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.