openEuler 22.03 LTS SP3 update for kernel



Risk Low
Patch available YES
Number of vulnerabilities 83
CVE-ID CVE-2021-47421
CVE-2021-47455
CVE-2022-48645
CVE-2023-52650
CVE-2023-52652
CVE-2023-52653
CVE-2023-52656
CVE-2023-52664
CVE-2023-52674
CVE-2023-52683
CVE-2023-52698
CVE-2023-52804
CVE-2023-52805
CVE-2023-52809
CVE-2023-52817
CVE-2023-52818
CVE-2023-52835
CVE-2023-52840
CVE-2023-52844
CVE-2023-52845
CVE-2023-52846
CVE-2023-52847
CVE-2023-52854
CVE-2023-52858
CVE-2023-52863
CVE-2023-52867
CVE-2023-52868
CVE-2023-52869
CVE-2023-52876
CVE-2023-52879
CVE-2024-26643
CVE-2024-26950
CVE-2024-26955
CVE-2024-26957
CVE-2024-26958
CVE-2024-26961
CVE-2024-26965
CVE-2024-26972
CVE-2024-26976
CVE-2024-26982
CVE-2024-26993
CVE-2024-26994
CVE-2024-26999
CVE-2024-27000
CVE-2024-27008
CVE-2024-27010
CVE-2024-27011
CVE-2024-27024
CVE-2024-27034
CVE-2024-27035
CVE-2024-27037
CVE-2024-27045
CVE-2024-27059
CVE-2024-27072
CVE-2024-27073
CVE-2024-27075
CVE-2024-27388
CVE-2024-27389
CVE-2024-27403
CVE-2024-27407
CVE-2024-27419
CVE-2024-35801
CVE-2024-35805
CVE-2024-35806
CVE-2024-35815
CVE-2024-35817
CVE-2024-35818
CVE-2024-35835
CVE-2024-35839
CVE-2024-35844
CVE-2024-35848
CVE-2024-35886
CVE-2024-35897
CVE-2024-35898
CVE-2024-35922
CVE-2024-35930
CVE-2024-35936
CVE-2024-35940
CVE-2024-35976
CVE-2024-35995
CVE-2024-35997
CVE-2024-36006
CVE-2024-36008
CWE-ID CWE-667
CWE-401
CWE-362
CWE-476
CWE-200
CWE-477
CWE-415
CWE-125
CWE-190
CWE-416
CWE-908
CWE-119
CWE-388
CWE-20
CWE-399
CWE-369
CWE-121
CWE-191
CWE-366
CWE-682
CWE-835
Exploitation vector Local
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 83 vulnerabilities.

1) Improper locking

EUVDB-ID: #VU90742

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47421

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the amdgpu_pci_error_detected() and amdgpu_pci_resume() functions in drivers/gpu/drm/amd/amdgpu/amdgpu_device.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU89939

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47455

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ptp_clock_register() function in drivers/ptp/ptp_clock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Race condition

EUVDB-ID: #VU93378

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48645

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the enetc_vf_set_features() and enetc_vf_netdev_setup() functions in drivers/net/ethernet/freescale/enetc/enetc_vf.c, within the enetc_pf_set_features() function in drivers/net/ethernet/freescale/enetc/enetc_pf.c, within the enetc_close() and enetc_setup_tc_mqprio() functions in drivers/net/ethernet/freescale/enetc/enetc.c, within the fsl-enetc-$() function in drivers/net/ethernet/freescale/enetc/Makefile. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) NULL pointer dereference

EUVDB-ID: #VU90517

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52650

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the tegra_dsi_ganged_probe() function in drivers/gpu/drm/tegra/dsi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU91353

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52652

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the pci_vntb_probe() function in drivers/pci/endpoint/functions/pci-epf-vntb.c, within the EXPORT_SYMBOL() and ntb_register_device() functions in drivers/ntb/core.c. A local user can gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Memory leak

EUVDB-ID: #VU90459

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52653

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the gss_import_v2_context() function in net/sunrpc/auth_gss/gss_krb5_mech.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use of obsolete function

EUVDB-ID: #VU93856

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52656

CWE-ID: CWE-477 - Use of Obsolete Function

Exploit availability: No

Description

The vulnerability allows a local user to have negative impact on system performance.

The vulnerability exists due to usage of dead code related to SCM_RIGHTS within the io_allocate_scq_urings(), io_ring_ctx_free(), and io_cqring_wait() function in fs/io_uring.c. A local user can influence system performance.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Double free

EUVDB-ID: #VU90893

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52664

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the aq_vec_ring_alloc() function in drivers/net/ethernet/aquantia/atlantic/aq_vec.c, within the aq_get_rxpages(), aq_ring_alloc(), aq_ring_rx_alloc() and aq_ring_hwts_rx_alloc() functions in drivers/net/ethernet/aquantia/atlantic/aq_ring.c, within the aq_ptp_ring_alloc() function in drivers/net/ethernet/aquantia/atlantic/aq_ptp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds read

EUVDB-ID: #VU91392

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52674

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the scarlett2_mixer_ctl_put() function in sound/usb/mixer_scarlett_gen2.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Integer overflow

EUVDB-ID: #VU91424

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52683

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the lpit_update_residency() function in drivers/acpi/acpi_lpit.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory leak

EUVDB-ID: #VU89982

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52698

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the netlbl_calipso_ops_register(), netlbl_calipso_add_pass() and netlbl_calipso_genl_init() functions in net/netlabel/netlabel_calipso.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds read

EUVDB-ID: #VU90284

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52804

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dbMount() function in fs/jfs/jfs_dmap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU90283

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52805

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the diInitInode() and diAlloc() functions in fs/jfs/jfs_imap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) NULL pointer dereference

EUVDB-ID: #VU90419

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52809

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fc_lport_ptp_setup() function in drivers/scsi/libfc/fc_lport.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU90432

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52817

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amdgpu_debugfs_regs_smc_read() and amdgpu_debugfs_regs_smc_write() functions in drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Out-of-bounds read

EUVDB-ID: #VU90289

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52818

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/gpu/drm/amd/include/pptable.h, drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Out-of-bounds read

EUVDB-ID: #VU91084

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52835

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the rb_alloc_aux() function in kernel/events/ring_buffer.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Use-after-free

EUVDB-ID: #VU91056

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52840

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rmi_unregister_function() function in drivers/input/rmi4/rmi_bus.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) NULL pointer dereference

EUVDB-ID: #VU90448

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52844

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vidtv_psi_service_desc_init() and kstrdup() functions in drivers/media/test-drivers/vidtv/vidtv_psi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use of uninitialized resource

EUVDB-ID: #VU90867

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52845

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the net/tipc/netlink.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Use-after-free

EUVDB-ID: #VU91055

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52846

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the prp_create_tagged_frame() function in net/hsr/hsr_forward.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free

EUVDB-ID: #VU91054

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52847

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the bttv_remove() function in drivers/media/pci/bt8xx/bttv-driver.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Use-after-free

EUVDB-ID: #VU90083

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52854

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the EXPORT_SYMBOL() function in kernel/padata.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) NULL pointer dereference

EUVDB-ID: #VU90433

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52858

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mtk_topckgen_init(), mtk_infrasys_init() and mtk_pericfg_init() functions in drivers/clk/mediatek/clk-mt7629.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) NULL pointer dereference

EUVDB-ID: #VU90426

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52863

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the axi_fan_control_probe() function in drivers/hwmon/axi-fan-control.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Buffer overflow

EUVDB-ID: #VU91308

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52867

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the drivers/gpu/drm/radeon/evergreen.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Buffer overflow

EUVDB-ID: #VU93616

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52868

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the thermal_zone_bind_cooling_device() function in drivers/thermal/thermal_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) NULL pointer dereference

EUVDB-ID: #VU90423

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52869

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pstore_register() function in fs/pstore/platform.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) NULL pointer dereference

EUVDB-ID: #VU90413

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52876

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the clk_mt7629_ethsys_init() and clk_mt7629_sgmiisys_init() functions in drivers/clk/mediatek/clk-mt7629-eth.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Use-after-free

EUVDB-ID: #VU90084

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52879

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the apply_event_filter() function in kernel/trace/trace_events_filter.c, within the remove_subsystem(), event_enable_read(), event_enable_write(), event_filter_read() and trace_create_new_event() functions in kernel/trace/trace_events.c, within the register_event_command() function in kernel/trace/trace.h, within the tracing_open_file_tr() and tracing_release_file_tr() functions in kernel/trace/trace.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Race condition

EUVDB-ID: #VU88135

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26643

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the nf_tables_unbind_set() function in net/netfilter/nf_tables_api.c. A local user can exploit the race and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) NULL pointer dereference

EUVDB-ID: #VU91460

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26950

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the get_peer() function in drivers/net/wireguard/netlink.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Improper error handling

EUVDB-ID: #VU93652

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26955

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nilfs_get_block() function in fs/nilfs2/inode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Use-after-free

EUVDB-ID: #VU91062

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26957

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the zcrypt_pick_queue() and zcrypt_drop_queue() functions in drivers/s390/crypto/zcrypt_api.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use-after-free

EUVDB-ID: #VU90183

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26958

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the , within the wait_on_commit() function in fs/nfs/write.c, within the nfs_direct_commit_schedule() function in fs/nfs/direct.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU90186

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26961

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mac802154_llsec_key_del_rcu() function in net/mac802154/llsec.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Out-of-bounds read

EUVDB-ID: #VU91393

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26965

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the F() function in drivers/clk/qcom/mmcc-msm8974.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Memory leak

EUVDB-ID: #VU90465

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26972

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mutex_unlock() function in fs/ubifs/dir.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Improper locking

EUVDB-ID: #VU90774

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26976

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the async_pf_execute(), kvm_clear_async_pf_completion_queue(), kvm_check_async_pf_completion() and kvm_setup_async_pf() functions in virt/kvm/async_pf.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Input validation error

EUVDB-ID: #VU90857

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26982

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the squashfs_new_inode() function in fs/squashfs/inode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Information disclosure

EUVDB-ID: #VU91355

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26993

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the sysfs_break_active_protection() function in fs/sysfs/file.c. A local user can gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Buffer overflow

EUVDB-ID: #VU93243

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26994

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the get_word() function in drivers/accessibility/speakup/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Improper locking

EUVDB-ID: #VU91449

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26999

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pmz_receive_chars() function in drivers/tty/serial/pmac_zilog.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Improper locking

EUVDB-ID: #VU91450

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27000

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mxs_auart_set_ldisc() and mxs_auart_irq_handle() functions in drivers/tty/serial/mxs-auart.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Out-of-bounds read

EUVDB-ID: #VU91095

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27008

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the apply_dcb_encoder_quirks() and fabricate_dcb_encoder_table() functions in drivers/gpu/drm/nouveau/nouveau_bios.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Improper locking

EUVDB-ID: #VU90769

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27010

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qdisc_alloc() function in net/sched/sch_generic.c, within the qdisc_run_end() function in net/core/dev.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Memory leak

EUVDB-ID: #VU90463

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27011

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_data_hold() and __nf_tables_abort() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Resource management error

EUVDB-ID: #VU93841

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27024

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the rds_sendmsg() function in net/rds/send.c, within the __rds_rdma_map() function in net/rds/rdma.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Improper locking

EUVDB-ID: #VU93785

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27034

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the f2fs_write_single_data_page() function in fs/f2fs/data.c, within the f2fs_compress_write_end_io(), f2fs_write_raw_pages() and unlock_page() functions in fs/f2fs/compress.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Resource management error

EUVDB-ID: #VU93857

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27035

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in fs/f2fs/compress.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) NULL pointer dereference

EUVDB-ID: #VU90523

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27037

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the SLCR_SWDT_CLK_SEL() and zynq_clk_setup() functions in drivers/clk/zynq/clkc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Buffer overflow

EUVDB-ID: #VU91310

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27045

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dp_dsc_clock_en_read() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Division by zero

EUVDB-ID: #VU91374

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27059

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the isd200_dump_driveid(), isd200_get_inquiry_data() and isd200_init_info() functions in drivers/usb/storage/isd200.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Improper locking

EUVDB-ID: #VU90765

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27072

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the usbtv_video_free() function in drivers/media/usb/usbtv/usbtv-video.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Memory leak

EUVDB-ID: #VU90455

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27073

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the budget_av_attach() function in drivers/media/pci/ttpci/budget-av.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Stack-based buffer overflow

EUVDB-ID: #VU91298

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27075

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to stack overflow within the stv0367_writeregs() function in drivers/media/dvb-frontends/stv0367.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Memory leak

EUVDB-ID: #VU90449

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27388

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the gssx_dec_option_array() function in net/sunrpc/auth_gss/gss_rpc_xdr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Resource management error

EUVDB-ID: #VU91608

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27389

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the pstore_put_backend_records() function in fs/pstore/inode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Integer underflow

EUVDB-ID: #VU91669

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27403

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the flow_offload_dst_cookie() and nft_flow_dst_release() functions in net/netfilter/nf_flow_table_core.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Buffer overflow

EUVDB-ID: #VU93624

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27407

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the mi_enum_attr() function in fs/ntfs3/record.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Race condition within a thread

EUVDB-ID: #VU91429

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27419

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

Description

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the nr_state1_machine(), nr_state2_machine() and nr_state3_machine() functions in net/netrom/nr_in.c, within the nr_rx_frame() function in net/netrom/af_netrom.c. A local user can manipulate data.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Input validation error

EUVDB-ID: #VU93680

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35801

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the fpu__init_cpu_xstate() function in arch/x86/kernel/fpu/xstate.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Improper locking

EUVDB-ID: #VU91519

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35805

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dm_exception_table_exit() function in drivers/md/dm-snap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Improper locking

EUVDB-ID: #VU90755

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35806

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qm_congestion_task() and qman_create_cgr() functions in drivers/soc/fsl/qbman/qman.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Resource management error

EUVDB-ID: #VU93271

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35815

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the aio_setup_ring() and kiocb_set_cancel_fn() functions in fs/aio.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Resource management error

EUVDB-ID: #VU93595

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35817

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the amdgpu_ttm_gart_bind() function in drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Improper locking

EUVDB-ID: #VU91447

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35818

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the arch/loongarch/include/asm/io.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Double free

EUVDB-ID: #VU90923

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35835

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the arfs_create_groups() function in drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Improper locking

EUVDB-ID: #VU93386

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35839

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nf_reject6_fill_skb_dst() and nf_send_reset6() functions in net/ipv6/netfilter/nf_reject_ipv6.c, within the nf_reject_fill_skb_dst() and nf_send_reset() functions in net/ipv4/netfilter/nf_reject_ipv4.c, within the br_nf_pre_routing_finish_ipv6() function in net/bridge/br_netfilter_ipv6.c, within the br_nf_pre_routing_finish_bridge(), br_nf_ipv4_daddr_was_changed(), bridge_parent_rtable(), skb_dst_set_noref(), setup_pre_routing(), br_nf_forward_finish(), ip_sabotage_in() and br_nf_pre_routing_finish_bridge_slow() functions in net/bridge/br_netfilter_hooks.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Incorrect calculation

EUVDB-ID: #VU93756

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35844

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the reserve_compress_blocks(), f2fs_reserve_compress_blocks() and mnt_drop_write_file() functions in fs/f2fs/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Buffer overflow

EUVDB-ID: #VU91199

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35848

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the at24_probe() function in drivers/misc/eeprom/at24.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Infinite loop

EUVDB-ID: #VU91413

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35886

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the inet6_dump_fib() function in net/ipv6/ip6_fib.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Resource management error

EUVDB-ID: #VU93269

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35897

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nf_tables_table_disable() and nf_tables_updtable() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Race condition within a thread

EUVDB-ID: #VU91427

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35898

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

Description

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the nf_tables_flowtable_parse_hook() and nft_flowtable_type_get() functions in net/netfilter/nf_tables_api.c. A local user can manipulate data.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Division by zero

EUVDB-ID: #VU91372

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35922

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the fb_get_mode() and fb_videomode_from_videomode() functions in drivers/video/fbdev/core/fbmon.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Memory leak

EUVDB-ID: #VU89976

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35930

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the lpfc_rcv_padisc() function in drivers/scsi/lpfc/lpfc_nportdisc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Improper error handling

EUVDB-ID: #VU90942

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35936

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mutex_unlock() function in fs/btrfs/volumes.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) NULL pointer dereference

EUVDB-ID: #VU90542

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35940

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the psz_kmsg_read() function in fs/pstore/zone.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Out-of-bounds read

EUVDB-ID: #VU90305

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35976

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the xsk_setsockopt() function in net/xdp/xsk.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Buffer overflow

EUVDB-ID: #VU92955

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35995

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the show_cppc_data(), acpi_cppc_processor_probe(), cpc_read() and cpc_write() functions in drivers/acpi/cppc_acpi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Infinite loop

EUVDB-ID: #VU91412

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35997

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the __i2c_hid_command() and i2c_hid_irq() functions in drivers/hid/i2c-hid/i2c-hid-core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Resource management error

EUVDB-ID: #VU93838

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36006

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the mlxsw_sp_acl_tcam_vchunk_migrate_one() and mlxsw_sp_acl_tcam_vchunk_migrate_all() functions in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) NULL pointer dereference

EUVDB-ID: #VU92068

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36008

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ip_route_use_hint() function in net/ipv4/route.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-201.0.0.114

kernel-tools: before 5.10.0-201.0.0.114

kernel-headers: before 5.10.0-201.0.0.114

kernel-tools-debuginfo: before 5.10.0-201.0.0.114

kernel-debuginfo: before 5.10.0-201.0.0.114

perf: before 5.10.0-201.0.0.114

kernel-source: before 5.10.0-201.0.0.114

kernel-debugsource: before 5.10.0-201.0.0.114

kernel-devel: before 5.10.0-201.0.0.114

kernel-tools-devel: before 5.10.0-201.0.0.114

python3-perf: before 5.10.0-201.0.0.114

perf-debuginfo: before 5.10.0-201.0.0.114

kernel: before 5.10.0-201.0.0.114

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1682


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###