openEuler 22.03 LTS SP1 update for kernel



Published: 2024-08-03
Risk Low
Patch available YES
Number of vulnerabilities 36
CVE-ID CVE-2021-47205
CVE-2022-48703
CVE-2022-48780
CVE-2022-48859
CVE-2023-52679
CVE-2024-26924
CVE-2024-26925
CVE-2024-27010
CVE-2024-34777
CVE-2024-35808
CVE-2024-35837
CVE-2024-35899
CVE-2024-35931
CVE-2024-36923
CVE-2024-37078
CVE-2024-38548
CVE-2024-38567
CVE-2024-38607
CVE-2024-38611
CVE-2024-38621
CVE-2024-39475
CVE-2024-39476
CVE-2024-39484
CVE-2024-39506
CVE-2024-39508
CVE-2024-40915
CVE-2024-40945
CVE-2024-40947
CVE-2024-40956
CVE-2024-40960
CVE-2024-40967
CVE-2024-40972
CVE-2024-40980
CVE-2024-40981
CVE-2024-40995
CVE-2024-41011
CWE-ID CWE-401
CWE-476
CWE-835
CWE-415
CWE-399
CWE-667
CWE-20
CWE-908
CWE-416
CWE-388
CWE-125
CWE-369
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		openEuler
Operating systems & Components / Operating system

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 36 vulnerabilities.

1) Memory leak

EUVDB-ID: #VU90007

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47205

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the DEFINE_SPINLOCK() and devm_sunxi_ccu_release() functions in drivers/clk/sunxi-ng/ccu_common.c, within the suniv_f1c100s_ccu_setup() function in drivers/clk/sunxi-ng/ccu-suniv-f1c100s.c, within the sun9i_a80_ccu_probe() function in drivers/clk/sunxi-ng/ccu-sun9i-a80.c, within the sun9i_a80_usb_clk_probe() function in drivers/clk/sunxi-ng/ccu-sun9i-a80-usb.c, within the sun9i_a80_de_clk_probe() function in drivers/clk/sunxi-ng/ccu-sun9i-a80-de.c, within the sun8i_v3_v3s_ccu_init() function in drivers/clk/sunxi-ng/ccu-sun8i-v3s.c, within the sun8i_r40_ccu_probe() function in drivers/clk/sunxi-ng/ccu-sun8i-r40.c, within the sunxi_h3_h5_ccu_init() function in drivers/clk/sunxi-ng/ccu-sun8i-h3.c, within the sunxi_de2_clk_probe() function in drivers/clk/sunxi-ng/ccu-sun8i-de2.c, within the sun8i_a83t_ccu_probe() function in drivers/clk/sunxi-ng/ccu-sun8i-a83t.c, within the sun8i_a33_ccu_setup() and ccu_pll_notifier_register() functions in drivers/clk/sunxi-ng/ccu-sun8i-a33.c, within the sun8i_a23_ccu_setup() function in drivers/clk/sunxi-ng/ccu-sun8i-a23.c, within the sun6i_a31_ccu_setup() function in drivers/clk/sunxi-ng/ccu-sun6i-a31.c, within the sun5i_ccu_init() function in drivers/clk/sunxi-ng/ccu-sun5i.c, within the sun50i_h616_ccu_setup() function in drivers/clk/sunxi-ng/ccu-sun50i-h616.c, within the sun50i_h6_ccu_probe() function in drivers/clk/sunxi-ng/ccu-sun50i-h6.c, within the sunxi_r_ccu_init() function in drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c, within the sun50i_a64_ccu_probe() function in drivers/clk/sunxi-ng/ccu-sun50i-a64.c, within the sun50i_a100_ccu_probe() function in drivers/clk/sunxi-ng/ccu-sun50i-a100.c, within the sun50i_a100_r_ccu_probe() function in drivers/clk/sunxi-ng/ccu-sun50i-a100-r.c, within the sun4i_ccu_init() and sunxi_ccu_probe() functions in drivers/clk/sunxi-ng/ccu-sun4i-a10.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU90514

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48703

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the int3400_setup_gddv(), int3400_thermal_probe() and int3400_thermal_remove() functions in drivers/thermal/intel/int340x_thermal/int3400_thermal.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Infinite loop

EUVDB-ID: #VU94470

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48780

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the smc_fback_error_report() and smc_switch_to_fallback() functions in net/smc/af_smc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU94395

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48859

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the prestera_switch_set_base_mac_addr() function in drivers/net/ethernet/marvell/prestera/prestera_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Double free

EUVDB-ID: #VU90892

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52679

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the of_unittest_parse_phandle_with_args() and of_unittest_parse_phandle_with_args_map() functions in drivers/of/unittest.c, within the of_parse_phandle_with_args_map() function in drivers/of/base.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource management error

EUVDB-ID: #VU89055

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26924

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the nft_pipapo_remove() function in net/netfilter/nft_set_pipapo.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper locking

EUVDB-ID: #VU92034

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26925

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __nf_tables_abort() and nf_tables_abort() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper locking

EUVDB-ID: #VU90769

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27010

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qdisc_alloc() function in net/sched/sch_generic.c, within the qdisc_run_end() function in net/core/dev.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU93172

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-34777

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the map_benchmark_ioctl() function in kernel/dma/map_benchmark.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper locking

EUVDB-ID: #VU90754

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35808

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the raid_message() function in drivers/md/dm-raid.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use of uninitialized resource

EUVDB-ID: #VU93435

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35837

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the mvpp2_bm_pool_cleanup() and mvpp2_bm_init() functions in drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU90160

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35899

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nf_tables_module_exit() function in net/netfilter/nf_tables_api.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper error handling

EUVDB-ID: #VU90943

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35931

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the amdgpu_pci_slot_reset() function in drivers/gpu/drm/amd/amdgpu/amdgpu_device.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use of uninitialized resource

EUVDB-ID: #VU90864

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36923

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the v9fs_evict_inode() function in fs/9p/vfs_inode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Improper locking

EUVDB-ID: #VU93342

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-37078

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nilfs_segctor_prepare_write() function in fs/nilfs2/segment.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) NULL pointer dereference

EUVDB-ID: #VU92349

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38548

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cdns_mhdp_atomic_enable() function in drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Input validation error

EUVDB-ID: #VU92370

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38567

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the carl9170_usb_probe() function in drivers/net/wireless/ath/carl9170/usb.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Resource management error

EUVDB-ID: #VU93181

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38607

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the macii_probe() function in drivers/macintosh/via-macii.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Memory leak

EUVDB-ID: #VU92298

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38611

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the et8ek8_remove() and __exit_p() functions in drivers/media/i2c/et8ek8/et8ek8_driver.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Out-of-bounds read

EUVDB-ID: #VU93025

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38621

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the stk1160_buffer_done() and stk1160_copy_video() functions in drivers/media/usb/stk1160/stk1160-video.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Division by zero

EUVDB-ID: #VU93828

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39475

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the savagefb_probe() function in drivers/video/fbdev/savage/savagefb_driver.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Improper locking

EUVDB-ID: #VU93824

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39476

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the raid5d() function in drivers/md/raid5.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Memory leak

EUVDB-ID: #VU93818

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39484

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the davinci_mmcsd_remove() and __exit_p() functions in drivers/mmc/host/davinci_mmc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) NULL pointer dereference

EUVDB-ID: #VU94258

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39506

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the lio_vf_rep_copy_packet() function in drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use-after-free

EUVDB-ID: #VU94229

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39508

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the WORKER_IDLE_TIMEOUT(), io_work_get_acct(), io_worker_exit(), io_wq_dec_running(), __io_worker_busy(), io_wq_worker(), io_wq_worker_running(), io_wq_worker_sleeping(), io_init_new_worker(), init_completion() and io_wq_work_match_item() functions in io_uring/io-wq.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Use-after-free

EUVDB-ID: #VU94222

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40915

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the set_direct_map_default_noflush() function in arch/riscv/mm/pageattr.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) NULL pointer dereference

EUVDB-ID: #VU94250

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40945

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/iommu.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Use-after-free

EUVDB-ID: #VU94218

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40947

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smack_post_notification() function in security/smack/smack_lsm.c, within the selinux_audit_rule_free() and selinux_audit_rule_init() functions in security/selinux/ss/services.c, within the security_key_getsecurity() function in security/security.c, within the ima_free_rule(), ima_lsm_copy_rule(), ima_lsm_update_rule() and ima_lsm_rule_init() functions in security/integrity/ima/ima_policy.c, within the aa_audit_rule_free() and aa_audit_rule_init() functions in security/apparmor/audit.c, within the audit_data_to_entry() and audit_dupe_lsm_field() functions in kernel/auditfilter.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Use-after-free

EUVDB-ID: #VU94216

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40956

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the irq_process_work_list() function in drivers/dma/idxd/irq.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) NULL pointer dereference

EUVDB-ID: #VU94245

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40960

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rt6_probe() function in net/ipv6/route.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Improper locking

EUVDB-ID: #VU94274

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40967

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the imx_uart_console_write() function in drivers/tty/serial/imx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Improper locking

EUVDB-ID: #VU94272

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40972

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ext4_xattr_set_entry(), iput(), ext4_xattr_block_set() and ext4_xattr_ibody_set() functions in fs/ext4/xattr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Improper locking

EUVDB-ID: #VU94270

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40980

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the reset_per_cpu_data(), trace_drop_common(), net_dm_hw_reset_per_cpu_data(), net_dm_hw_summary_probe() and __net_dm_cpu_data_init() functions in net/core/drop_monitor.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Improper locking

EUVDB-ID: #VU94269

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40981

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the batadv_purge_orig_ref() function in net/batman-adv/originator.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improper locking

EUVDB-ID: #VU94267

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40995

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tcf_idr_check_alloc() and rcu_read_unlock() functions in net/sched/act_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Input validation error

EUVDB-ID: #VU94530

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41011

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the kfd_ioctl_alloc_memory_of_gpu(), criu_restore_memory_of_gpu() and kfd_mmio_mmap() functions in drivers/gpu/drm/amd/amdkfd/kfd_chardev.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

kernel-tools-debuginfo: before 5.10.0-136.87.0.168

python3-perf-debuginfo: before 5.10.0-136.87.0.168

perf-debuginfo: before 5.10.0-136.87.0.168

kernel-debuginfo: before 5.10.0-136.87.0.168

kernel-devel: before 5.10.0-136.87.0.168

perf: before 5.10.0-136.87.0.168

kernel-tools-devel: before 5.10.0-136.87.0.168

kernel-headers: before 5.10.0-136.87.0.168

kernel-tools: before 5.10.0-136.87.0.168

kernel-source: before 5.10.0-136.87.0.168

kernel-debugsource: before 5.10.0-136.87.0.168

python3-perf: before 5.10.0-136.87.0.168

kernel: before 5.10.0-136.87.0.168

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1941


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###