openEuler 22.03 LTS SP1 update for kernel

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the scarlett2_mixer_ctl_put() function in sound/usb/mixer_scarlett_gen2.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU90278

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52764

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the set_flicker() function in drivers/media/usb/gspca/cpia1.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper error handling

EUVDB-ID: #VU95018

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52887

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the j1939_xtp_rx_rts_session_new() function in net/can/j1939/transport.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU93043

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-33621

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ipvlan_process_v4_outbound() and ipvlan_process_v6_outbound() functions in drivers/net/ipvlan/ipvlan_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU93461

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35904

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the init_sel_fs() function in security/selinux/selinuxfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) NULL pointer dereference

EUVDB-ID: #VU92351

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38546

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vc4_hdmi_audio_init() function in drivers/gpu/drm/vc4/vc4_hdmi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU92308

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38561

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kunit_try_catch_run() function in lib/kunit/try-catch.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper locking

EUVDB-ID: #VU92363

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38594

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tc_taprio_configure() function in drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c, within the stmmac_adjust_time() function in drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Double free

EUVDB-ID: #VU93040

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38627

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the stm_register_device() function in drivers/hwtracing/stm/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds read

EUVDB-ID: #VU93326

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39471

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the sdma_v4_0_process_trap_irq() function in drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Buffer overflow

EUVDB-ID: #VU94313

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39497

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the drm_gem_shmem_mmap() function in drivers/gpu/drm/drm_gem_shmem_helper.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Memory leak

EUVDB-ID: #VU94203

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40910

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ax25_accept() function in net/ax25/af_ax25.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Out-of-bounds read

EUVDB-ID: #VU94236

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40953

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the kvm_vcpu_on_spin() function in virt/kvm/kvm_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU94246

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40959

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xfrm6_get_saddr() function in net/ipv6/xfrm6_policy.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) NULL pointer dereference

EUVDB-ID: #VU94244

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40961

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fib6_nh_init() function in net/ipv6/route.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Race condition

EUVDB-ID: #VU94297

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40976

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the lima_sched_timedout_job() function in drivers/gpu/drm/lima/lima_sched.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) NULL pointer dereference

EUVDB-ID: #VU94240

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40982

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ssb_bus_match() function in drivers/ssb/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Resource management error

EUVDB-ID: #VU94308

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40988

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sumo_construct_vid_mapping_table() function in drivers/gpu/drm/radeon/sumo_dpm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Input validation error

EUVDB-ID: #VU94287

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40999

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ena_com_cdesc_rx_pkt_get() and ena_com_rx_pkt() functions in drivers/net/ethernet/amazon/ena/ena_eth_com.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Out-of-bounds read

EUVDB-ID: #VU94835

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41013

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the __xfs_dir3_data_check() function in fs/xfs/libxfs/xfs_dir2_data.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Out-of-bounds read

EUVDB-ID: #VU94836

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41014

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the xlog_recover_process_data() function in fs/xfs/xfs_log_recover.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Out-of-bounds read

EUVDB-ID: #VU94839

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41019

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the check_rstbl() function in fs/ntfs3/fslog.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper locking

EUVDB-ID: #VU94996

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41020

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fcntl_setlk64() function in fs/locks.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Improper error handling

EUVDB-ID: #VU95022

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41022

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the sdma_v4_0_process_trap_irq() function in drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Memory leak

EUVDB-ID: #VU94924

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41023

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the enqueue_task_dl() function in kernel/sched/deadline.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Resource management error

EUVDB-ID: #VU95071

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41027

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the userfaultfd_api() function in fs/userfaultfd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Use-after-free

EUVDB-ID: #VU94949

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41040

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the net/sched/act_ct.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Resource management error

EUVDB-ID: #VU95069

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41041

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sock_set_flag() and spin_unlock() functions in net/ipv4/udp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Input validation error

EUVDB-ID: #VU95108

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41044

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ppp_read() and ppp_write() functions in drivers/net/ppp/ppp_generic.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) NULL pointer dereference

EUVDB-ID: #VU94982

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41048

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the sk_msg_recvmsg() function in net/core/skmsg.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) NULL pointer dereference

EUVDB-ID: #VU94977

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41062

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the l2cap_sock_kill(), l2cap_sock_new_connection_cb() and l2cap_sock_recv_cb() functions in net/bluetooth/l2cap_sock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Improper locking

EUVDB-ID: #VU94992

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41063

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the hci_unregister_dev() function in net/bluetooth/hci_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Improper locking

EUVDB-ID: #VU94991

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41064

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the eeh_pe_bus_get() function in arch/powerpc/kernel/eeh_pe.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use-after-free

EUVDB-ID: #VU94943

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41069

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the soc_tplg_dapm_graph_elems_load() function in sound/soc/soc-topology.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU94942

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41070

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kvm_spapr_tce_attach_iommu_group() function in arch/powerpc/kvm/book3s_64_vio.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Input validation error

EUVDB-ID: #VU95106

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41072

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the cfg80211_wext_siwscan() function in net/wireless/scan.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) NULL pointer dereference

EUVDB-ID: #VU94976

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41077

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the null_validate_conf() function in drivers/block/null_blk/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Memory leak

EUVDB-ID: #VU94930

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41079

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nvmet_execute_admin_connect() and nvmet_execute_io_connect() functions in drivers/nvme/target/fabrics-cmd.c, within the pr_debug() and nvmet_execute_auth_receive() functions in drivers/nvme/target/fabrics-cmd-auth.c, within the nvmet_req_init() function in drivers/nvme/target/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Improper locking

EUVDB-ID: #VU94990

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41080

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the io_register_iowq_max_workers() function in io_uring/register.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Resource management error

EUVDB-ID: #VU95051

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41081

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ila_output() function in net/ipv6/ila/ila_lwt.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) NULL pointer dereference

EUVDB-ID: #VU94971

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41089

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv17_tv_get_hd_modes() function in drivers/gpu/drm/nouveau/dispnv04/tvnv17.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Out-of-bounds read

EUVDB-ID: #VU94840

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41090

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tap_get_user_xdp() function in drivers/net/tap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Out-of-bounds read

EUVDB-ID: #VU94841

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41091

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tun_xdp_one() function in drivers/net/tun.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Resource management error

EUVDB-ID: #VU95067

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41097

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the cxacru_bind() function in drivers/usb/atm/cxacru.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Incorrect calculation

EUVDB-ID: #VU95076

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42068

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the jit_subprogs() function in kernel/bpf/verifier.c, within the bpf_prog_select_runtime() function in kernel/bpf/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Use of uninitialized resource

EUVDB-ID: #VU95031

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42076

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the MODULE_ALIAS() and j1939_send_one() functions in net/can/j1939/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Resource management error

EUVDB-ID: #VU95068

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42077

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ocfs2_extend_trans() function in fs/ocfs2/journal.c, within the ocfs2_dio_end_io_write() function in fs/ocfs2/aops.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Input validation error

EUVDB-ID: #VU95103

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42080

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the rdma_restrack_init() and type2str() functions in drivers/infiniband/core/restrack.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Buffer overflow

EUVDB-ID: #VU95055

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42082

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the __xdp_reg_mem_model() function in net/core/xdp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Improper neutralization of directives in statically saved code (\'static code injection\')

EUVDB-ID: #VU95052

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42084

CWE-ID: CWE-96 - Improper Neutralization of Directives in Statically Saved Code (\'Static Code Injection\')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. Changing the type of the compat syscall to the signed compat_off_t changes the behavior so it instead returns -EINVAL. The native entry point, the truncate() syscall and the corresponding loff_t based variants are all correct already and do not suffer from this mistake.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Buffer overflow

EUVDB-ID: #VU95041

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42086

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the bme680_compensate_temp(), bme680_compensate_press() and bme680_compensate_humid() functions in drivers/iio/chemical/bme680_core.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) NULL pointer dereference

EUVDB-ID: #VU94964

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42089

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fsl_asoc_card_probe() function in sound/soc/fsl/fsl-asoc-card.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Improper locking

EUVDB-ID: #VU94988

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42090

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the create_pinctrl() function in drivers/pinctrl/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Input validation error

EUVDB-ID: #VU95000

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42092

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the davinci_gpio_probe() function in drivers/gpio/gpio-davinci.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Buffer overflow

EUVDB-ID: #VU95039

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42093

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dpaa2_eth_xdp_xmit() and update_xps() functions in drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Buffer overflow

EUVDB-ID: #VU95040

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42094

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the iucv_setmask_mp() and iucv_cpu_online() functions in net/iucv/iucv.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Input validation error

EUVDB-ID: #VU95001

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42097

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the load_data() and load_guspatch() functions in sound/synth/emux/soundfont.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) NULL pointer dereference

EUVDB-ID: #VU94963

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42101

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nouveau_connector_get_modes() function in drivers/gpu/drm/nouveau/nouveau_connector.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Use of uninitialized resource

EUVDB-ID: #VU95024

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42106

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the inet_diag_dump_compat() and inet_diag_get_exact_compat() functions in net/ipv4/inet_diag.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Use-after-free

EUVDB-ID: #VU94932

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42115

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the jffs2_i_init_once() function in fs/jffs2/super.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Input validation error

EUVDB-ID: #VU95097

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42124

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qedf_execute_tmf() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Resource management error

EUVDB-ID: #VU95059

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42129

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the mlxreg_led_probe() function in drivers/leds/leds-mlxreg.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Buffer overflow

EUVDB-ID: #VU95054

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Input validation error

EUVDB-ID: #VU95092

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42155

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1964

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pkey_unlocked_ioctl() function in drivers/s390/crypto/pkey_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.88.0.169

python3-perf: before 5.10.0-136.88.0.169

perf-debuginfo: before 5.10.0-136.88.0.169

perf: before 5.10.0-136.88.0.169

kernel-tools-devel: before 5.10.0-136.88.0.169

kernel-tools-debuginfo: before 5.10.0-136.88.0.169

kernel-tools: before 5.10.0-136.88.0.169

kernel-source: before 5.10.0-136.88.0.169

kernel-headers: before 5.10.0-136.88.0.169

kernel-devel: before 5.10.0-136.88.0.169

kernel-debugsource: before 5.10.0-136.88.0.169

kernel-debuginfo: before 5.10.0-136.88.0.169

kernel: before 5.10.0-136.88.0.169

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Input validation error

EUVDB-ID: #VU94999

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42160