openEuler 24.03 LTS update for kernel

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bnad_debugfs_write_regrd() and bnad_debugfs_write_regwr() functions in drivers/net/ethernet/brocade/bna/bnad_debugfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper locking

EUVDB-ID: #VU93342

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-37078

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nilfs_segctor_prepare_write() function in fs/nilfs2/segment.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU94246

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40959

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xfrm6_get_saddr() function in net/ipv6/xfrm6_policy.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Race condition

EUVDB-ID: #VU94297

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40976

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the lima_sched_timedout_job() function in drivers/gpu/drm/lima/lima_sched.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU94299

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40978

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qedi_dbg_do_not_recover_cmd_read() function in drivers/scsi/qedi/qedi_debugfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU94672

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fcntl_setlk() function in fs/locks.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds read

EUVDB-ID: #VU94837

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41016

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ocfs2_xattr_find_entry() function in fs/ocfs2/xattr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) NULL pointer dereference

EUVDB-ID: #VU94975

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41037

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hda_dai_suspend() function in sound/soc/sof/intel/hda-dai.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper Initialization

EUVDB-ID: #VU95047

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41052

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the vfio_pci_ioctl_get_pci_hot_reset_info() function in drivers/vfio/pci/vfio_pci_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds read

EUVDB-ID: #VU94956

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41071

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ieee80211_prep_hw_scan() function in net/mac80211/scan.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Resource management error

EUVDB-ID: #VU95073

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41082

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nvmf_reg_read32(), nvmf_reg_read64() and nvmf_reg_write32() functions in drivers/nvme/host/fabrics.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) NULL pointer dereference

EUVDB-ID: #VU94970

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41098

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ata_host_release() function in drivers/ata/libata-core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Input validation error

EUVDB-ID: #VU95082

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42139

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ice_ptp_extts_event(), ice_ptp_cfg_extts(), ice_ptp_gpio_enable_e810(), ice_ptp_gpio_enable_e823(), ice_ptp_rebuild_owner() and ice_ptp_release() functions in drivers/net/ethernet/intel/ice/ice_ptp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Memory leak

EUVDB-ID: #VU94922

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42152

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nvmet_sq_destroy() function in drivers/nvme/target/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Improper locking

EUVDB-ID: #VU94983

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42153

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the wait_reset(), i2c_pnx_master_xmit(), i2c_pnx_master_rcv(), i2c_pnx_interrupt(), i2c_pnx_timeout(), i2c_pnx_xfer() and i2c_pnx_probe() functions in drivers/i2c/busses/i2c-pnx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper locking

EUVDB-ID: #VU95506

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42234

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the folio_migrate_mapping() function in mm/migrate.c, within the mem_cgroup_migrate() function in mm/memcontrol.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) NULL pointer dereference

EUVDB-ID: #VU95505

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42235

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the crst_table_alloc() and base_crst_alloc() functions in arch/s390/mm/pgalloc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Infinite loop

EUVDB-ID: #VU95513

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42237

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the cs_dsp_load(), cs_dsp_load_coeff() and regmap_async_complete() functions in drivers/firmware/cirrus/cs_dsp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Infinite loop

EUVDB-ID: #VU95514

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42238

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the cs_dsp_load() and cs_dsp_load_coeff() functions in drivers/firmware/cirrus/cs_dsp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Improper locking

EUVDB-ID: #VU95507

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42239

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __bpf_async_init(), drop_prog_refcnt(), BPF_CALL_1() and hrtimer_cancel() functions in kernel/bpf/helpers.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU95516

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42240

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the SYM_INNER_LABEL() function in arch/x86/entry/entry_64_compat.S. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Resource management error

EUVDB-ID: #VU95517

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42241

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the shmem_confirm_swap() and shmem_is_huge() functions in mm/shmem.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Improper error handling

EUVDB-ID: #VU95511

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42243

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the include/linux/pagemap.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper error handling

EUVDB-ID: #VU95512

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42248

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ma35d1serial_probe() function in drivers/tty/serial/ma35d1_serial.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Improper locking

EUVDB-ID: #VU95509

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42250

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the cachefiles_daemon_poll() function in fs/cachefiles/daemon.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Resource management error

EUVDB-ID: #VU95562

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42253

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the pca953x_irq_bus_sync_unlock() function in drivers/gpio/gpio-pca953x.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Input validation error

EUVDB-ID: #VU95923

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42258

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __thp_get_unmapped_area() function in mm/huge_memory.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Buffer overflow

EUVDB-ID: #VU96008

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42259

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the i915_error_to_vmf_fault() and vm_fault_gtt() functions in drivers/gpu/drm/i915/gem/i915_gem_mman.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Use-after-free

EUVDB-ID: #VU96105

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42271

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the iucv_sever_path() function in net/iucv/af_iucv.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Use of uninitialized resource

EUVDB-ID: #VU96171

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42272

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the DEFINE_MUTEX() and offsetof() functions in net/sched/act_ct.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Input validation error

EUVDB-ID: #VU96205

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42276

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nvme_prep_rq() function in drivers/nvme/host/pci.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) NULL pointer dereference

EUVDB-ID: #VU96144

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42277

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the sprd_iommu_cleanup() function in drivers/iommu/sprd-iommu.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Improper error handling

EUVDB-ID: #VU96167

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42279

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the REG_CONTROL2() and mchp_corespi_transfer_one() functions in drivers/spi/spi-microchip-core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Input validation error

EUVDB-ID: #VU96207

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42291

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ice_vc_fdir_reset_cnt_all(), ice_vc_add_fdir_fltr_post(), ice_vc_del_fdir_fltr_post() and ice_vc_add_fdir_fltr() functions in drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c, within the ice_parse_rx_flow_user_data() function in drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improper locking

EUVDB-ID: #VU96151

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42294

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the del_gendisk() function in block/genhd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Improper locking

EUVDB-ID: #VU96154

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42296

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the f2fs_convert_inline_inode() function in fs/f2fs/inline.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) NULL pointer dereference

EUVDB-ID: #VU96138

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42298

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qmc_audio_dai_parse() function in sound/soc/fsl/fsl_qmc_audio.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Input validation error

EUVDB-ID: #VU96208

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42303

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pxp_probe() function in drivers/media/platform/nxp/imx-pxp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) NULL pointer dereference

EUVDB-ID: #VU96137

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42307

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the init_cifs(), destroy_mids() and destroy_workqueue() functions in fs/smb/client/cifsfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Use-after-free

EUVDB-ID: #VU96110

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42314

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the add_ra_bio_pages() function in fs/btrfs/compression.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Improper locking

EUVDB-ID: #VU96152

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42315

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the exfat_get_dentry_set() function in fs/exfat/dir.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Integer underflow

EUVDB-ID: #VU96174

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42316

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the folio_rotate_reclaimable() function in mm/vmscan.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Reachable assertion

EUVDB-ID: #VU96161

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42317

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the __thp_vma_allowable_orders() function in mm/huge_memory.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) NULL pointer dereference

EUVDB-ID: #VU96133

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42320

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dasd_copy_pair_store() function in drivers/s390/block/dasd_devmap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Resource management error

EUVDB-ID: #VU96183

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42321

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the __skb_flow_dissect() function in net/core/flow_dissector.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Input validation error

EUVDB-ID: #VU96160

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43817

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the include/linux/virtio_net.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) NULL pointer dereference

EUVDB-ID: #VU96131

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43818

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the st_es8336_late_probe() function in sound/soc/amd/acp-es8336.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) NULL pointer dereference

EUVDB-ID: #VU96129

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43821

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the lpfc_xcvr_data_show() function in drivers/scsi/lpfc/lpfc_attr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Out-of-bounds read

EUVDB-ID: #VU96111

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43825

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the iio_gts_build_avail_time_table() function in drivers/iio/industrialio-gts-helper.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Improper locking

EUVDB-ID: #VU96150

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43826

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nfs_wb_folio_cancel() and nfs_wb_folio() functions in fs/nfs/write.c, within the nfs_read_folio() function in fs/nfs/read.c, within the nfs_invalidate_folio() and nfs_launder_folio() functions in fs/nfs/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) NULL pointer dereference

EUVDB-ID: #VU96124

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43829

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qxl_add_mode() function in drivers/gpu/drm/qxl/qxl_display.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Improper locking

EUVDB-ID: #VU96149

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43832

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the make_folio_secure() and folio_wait_writeback() functions in arch/s390/kernel/uv.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) NULL pointer dereference

EUVDB-ID: #VU96123

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43833

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the v4l2_async_create_ancillary_links() function in drivers/media/v4l2-core/v4l2-async.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) NULL pointer dereference

EUVDB-ID: #VU96121

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43837

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/bpf_verifier.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Resource management error

EUVDB-ID: #VU96187

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43841

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the virt_wifi_inform_bss(), virt_wifi_connect() and virt_wifi_connect_complete() functions in drivers/net/wireless/virt_wifi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Input validation error

EUVDB-ID: #VU96198

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43842

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the rtw89_sta_info_get_iter() function in drivers/net/wireless/realtek/rtw89/debug.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Use of uninitialized resource

EUVDB-ID: #VU96170

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43845

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the udf_rename() function in fs/udf/namei.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Resource management error

EUVDB-ID: #VU96186

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43846

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the objagg_obj_parent_assign() function in lib/objagg.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Input validation error

EUVDB-ID: #VU96199

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43847

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the drivers/net/wireless/ath/ath12k/hw.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Input validation error

EUVDB-ID: #VU96200

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43849

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pdr_locator_new_server(), pdr_locator_del_server() and pdr_get_domain_list() functions in drivers/soc/qcom/pdr_interface.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Resource management error

EUVDB-ID: #VU96185

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43850

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bwmon_start() and bwmon_probe() functions in drivers/soc/qcom/icc-bwmon.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Resource management error

EUVDB-ID: #VU96179

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43851

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the DEFINE_PER_CPU_READ_MOSTLY(), xlnx_disable_percpu_irq() and xlnx_event_init_sgi() functions in drivers/soc/xilinx/xlnx_event_manager.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Improper locking

EUVDB-ID: #VU96147

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43855

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the md_end_flush(), submit_flushes() and md_submit_flush_data() functions in drivers/md/md.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Buffer overflow

EUVDB-ID: #VU96191

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43856

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dmam_free_coherent() function in kernel/dma/mapping.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) NULL pointer dereference

EUVDB-ID: #VU96119

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43859

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the f2fs_set_inode_flags() function in fs/f2fs/inode.c, within the f2fs_file_mmap() and f2fs_file_open() functions in fs/f2fs/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Input validation error

EUVDB-ID: #VU96493

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43883

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the vhci_urb_enqueue(), vhci_shutdown_connection() and vhci_device_reset() functions in drivers/usb/usbip/vhci_hcd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) NULL pointer dereference

EUVDB-ID: #VU96538

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43884

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pair_device() function in net/bluetooth/mgmt.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Division by zero

EUVDB-ID: #VU96545

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43889

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the padata_do_multithreaded() function in kernel/padata.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Buffer overflow

EUVDB-ID: #VU96544

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43890

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the get_free_elt(), tracing_map_clear() and tracing_map_create() functions in kernel/trace/tracing_map.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Use-after-free

EUVDB-ID: #VU96514

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43891

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the trigger_start(), event_trigger_regex_open() and event_trigger_regex_write() functions in kernel/trace/trace_events_trigger.c, within the event_inject_write() function in kernel/trace/trace_events_inject.c, within the hist_show() and hist_debug_show() functions in kernel/trace/trace_events_hist.c, within the event_enable_read(), event_enable_write(), f_next(), f_show(), event_filter_read(), event_filter_write() and event_callback() functions in kernel/trace/trace_events.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) NULL pointer dereference

EUVDB-ID: #VU96535

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43895

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the is_dsc_need_re_compute() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Input validation error

EUVDB-ID: #VU96541

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43897

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __udp_gso_segment() function in net/ipv4/udp_offload.c, within the tcp_gso_segment() function in net/ipv4/tcp_offload.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) NULL pointer dereference

EUVDB-ID: #VU96533

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43898

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ext4_da_do_write_end() function in fs/ext4/inode.c, within the __block_commit_write() function in fs/buffer.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) NULL pointer dereference

EUVDB-ID: #VU96532

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43899

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dcn20_get_dcc_compression_cap() function in drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Use-after-free

EUVDB-ID: #VU96515

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43900

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the load_firmware_cb() function in drivers/media/tuners/xc2028.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) NULL pointer dereference

EUVDB-ID: #VU96530

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43902

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dm_suspend(), create_eml_sink() and amdgpu_dm_connector_get_modes() functions in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) NULL pointer dereference

EUVDB-ID: #VU96528

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43905

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vega10_find_dpm_states_clocks_in_dpm_table(), vega10_generate_dpm_level_enable_mask(), vega10_check_states_equal(), vega10_set_sclk_od(), vega10_set_mclk_od(), vega10_odn_update_power_state() and vega10_get_performance_level() functions in drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) NULL pointer dereference

EUVDB-ID: #VU96527

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43906

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ta_if_invoke_debugfs_write() function in drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) NULL pointer dereference

EUVDB-ID: #VU96526

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43907

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vega10_apply_state_adjust_rules() function in drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c, within the smu8_apply_state_adjust_rules() function in drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c, within the smu7_apply_state_adjust_rules() function in drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) NULL pointer dereference

EUVDB-ID: #VU96525

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43908

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amdgpu_ras_interrupt_process_handler() function in drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) NULL pointer dereference

EUVDB-ID: #VU96524

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43909

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the smu7_update_edc_leakage_table() and smu7_hwmgr_backend_init() functions in drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Input validation error

EUVDB-ID: #VU96548

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43912

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __nl80211_set_channel() function in net/wireless/nl80211.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Memory leak

EUVDB-ID: #VU96511

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43913

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the devm_apple_nvme_mempool_destroy() and apple_nvme_probe() functions in drivers/nvme/host/apple.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Input validation error

EUVDB-ID: #VU96542

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43914

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the reshape_request() function in drivers/md/raid5.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Use-after-free

EUVDB-ID: #VU96517

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44934

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the br_multicast_del_port() function in net/bridge/br_multicast.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) NULL pointer dereference

EUVDB-ID: #VU96522

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44935

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __sctp_hash_endpoint() and __sctp_unhash_endpoint() functions in net/sctp/input.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Resource management error

EUVDB-ID: #VU96553

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44940

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the NAPI_GRO_CB() function in net/ipv4/fou_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Input validation error

EUVDB-ID: #VU96552

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44942

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the fs/f2fs/gc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Use-after-free

EUVDB-ID: #VU96658

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2024-44946

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kcm_sendmsg(), KCM_STATS_ADD(), sk->sk_write_space() and init_kcm_sock() functions in net/kcm/kcmsock.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

90) Memory leak

EUVDB-ID: #VU96711

Risk: Low

CVSSv4.0: 5.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2024-44947

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: Yes

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the fuse_notify_store() function in fs/fuse/dev.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-41.0.0.48

python3-perf: before 6.6.0-41.0.0.48

perf-debuginfo: before 6.6.0-41.0.0.48

perf: before 6.6.0-41.0.0.48

kernel-tools-devel: before 6.6.0-41.0.0.48

kernel-tools-debuginfo: before 6.6.0-41.0.0.48

kernel-tools: before 6.6.0-41.0.0.48

kernel-source: before 6.6.0-41.0.0.48

kernel-headers: before 6.6.0-41.0.0.48

kernel-devel: before 6.6.0-41.0.0.48

kernel-debugsource: before 6.6.0-41.0.0.48

kernel-debuginfo: before 6.6.0-41.0.0.48

bpftool-debuginfo: before 6.6.0-41.0.0.48

bpftool: before 6.6.0-41.0.0.48

kernel: before 6.6.0-41.0.0.48

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2124

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

91) Resource management error

EUVDB-ID: #VU96881

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44961