openEuler 20.03 LTS SP4 update for kernel

Published: 2024-10-12

Risk	Low
Patch available	YES
Number of vulnerabilities	18
CVE-ID	CVE-2024-44954 CVE-2024-44958 CVE-2024-45021 CVE-2024-46673 CVE-2024-46674 CVE-2024-46721 CVE-2024-46722 CVE-2024-46738 CVE-2024-46739 CVE-2024-46740 CVE-2024-46750 CVE-2024-46756 CVE-2024-46758 CVE-2024-46761 CVE-2024-46771 CVE-2024-46777 CVE-2024-46780 CVE-2024-46781
CWE-ID	CWE-667 CWE-399 CWE-665 CWE-416 CWE-476 CWE-125 CWE-191 CWE-401 CWE-190 CWE-119
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system python3-perf-debuginfo Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component python2-perf-debuginfo Operating systems & Components / Operating system package or component python2-perf Operating systems & Components / Operating system package or component perf-debuginfo Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component kernel-tools-devel Operating systems & Components / Operating system package or component kernel-tools-debuginfo Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel-debugsource Operating systems & Components / Operating system package or component kernel-debuginfo Operating systems & Components / Operating system package or component bpftool-debuginfo Operating systems & Components / Operating system package or component bpftool Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 18 vulnerabilities.

1) Improper locking

EUVDB-ID: #VU96859

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-44954

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the line6_data_received() function in sound/usb/line6/driver.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource management error

EUVDB-ID: #VU96880

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-44958

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sched_cpu_deactivate() function in kernel/sched/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Initialization

EUVDB-ID: #VU97184

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45021

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the memcg_write_event_control() function in mm/memcontrol.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU97251

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46673

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the aac_init_adapter() function in drivers/scsi/aacraid/comminit.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU97252

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46674

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the st_dwc3_probe() and reset_control_assert() functions in drivers/usb/dwc3/dwc3-st.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU97532

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46721

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __aafs_profile_mkdir() function in security/apparmor/apparmorfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds read

EUVDB-ID: #VU97508

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46722

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the amdgpu_atombios_init_mc_reg_table() function in drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU97491

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46738

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vmci_resource_remove() function in drivers/misc/vmw_vmci/vmci_resource.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) NULL pointer dereference

EUVDB-ID: #VU97528

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46739

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hv_uio_channel_cb() function in drivers/uio/uio_hv_generic.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use-after-free

EUVDB-ID: #VU97492

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46740

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the binder_transaction() function in drivers/android/binder.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper locking

EUVDB-ID: #VU97539

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46750

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pci_bus_lock(), pci_bus_unlock(), pci_bus_trylock(), list_for_each_entry_continue_reverse(), pci_slot_lock() and pci_slot_trylock() functions in drivers/pci/pci.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Integer underflow

EUVDB-ID: #VU97551

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46756

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the store_target_temp() and store_tolerance() functions in drivers/hwmon/w83627ehf.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Integer underflow

EUVDB-ID: #VU97553

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46758

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the set_tcrit2(), set_tcrit1(), set_tcrit1_hyst() and set_offset() functions in drivers/hwmon/lm95234.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) NULL pointer dereference

EUVDB-ID: #VU97513

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46761

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pnv_php_disable_irq() function in drivers/pci/hotplug/pnv_php.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Memory leak

EUVDB-ID: #VU97485

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46771

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the bcm_notify() function in net/can/bcm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Integer overflow

EUVDB-ID: #VU97550

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46777

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the udf_fill_partdesc_info() function in fs/udf/super.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Buffer overflow

EUVDB-ID: #VU97564

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46780

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nilfs_dev_revision_show(), nilfs_dev_device_size_show(), nilfs_dev_uuid_show() and nilfs_dev_volume_name_show() functions in fs/nilfs2/sysfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Use-after-free

EUVDB-ID: #VU97495

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46781

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_finish_roll_forward() and nilfs_salvage_orphan_logs() functions in fs/nilfs2/recovery.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2410.1.0.0298

python3-perf: before 4.19.90-2410.1.0.0298

python2-perf-debuginfo: before 4.19.90-2410.1.0.0298

python2-perf: before 4.19.90-2410.1.0.0298

perf-debuginfo: before 4.19.90-2410.1.0.0298

perf: before 4.19.90-2410.1.0.0298

kernel-tools-devel: before 4.19.90-2410.1.0.0298

kernel-tools-debuginfo: before 4.19.90-2410.1.0.0298

kernel-tools: before 4.19.90-2410.1.0.0298

kernel-source: before 4.19.90-2410.1.0.0298

kernel-devel: before 4.19.90-2410.1.0.0298

kernel-debugsource: before 4.19.90-2410.1.0.0298

kernel-debuginfo: before 4.19.90-2410.1.0.0298

bpftool-debuginfo: before 4.19.90-2410.1.0.0298

bpftool: before 4.19.90-2410.1.0.0298

kernel: before 4.19.90-2410.1.0.0298

CPE2.3

cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2217

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.