openEuler 24.03 LTS update for kernel

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the apparmor_socket_sock_rcv_skb() function in security/apparmor/lsm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper locking

EUVDB-ID: #VU92027

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27397

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __nft_rbtree_insert(), nft_rbtree_deactivate() and nft_rbtree_gc() functions in net/netfilter/nft_set_rbtree.c, within the pipapo_get(), nft_pipapo_get(), nft_pipapo_insert(), pipapo_gc() and pipapo_deactivate() functions in net/netfilter/nft_set_pipapo.c, within the nft_rhash_key(), nft_rhash_cmp(), nft_rhash_lookup(), nft_rhash_get(), nft_rhash_update(), nft_rhash_insert() and nft_rhash_deactivate() functions in net/netfilter/nft_set_hash.c, within the nft_trans_gc_catchall_sync() and nf_tables_valid_genid() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU90058

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the msft_monitor_supported() function in net/bluetooth/msft.h, within the msft_register() function in net/bluetooth/msft.c, within the hci_unregister_dev() and hci_release_dev() functions in net/bluetooth/hci_core.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Unchecked Return Value

EUVDB-ID: #VU89896

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36015

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an unchecked return value within the register_device() function in drivers/char/ppdev.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU90849

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36032

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qca_read_fw_build_info() function in drivers/bluetooth/btqca.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource management error

EUVDB-ID: #VU93252

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36244

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the parse_taprio_schedule() function in net/sched/sch_taprio.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU90850

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36880

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qca_send_pre_shutdown_cmd(), qca_tlv_check_data() and qca_download_firmware() functions in drivers/bluetooth/btqca.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use of uninitialized resource

EUVDB-ID: #VU90975

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36889

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the mptcp_stream_connect() function in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper locking

EUVDB-ID: #VU90735

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36894

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ffs_user_copy_worker() and ffs_epfile_async_io_complete() functions in drivers/usb/gadget/function/f_fs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use-after-free

EUVDB-ID: #VU93085

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36909

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vmbus_free_ring() function in drivers/hv/channel.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use-after-free

EUVDB-ID: #VU93345

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36910

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the hv_uio_cleanup() and hv_uio_probe() functions in drivers/uio/uio_hv_generic.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU93346

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36911

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the free_netvsc_device() function in drivers/net/hyperv/netvsc.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Information disclosure

EUVDB-ID: #VU91323

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36913

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the vmbus_connect() and vmbus_disconnect() functions in drivers/hv/connection.c. A local user can gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Out-of-bounds read

EUVDB-ID: #VU90268

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36915

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nfc_llcp_setsockopt() function in net/nfc/llcp_sock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Input validation error

EUVDB-ID: #VU93447

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36918

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the test_fail_cases() function in tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c, within the bloom_map_get_next_key() and bloom_map_check_btf() functions in kernel/bpf/bloom_filter.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Buffer overflow

EUVDB-ID: #VU93238

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36920

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the mpi3mr_bsg_process_mpt_cmds() function in drivers/scsi/mpi3mr/mpi3mr_app.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Out-of-bounds read

EUVDB-ID: #VU90270

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36921

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the iwl_mvm_mld_rm_sta() function in drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Improper locking

EUVDB-ID: #VU92009

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36922

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the iwl_txq_reclaim() function in drivers/net/wireless/intel/iwlwifi/queue/tx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use of uninitialized resource

EUVDB-ID: #VU90863

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36927

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the raw_sendmsg() function in net/ipv4/raw.c, within the __ip_make_skb() function in net/ipv4/ip_output.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Improper locking

EUVDB-ID: #VU91441

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36936

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the list_del() function in drivers/firmware/efi/unaccepted_memory.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Double Free

EUVDB-ID: #VU90885

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36940

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the pinctrl_enable() function in drivers/pinctrl/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) NULL pointer dereference

EUVDB-ID: #VU90528

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36941

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nl80211_set_coalesce() function in net/wireless/nl80211.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Buffer overflow

EUVDB-ID: #VU93469

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36946

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the rtm_phonet_notify() function in net/phonet/pn_netlink.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper privilege management

EUVDB-ID: #VU93733

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36963

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to read and manipulate data.

The vulnerability exists due to improperly imposed permissions within the DEFINE_SPINLOCK(), tracefs_apply_options() and tracefs_d_revalidate() functions in fs/tracefs/inode.c, within the eventfs_remount() function in fs/tracefs/event_inode.c. A local user can read and manipulate data.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use-after-free

EUVDB-ID: #VU91597

Risk: Critical

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2024-36971

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to a use-after-free error within the xfrm_link_failure() function in net/xfrm/xfrm_policy.c, within the dst_entry ip6_dst_check() and ip6_dst_check() functions in net/ipv6/route.c, within the dst_entry ipv4_dst_check() and ip_do_redirect() functions in net/ipv4/route.c. A remote attacker can send specially crafted packets to the system and execute arbitrary code.

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

26) Improper locking

EUVDB-ID: #VU92363

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38594

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tc_taprio_configure() function in drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c, within the stmmac_adjust_time() function in drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) NULL pointer dereference

EUVDB-ID: #VU92341

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38608

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mlx5e_resume(), _mlx5e_suspend(), mlx5e_suspend(), _mlx5e_probe() and _mlx5e_remove() functions in drivers/net/ethernet/mellanox/mlx5/core/en_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Use-after-free

EUVDB-ID: #VU92314

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38612

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the IS_ENABLED() function in net/ipv6/seg6.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Input validation error

EUVDB-ID: #VU94287

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40999

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ena_com_cdesc_rx_pkt_get() and ena_com_rx_pkt() functions in drivers/net/ethernet/amazon/ena/ena_eth_com.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Use-after-free

EUVDB-ID: #VU94937

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42104

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_check_page() and nilfs_error() functions in fs/nilfs2/dir.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Resource management error

EUVDB-ID: #VU95058

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42128

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the an30259a_probe() function in drivers/leds/leds-an30259a.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Input validation error

EUVDB-ID: #VU95090

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42157

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pkey_unlocked_ioctl() function in drivers/s390/crypto/pkey_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Buffer overflow

EUVDB-ID: #VU95078

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42229

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the setkey_unaligned() function in crypto/cipher.c, within the setkey_unaligned() function in crypto/aead.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Use-after-free

EUVDB-ID: #VU95503

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42232

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the delayed_work() and EXPORT_SYMBOL() functions in net/ceph/mon_client.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Memory leak

EUVDB-ID: #VU95502

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42236

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the usb_string_copy() function in drivers/usb/gadget/configfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU96106

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42280

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the hfcmulti_dtmf() and HFC_wait_nodebug() functions in drivers/isdn/hardware/mISDN/hfcmulti.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Memory leak

EUVDB-ID: #VU96195

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42283

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nla_put_nh_group() function in net/ipv4/nexthop.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) NULL pointer dereference

EUVDB-ID: #VU96141

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42286

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qla_nvme_register_remote() function in drivers/scsi/qla2xxx/qla_nvme.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) NULL pointer dereference

EUVDB-ID: #VU96140

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42287

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __qla2x00_abort_all_cmds() function in drivers/scsi/qla2xxx/qla_os.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) NULL pointer dereference

EUVDB-ID: #VU96139

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42289

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qla24xx_disable_vp() function in drivers/scsi/qla2xxx/qla_mid.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Resource management error

EUVDB-ID: #VU96181

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42290

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the imx_irqsteer_get_reg_index(), imx_irqsteer_irq_mask() and imx_irqsteer_probe() functions in drivers/irqchip/irq-imx-irqsteer.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Out-of-bounds read

EUVDB-ID: #VU96114

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42292

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the zap_modalias_env() function in lib/kobject_uevent.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Improper error handling

EUVDB-ID: #VU96166

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42295

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nilfs_btree_get_new_block() function in fs/nilfs2/btree.c, within the nilfs_btnode_create_block() function in fs/nilfs2/btnode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Input validation error

EUVDB-ID: #VU96193

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42299

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the blksize_bits() function in fs/ntfs3/fslog.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Resource management error

EUVDB-ID: #VU96182

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42305

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the add_dirent_to_buf() and make_indexed_dir() functions in fs/ext4/namei.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Buffer overflow

EUVDB-ID: #VU96184

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42306

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the udf_sb_free_bitmap() function in fs/udf/super.c, within the read_block_bitmap() and __load_block_bitmap() functions in fs/udf/balloc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) NULL pointer dereference

EUVDB-ID: #VU96136

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42308

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dc_plane_get_status() function in drivers/gpu/drm/amd/display/dc/core/dc_surface.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) NULL pointer dereference

EUVDB-ID: #VU96135

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42309

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the psb_intel_lvds_get_modes() function in drivers/gpu/drm/gma500/psb_intel_lvds.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Use of uninitialized resource

EUVDB-ID: #VU96172

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42311

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hfs_new_inode() and hfs_inode_read_fork() functions in fs/hfs/inode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Use-after-free

EUVDB-ID: #VU96109

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42313

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vdec_close() function in drivers/media/platform/qcom/venus/vdec.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Resource management error

EUVDB-ID: #VU96189

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42322

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ip_vs_add_service() function in net/netfilter/ipvs/ip_vs_ctl.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) NULL pointer dereference

EUVDB-ID: #VU96127

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43823

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ks_pcie_setup_rc_app_regs() and ks_pcie_host_init() functions in drivers/pci/controller/dwc/pci-keystone.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Use of uninitialized resource

EUVDB-ID: #VU96169

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43828

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ext4_es_find_extent_range() function in fs/ext4/extents_status.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Double free

EUVDB-ID: #VU96162

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43830

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the led_trigger_set() function in drivers/leds/led-triggers.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Input validation error

EUVDB-ID: #VU96196

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43831

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the vpu_dec_init() function in drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Use-after-free

EUVDB-ID: #VU96103

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43834

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the xdp_unreg_mem_model() function in net/core/xdp.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Resource management error

EUVDB-ID: #VU96178

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43840

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the prepare_trampoline() function in arch/arm64/net/bpf_jit_comp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) NULL pointer dereference

EUVDB-ID: #VU96118

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43860

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the imx_rproc_addr_init() function in drivers/remoteproc/imx_rproc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Race condition

EUVDB-ID: #VU96546

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43892

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the MEM_CGROUP_ID_MAX(), mem_cgroup_alloc() and mem_cgroup_css_online() functions in mm/memcontrol.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Improper locking

EUVDB-ID: #VU96540

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43893

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the uart_set_info() function in drivers/tty/serial/serial_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) NULL pointer dereference

EUVDB-ID: #VU96536

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43894

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the drm_client_modeset_probe() function in drivers/gpu/drm/drm_client_modeset.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Memory leak

EUVDB-ID: #VU96512

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44931

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the gpiochip_get_desc() function in drivers/gpio/gpiolib.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Improper locking

EUVDB-ID: #VU96857

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44952

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the make_driver_name() and module_remove_driver() functions in drivers/base/module.c, within the dev_uevent() and uevent_show() functions in drivers/base/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) NULL pointer dereference

EUVDB-ID: #VU96848

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44990

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the bond_ipsec_offload_ok() function in drivers/net/bonding/bond_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Use of uninitialized resource

EUVDB-ID: #VU97182

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-45018

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the nf_flow_offload_tuple() function in net/netfilter/nf_flow_table_offload.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Division by zero

EUVDB-ID: #VU97276

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46676

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the pn533_start_poll() function in drivers/nfc/pn533/pn533.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Infinite loop

EUVDB-ID: #VU97279

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46689

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the cmd_db_dev_probe() function in drivers/soc/qcom/cmd-db.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) NULL pointer dereference

EUVDB-ID: #VU97261

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46691

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pmic_glink_ucsi_notify(), pmic_glink_ucsi_callback() and pmic_glink_ucsi_probe() functions in drivers/usb/typec/ucsi/ucsi_glink.c, within the EXPORT_SYMBOL_GPL() function in drivers/soc/qcom/pmic_glink.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Buffer overflow

EUVDB-ID: #VU97285

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46709

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the vmw_stdu_bo_cpu_commit() and vmw_stdu_bo_populate_update_cpu() functions in drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c, within the vmw_bo_cpu_blit_line() and vmw_bo_cpu_blit() functions in drivers/gpu/drm/vmwgfx/vmwgfx_blit.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Input validation error

EUVDB-ID: #VU97572

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46716

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the msgdma_free_descriptor() and msgdma_chan_desc_cleanup() functions in drivers/dma/altera-msgdma.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Buffer overflow

EUVDB-ID: #VU97557

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46726

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dcn_bw_update_from_pplib_fclks() function in drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Input validation error

EUVDB-ID: #VU97566

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46754

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the net/core/filter.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) NULL pointer dereference

EUVDB-ID: #VU97516

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46795

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the smb2_sess_setup() function in fs/ksmbd/smb2pdu.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) NULL pointer dereference

EUVDB-ID: #VU97793

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46805

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the psp_xgmi_reflect_topology_info() function in drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) NULL pointer dereference

EUVDB-ID: #VU97796

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46810

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the tc_irq_handler() function in drivers/gpu/drm/bridge/tc358767.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Resource management error

EUVDB-ID: #VU97830

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46817

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the amdgpu_dm_initialize_drm_device() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) NULL pointer dereference

EUVDB-ID: #VU97797

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46819

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nbio_v7_4_handle_ras_controller_intr_no_bifring() function in drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Input validation error

EUVDB-ID: #VU97841

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46821

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the navi10_get_current_clk_freq_by_table(), navi10_emit_clk_levels(), navi10_print_clk_levels() and navi10_force_clk_levels() functions in drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) NULL pointer dereference

EUVDB-ID: #VU97798

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46822

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the arch/arm64/include/asm/acpi.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Input validation error

EUVDB-ID: #VU97839

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46826

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the fs/binfmt_elf.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Improper locking

EUVDB-ID: #VU97804

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46830

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the kvm_arch_vcpu_ioctl() function in arch/x86/kvm/x86.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Input validation error

EUVDB-ID: #VU97837

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46836

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ast_udc_getstatus() function in drivers/usb/gadget/udc/aspeed_udc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Improper locking

EUVDB-ID: #VU97806

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46838

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mm/userfaultfd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Improper locking

EUVDB-ID: #VU97808

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46840

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the reada_walk_down(), walk_down_proc(), do_walk_down() and walk_up_proc() functions in fs/btrfs/extent-tree.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Memory leak

EUVDB-ID: #VU97776

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46854

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dpaa_start_xmit() function in drivers/net/ethernet/freescale/dpaa/dpaa_eth.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Memory leak

EUVDB-ID: #VU97777

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46855

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_socket_eval() function in net/netfilter/nft_socket.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Use-after-free

EUVDB-ID: #VU97783

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46858

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mptcp_pm_del_add_timer() and remove_anno_list_by_saddr() functions in net/mptcp/pm_netlink.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Out-of-bounds read

EUVDB-ID: #VU97791

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46859

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the DEVICE_ATTR_RW(), acpi_pcc_hotkey_resume() and acpi_pcc_hotkey_add() functions in drivers/platform/x86/panasonic-laptop.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Improper locking

EUVDB-ID: #VU98369

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47658

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the stm32_cryp_irq_thread() function in drivers/crypto/stm32/stm32-cryp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-47.0.0.52

python3-perf: before 6.6.0-47.0.0.52

perf-debuginfo: before 6.6.0-47.0.0.52

perf: before 6.6.0-47.0.0.52

kernel-tools-devel: before 6.6.0-47.0.0.52

kernel-tools-debuginfo: before 6.6.0-47.0.0.52

kernel-tools: before 6.6.0-47.0.0.52

kernel-source: before 6.6.0-47.0.0.52

kernel-headers: before 6.6.0-47.0.0.52

kernel-devel: before 6.6.0-47.0.0.52

kernel-debugsource: before 6.6.0-47.0.0.52

kernel-debuginfo: before 6.6.0-47.0.0.52

bpftool-debuginfo: before 6.6.0-47.0.0.52

bpftool: before 6.6.0-47.0.0.52

kernel: before 6.6.0-47.0.0.52

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2296

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Input validation error

EUVDB-ID: #VU98379

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47665