openEuler 22.03 LTS SP1 update for kernel



Risk Medium
Patch available YES
Number of vulnerabilities 15
CVE-ID CVE-2022-48868
CVE-2022-48949
CVE-2022-48971
CVE-2022-49014
CVE-2022-49015
CVE-2022-49022
CVE-2022-49028
CVE-2023-52922
CVE-2023-6356
CVE-2023-6535
CVE-2024-46765
CVE-2024-50086
CVE-2024-50218
CVE-2024-53142
CVE-2024-53150
CWE-ID CWE-476
CWE-119
CWE-399
CWE-682
CWE-20
CWE-667
CWE-416
CWE-908
CWE-125
Exploitation vector Network
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 15 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU96348

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48868

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __drv_enable_wq() function in drivers/dma/idxd/device.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU99153

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48949

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the igb_vf_reset_msg() function in drivers/net/ethernet/intel/igb/igb_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU99141

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48971

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bt_init() and sock_unregister() functions in net/bluetooth/af_bluetooth.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Incorrect calculation

EUVDB-ID: #VU99182

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49014

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the __tun_detach() and tun_detach() functions in drivers/net/tun.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU99199

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49015

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the hsr_deliver_master() function in net/hsr/hsr_forward.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU99200

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49022

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ieee80211_get_rate_duration() function in net/mac80211/airtime.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper locking

EUVDB-ID: #VU99008

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49028

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ixgbevf_init_module() function in drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU101033

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52922

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the bcm_release() function in net/can/bcm.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) NULL pointer dereference

EUVDB-ID: #VU85854

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-6356

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the nvmet_tcp_build_iovec() function in the Linux kernel's NVMe driver. A remote attacker can pass specially crafted TCP packets to the system and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) NULL pointer dereference

EUVDB-ID: #VU85853

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-6535

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the nvmet_tcp_execute_request() function in the Linux kernel's NVMe driver. A remote attacker can send specially crafted NVMe-oF/TCP packets to the system and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) NULL pointer dereference

EUVDB-ID: #VU97522

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46765

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_xsk_pool_setup() function in drivers/net/ethernet/intel/ice/ice_xsk.c, within the ice_clear_hw_tbls(), ice_xdp_setup_prog() and ice_xdp() functions in drivers/net/ethernet/intel/ice/ice_main.c, within the ice_vsi_free(), ice_vsi_alloc() and ice_vsi_rebuild() functions in drivers/net/ethernet/intel/ice/ice_lib.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU99444

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50086

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smb2_check_user_session(), smb2_sess_setup() and smb2_session_logoff() functions in fs/smb/server/smb2pdu.c, within the __handle_ksmbd_work() function in fs/smb/server/server.c, within the ksmbd_expire_session(), ksmbd_session_lookup_slowpath(), ksmbd_session_lookup_all() and __session_create() functions in fs/smb/server/mgmt/user_session.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Input validation error

EUVDB-ID: #VU100187

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50218

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ocfs2_remove_inode_range() function in fs/ocfs2/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use of uninitialized resource

EUVDB-ID: #VU101347

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53142

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the do_name() and do_copy() functions in init/initramfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Out-of-bounds read

EUVDB-ID: #VU101910

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53150

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the DESC_LENGTH_CHECK(), validate_clock_source() and validate_clock_selector() functions in sound/usb/clock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

python3-perf-debuginfo: before 5.10.0-136.107.0.187

python3-perf: before 5.10.0-136.107.0.187

perf-debuginfo: before 5.10.0-136.107.0.187

perf: before 5.10.0-136.107.0.187

kernel-tools-devel: before 5.10.0-136.107.0.187

kernel-tools-debuginfo: before 5.10.0-136.107.0.187

kernel-tools: before 5.10.0-136.107.0.187

kernel-source: before 5.10.0-136.107.0.187

kernel-headers: before 5.10.0-136.107.0.187

kernel-devel: before 5.10.0-136.107.0.187

kernel-debugsource: before 5.10.0-136.107.0.187

kernel-debuginfo: before 5.10.0-136.107.0.187

kernel: before 5.10.0-136.107.0.187

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1016


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###