openEuler 20.03 LTS SP4 update for kernel



| Updated: 2025-04-08
Risk Low
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2024-53150
CVE-2024-53155
CVE-2024-53157
CVE-2024-56570
CVE-2024-56603
CVE-2024-56619
CVE-2024-56642
CVE-2024-56662
CVE-2024-56739
CWE-ID CWE-125
CWE-908
CWE-476
CWE-20
CWE-416
CWE-667
Exploitation vector Local
Public exploit Vulnerability #1 is being exploited in the wild.
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

python2-perf-debuginfo
Operating systems & Components / Operating system package or component

python2-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

bpftool-debuginfo
Operating systems & Components / Operating system package or component

bpftool
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU101910

Risk: High

CVSSv4.0: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2024-53150

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the DESC_LENGTH_CHECK(), validate_clock_source() and validate_clock_selector() functions in sound/usb/clock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Use of uninitialized resource

EUVDB-ID: #VU101917

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53155

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ocfs2_file_write_iter() and ocfs2_file_read_iter() functions in fs/ocfs2/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU101914

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53157

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the scpi_dvfs_get_info() function in drivers/firmware/arm_scpi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU102280

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56570

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ovl_dentry_init_flags() function in fs/overlayfs/util.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU102018

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56603

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the can_create() function in net/can/af_can.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU102022

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56619

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_put_page() function in fs/nilfs2/dir.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU102029

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56642

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cleanup_bearer() function in net/tipc/udp_media.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU102077

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56662

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the acpi_nfit_ctl() function in drivers/acpi/nfit/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper locking

EUVDB-ID: #VU102154

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56739

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the rtc_timer_do_work() function in drivers/rtc/interface.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python3-perf-debuginfo: before 4.19.90-2501.3.0.0312

python3-perf: before 4.19.90-2501.3.0.0312

python2-perf-debuginfo: before 4.19.90-2501.3.0.0312

python2-perf: before 4.19.90-2501.3.0.0312

perf-debuginfo: before 4.19.90-2501.3.0.0312

perf: before 4.19.90-2501.3.0.0312

kernel-tools-devel: before 4.19.90-2501.3.0.0312

kernel-tools-debuginfo: before 4.19.90-2501.3.0.0312

kernel-tools: before 4.19.90-2501.3.0.0312

kernel-source: before 4.19.90-2501.3.0.0312

kernel-devel: before 4.19.90-2501.3.0.0312

kernel-debugsource: before 4.19.90-2501.3.0.0312

kernel-debuginfo: before 4.19.90-2501.3.0.0312

bpftool-debuginfo: before 4.19.90-2501.3.0.0312

bpftool: before 4.19.90-2501.3.0.0312

kernel: before 4.19.90-2501.3.0.0312

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1067


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###