openEuler 24.03 LTS update for kernel

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bnxt_qplib_create_qp() function in drivers/infiniband/hw/bnxt_re/qplib_fp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) NULL pointer dereference

EUVDB-ID: #VU92350

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38547

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the load_video_binaries() function in drivers/staging/media/atomisp/pci/sh_css.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource management error

EUVDB-ID: #VU93178

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39292

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the register_winch_irq() function in arch/um/drivers/line.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU94313

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39497

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the drm_gem_shmem_mmap() function in drivers/gpu/drm/drm_gem_shmem_helper.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Memory leak

EUVDB-ID: #VU94207

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40942

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mesh_path_discard_frame() function in net/mac80211/mesh_pathtbl.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU94843

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41017

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __jfs_getxattr() and jfs_listxattr() functions in fs/jfs/xattr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper error handling

EUVDB-ID: #VU95022

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41022

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the sdma_v4_0_process_trap_irq() function in drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Resource management error

EUVDB-ID: #VU95071

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41027

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the userfaultfd_api() function in fs/userfaultfd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper error handling

EUVDB-ID: #VU95020

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41034

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nilfs_dotdot() function in fs/nilfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) NULL pointer dereference

EUVDB-ID: #VU94979

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41055

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/mmzone.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Memory leak

EUVDB-ID: #VU94926

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41065

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the alloc_dispatch_log_kmem_cache() function in arch/powerpc/platforms/pseries/setup.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Use-after-free

EUVDB-ID: #VU94942

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41070

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kvm_spapr_tce_attach_iommu_group() function in arch/powerpc/kvm/book3s_64_vio.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Memory leak

EUVDB-ID: #VU94929

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41078

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the btrfs_quota_disable() function in fs/btrfs/qgroup.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Resource management error

EUVDB-ID: #VU95051

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41081

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ila_output() function in net/ipv6/ila/ila_lwt.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) NULL pointer dereference

EUVDB-ID: #VU94971

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41089

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv17_tv_get_hd_modes() function in drivers/gpu/drm/nouveau/dispnv04/tvnv17.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) NULL pointer dereference

EUVDB-ID: #VU94966

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41095

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv17_tv_get_ld_modes() function in drivers/gpu/drm/nouveau/dispnv04/tvnv17.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Resource management error

EUVDB-ID: #VU95067

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41097

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the cxacru_bind() function in drivers/usb/atm/cxacru.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Use of uninitialized resource

EUVDB-ID: #VU95031

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42076

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the MODULE_ALIAS() and j1939_send_one() functions in net/can/j1939/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Resource management error

EUVDB-ID: #VU95068

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42077

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ocfs2_extend_trans() function in fs/ocfs2/journal.c, within the ocfs2_dio_end_io_write() function in fs/ocfs2/aops.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Input validation error

EUVDB-ID: #VU95103

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42080

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the rdma_restrack_init() and type2str() functions in drivers/infiniband/core/restrack.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Buffer overflow

EUVDB-ID: #VU95055

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42082

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the __xdp_reg_mem_model() function in net/core/xdp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Improper neutralization of directives in statically saved code (\'static code injection\')

EUVDB-ID: #VU95052

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42084

CWE-ID: CWE-96 - Improper Neutralization of Directives in Statically Saved Code (\'Static Code Injection\')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. Changing the type of the compat syscall to the signed compat_off_t changes the behavior so it instead returns -EINVAL. The native entry point, the truncate() syscall and the corresponding loff_t based variants are all correct already and do not suffer from this mistake.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Resource management error

EUVDB-ID: #VU95066

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42087

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ili9881c_prepare() and ili9881c_unprepare() functions in drivers/gpu/drm/panel/panel-ilitek-ili9881c.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) NULL pointer dereference

EUVDB-ID: #VU94964

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42089

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fsl_asoc_card_probe() function in sound/soc/fsl/fsl-asoc-card.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Improper locking

EUVDB-ID: #VU94988

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42090

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the create_pinctrl() function in drivers/pinctrl/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Input validation error

EUVDB-ID: #VU95000

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42092

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the davinci_gpio_probe() function in drivers/gpio/gpio-davinci.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Buffer overflow

EUVDB-ID: #VU95039

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42093

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dpaa2_eth_xdp_xmit() and update_xps() functions in drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Buffer overflow

EUVDB-ID: #VU95040

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42094

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the iucv_setmask_mp() and iucv_cpu_online() functions in net/iucv/iucv.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Input validation error

EUVDB-ID: #VU95101

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42095

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the uart_write() and omap8250_irq() functions in drivers/tty/serial/8250/8250_omap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Improper locking

EUVDB-ID: #VU94987

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42096

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the profile_pc() function in arch/x86/kernel/time.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Input validation error

EUVDB-ID: #VU95100

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42098

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ecdh_set_secret() function in crypto/ecdh.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use of uninitialized resource

EUVDB-ID: #VU95024

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42106

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the inet_diag_dump_compat() and inet_diag_get_exact_compat() functions in net/ipv4/inet_diag.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Improper error handling

EUVDB-ID: #VU95015

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42119

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the find_first_free_audio() function in drivers/gpu/drm/amd/display/dc/core/dc_resource.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Input validation error

EUVDB-ID: #VU95097

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42124

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qedf_execute_tmf() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Use-after-free

EUVDB-ID: #VU94931

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42137

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the qca_serdev_shutdown() function in drivers/bluetooth/hci_qca.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Out-of-bounds read

EUVDB-ID: #VU94951

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42143

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the orangefs_statfs() function in fs/orangefs/super.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Buffer overflow

EUVDB-ID: #VU95054

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Out-of-bounds read

EUVDB-ID: #VU94952

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42148

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/net/ethernet/broadcom/bnx2x/bnx2x.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Input validation error

EUVDB-ID: #VU95510

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42244

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the mos7840_port_remove() function in drivers/usb/serial/mos7840.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Infinite loop

EUVDB-ID: #VU95515

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42246

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the xs_tcp_setup_socket() function in net/sunrpc/xprtsock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Input validation error

EUVDB-ID: #VU96206

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42281

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the bpf_skb_net_grow() function in net/core/filter.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Buffer overflow

EUVDB-ID: #VU96177

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42288

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the qla2x00_number_of_exch() function in drivers/scsi/qla2xxx/qla_os.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Improper error handling

EUVDB-ID: #VU96164

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42304

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the __ext4_read_dirblock(), ext4_empty_dir() and ext4_get_first_dir_block() functions in fs/ext4/namei.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) NULL pointer dereference

EUVDB-ID: #VU96134

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42310

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cdv_intel_lvds_get_modes() function in drivers/gpu/drm/gma500/cdv_intel_lvds.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Input validation error

EUVDB-ID: #VU96210

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42318

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the hook_cred_prepare() and hook_cred_free() functions in security/landlock/cred.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Input validation error

EUVDB-ID: #VU96197

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43839

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the bnad_tx_msix_register() and bnad_rx_msix_register() functions in drivers/net/ethernet/brocade/bna/bnad.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Memory leak

EUVDB-ID: #VU96099

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43854

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the bio_integrity_prep() function in block/bio-integrity.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Resource management error

EUVDB-ID: #VU96304

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43879

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the cfg80211_calculate_bitrate_he() function in net/wireless/util.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Type Confusion

EUVDB-ID: #VU96639

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44944

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input within the ctnetlink_del_expect() function in net/netfilter/nf_conntrack_netlink.c. A local user can trigger a type confusion error and gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) NULL pointer dereference

EUVDB-ID: #VU96852

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-45006

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xhci_configure_endpoint() and xhci_setup_device() functions in drivers/usb/host/xhci.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) NULL pointer dereference

EUVDB-ID: #VU97256

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46707

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the access_gic_sgi() function in arch/arm64/kvm/sys_regs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) NULL pointer dereference

EUVDB-ID: #VU97520

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46770

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_prepare_for_reset(), ice_update_pf_netdev_link() and ice_rebuild() functions in drivers/net/ethernet/intel/ice/ice_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Out-of-bounds read

EUVDB-ID: #VU97786

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46828

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the net/sched/sch_cake.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Infinite loop

EUVDB-ID: #VU97820

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46848

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the adl_get_hybrid_cpu_type() and intel_pmu_init() functions in arch/x86/events/intel/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Out-of-bounds read

EUVDB-ID: #VU98365

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47670

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ocfs2_listxattr(), ocfs2_xattr_find_entry(), ocfs2_xattr_ibody_get(), ocfs2_xattr_ibody_find() and ocfs2_xattr_block_find() functions in fs/ocfs2/xattr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Input validation error

EUVDB-ID: #VU99041

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49938

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ath9k_hif_usb_rx_cb() and ath9k_hif_usb_reg_in_cb() functions in drivers/net/wireless/ath/ath9k/hif_usb.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) NULL pointer dereference

EUVDB-ID: #VU98953

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49944

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the sctp_listen_start() function in net/sctp/socket.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Buffer overflow

EUVDB-ID: #VU99151

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49952

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nf_dup_ipv6_route() and nf_dup_ipv6() functions in net/ipv6/netfilter/nf_dup_ipv6.c, within the nf_dup_ipv4() function in net/ipv4/netfilter/nf_dup_ipv4.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Improper locking

EUVDB-ID: #VU99017

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49959

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __releases() function in fs/jbd2/checkpoint.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Resource management error

EUVDB-ID: #VU99150

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49963

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bcm2835_mbox_probe() function in drivers/mailbox/bcm2835-mailbox.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Use-after-free

EUVDB-ID: #VU99442

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50073

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the gsm_cleanup_mux() function in drivers/tty/n_gsm.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) NULL pointer dereference

EUVDB-ID: #VU99822

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50133

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the stack_top() function in arch/loongarch/kernel/process.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Input validation error

EUVDB-ID: #VU100081

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50142

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the verify_newsa_info() function in net/xfrm/xfrm_user.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Memory leak

EUVDB-ID: #VU100053

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50167

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the be_xmit() function in drivers/net/ethernet/emulex/benet/be_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Memory leak

EUVDB-ID: #VU100054

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50168

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the sun3_82586_send_packet() function in drivers/net/ethernet/i825xx/sun3_82586.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Incorrect calculation

EUVDB-ID: #VU100202

Risk: Low

CVSSv4.0: 5.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2024-50251

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: Yes

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the nft_payload_set_eval() function in net/netfilter/nft_payload.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

70) NULL pointer dereference

EUVDB-ID: #VU100709

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53050

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the intel_dp_hdcp2_get_capability() function in drivers/gpu/drm/i915/display/intel_dp_hdcp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Out-of-bounds read

EUVDB-ID: #VU100938

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53099

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bpf_link_show_fdinfo() function in kernel/bpf/syscall.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Use of uninitialized resource

EUVDB-ID: #VU100940

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53101

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ocfs2_setattr() function in fs/ocfs2/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Improper locking

EUVDB-ID: #VU101227

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53128

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the include/linux/sched/task_stack.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Out-of-bounds read

EUVDB-ID: #VU101910

Risk: High

CVSSv4.0: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2024-53150

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the DESC_LENGTH_CHECK(), validate_clock_source() and validate_clock_selector() functions in sound/usb/clock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

75) Use of uninitialized resource

EUVDB-ID: #VU101917

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53155

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ocfs2_file_write_iter() and ocfs2_file_read_iter() functions in fs/ocfs2/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) NULL pointer dereference

EUVDB-ID: #VU101914

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53157

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the scpi_dvfs_get_info() function in drivers/firmware/arm_scpi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Integer underflow

EUVDB-ID: #VU101924

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53158

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the geni_se_clk_tbl_get() function in drivers/soc/qcom/qcom-geni-se.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Buffer overflow

EUVDB-ID: #VU101925

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53159

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the store_target_temp(), store_temp_tolerance() and store_weight_temp() functions in drivers/hwmon/nct6775-core.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Race condition within a thread

EUVDB-ID: #VU101926

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53160

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

Description

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the krc_count(), schedule_delayed_monitor_work() and kvfree_call_rcu() functions in kernel/rcu/tree.c. A local user can corrupt data.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Use-after-free

EUVDB-ID: #VU102059

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53171

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the get_znodes_to_commit() function in fs/ubifs/tnc_commit.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Improper Initialization

EUVDB-ID: #VU102222

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53180

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the snd_pcm_mmap_data_fault() function in sound/core/pcm_native.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Buffer overflow

EUVDB-ID: #VU102214

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53187

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the io_pin_pages() function in io_uring/memmap.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Improper locking

EUVDB-ID: #VU102173

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53190

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the efuse_write_1byte() and read_efuse_byte() functions in drivers/net/wireless/realtek/rtlwifi/efuse.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Double free

EUVDB-ID: #VU102194

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53191

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ath12k_dp_free() function in drivers/net/wireless/ath/ath12k/dp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Use-after-free

EUVDB-ID: #VU102049

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53194

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pci_slot_release(), pci_bus_get() and make_slot_name() functions in drivers/pci/slot.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Improper error handling

EUVDB-ID: #VU102209

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53196

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the kvm_mmio_read_buf() and kvm_handle_mmio_return() functions in arch/arm64/kvm/mmio.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Integer underflow

EUVDB-ID: #VU102211

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53203

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the ucsi_ccg_sync_control() function in drivers/usb/typec/ucsi/ucsi_ccg.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Double free

EUVDB-ID: #VU102195

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53213

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the lan78xx_probe() function in drivers/net/usb/lan78xx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Improper error handling

EUVDB-ID: #VU102208

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53215

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the svc_rdma_proc_init() function in net/sunrpc/xprtrdma/svc_rdma.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Use-after-free

EUVDB-ID: #VU102066

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53218

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the f2fs_do_shutdown() function in fs/f2fs/file.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) NULL pointer dereference

EUVDB-ID: #VU102132

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53219

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the virtio_fs_get_tree() function in fs/fuse/virtio_fs.c, within the fuse_read_args_fill(), fuse_release_user_pages(), fuse_aio_complete_req(), fuse_get_frag_size(), fuse_get_user_pages() and fuse_direct_io() functions in fs/fuse/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) NULL pointer dereference

EUVDB-ID: #VU102141

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53224

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mlx5_ib_dev_res_init(), mlx5_ib_stage_delay_drop_cleanup(), mlx5_ib_stage_dev_notifier_init() and STAGE_CREATE() functions in drivers/infiniband/hw/mlx5/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) NULL pointer dereference

EUVDB-ID: #VU102142

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53226

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hns_roce_set_page() and hns_roce_map_mr_sg() functions in drivers/infiniband/hw/hns/hns_roce_mr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Infinite loop

EUVDB-ID: #VU102217

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53229

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the rxe_requester() function in drivers/infiniband/sw/rxe/rxe_req.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) NULL pointer dereference

EUVDB-ID: #VU102144

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53231

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cppc_get_cpu_power() function in drivers/cpufreq/cppc_cpufreq.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Resource management error

EUVDB-ID: #VU102251

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53234

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the z_erofs_load_compact_lcluster() and z_erofs_get_extent_decompressedlen() functions in fs/erofs/zmap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Use-after-free

EUVDB-ID: #VU102070

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53239

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the usb6fire_chip_abort(), usb6fire_chip_destroy(), usb6fire_chip_probe() and usb6fire_chip_disconnect() functions in sound/usb/6fire/chip.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Processor optimization removal or modification of security-critical code

EUVDB-ID: #VU101817

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53241

CWE-ID: CWE-1037 - Processor optimization removal or modification of security-critical code

Exploit availability: No

Description

The vulnerability allows a malicious guest to gain access to sensitive information.

The vulnerability exists due to implemented mitigations for hardware vulnerabilities related to Xen hypercall page implementation the guest OS is relying on to work might not be fully functional, resulting in e.g. guest user processes being able to read data they ought not have access to.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Input validation error

EUVDB-ID: #VU102991

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-55639

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the rswitch_device_alloc(), of_node_put() and rswitch_device_free() functions in drivers/net/ethernet/renesas/rswitch.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Resource management error

EUVDB-ID: #VU102252

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56543

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ath12k_mac_peer_cleanup_all() function in drivers/net/wireless/ath/ath12k/mac.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Use-after-free

EUVDB-ID: #VU102074

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56546

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the xlnx_add_cb_for_suspend() function in drivers/soc/xilinx/xlnx_event_manager.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) NULL pointer dereference

EUVDB-ID: #VU102151

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56549

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cachefiles_ondemand_fd_write_iter() and cachefiles_ondemand_fd_llseek() functions in fs/cachefiles/ondemand.c, within the cachefiles_commit_object() and cachefiles_clean_up_object() functions in fs/cachefiles/interface.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Input validation error

EUVDB-ID: #VU102279

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56562

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the i3c_master_put_i3c_addrs() function in drivers/i3c/master.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Input validation error

EUVDB-ID: #VU102280

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56570

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ovl_dentry_init_flags() function in fs/overlayfs/util.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Memory leak

EUVDB-ID: #VU101996

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56572

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the allocate_buffers_internal() function in drivers/media/platform/allegro-dvt/allegro-core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Use-after-free

EUVDB-ID: #VU102045

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56582

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the btrfs_encoded_read_endio() function in fs/btrfs/inode.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Resource management error

EUVDB-ID: #VU102243

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56583

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the enqueue_dl_entity() function in kernel/sched/deadline.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Improper locking

EUVDB-ID: #VU102169

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56585

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the setup_tlb_handler() function in arch/loongarch/mm/tlb.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Improper error handling

EUVDB-ID: #VU102204

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56586

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the f2fs_write_inode() function in fs/f2fs/inode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Improper locking

EUVDB-ID: #VU102167

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56592

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the htab_elem_free(), free_htab_elem(), alloc_htab_elem(), htab_map_update_elem(), htab_map_delete_elem() and prealloc_lru_pop() functions in kernel/bpf/hashtab.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Improper locking

EUVDB-ID: #VU102160

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56594

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the amdgpu_ttm_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Out-of-bounds read

EUVDB-ID: #VU102088

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56595

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dbAdjTree() function in fs/jfs/jfs_dmap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Out-of-bounds read

EUVDB-ID: #VU102087

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56596

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the jfs_readdir() function in fs/jfs/jfs_dtree.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Out-of-bounds read

EUVDB-ID: #VU102086

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56597

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dbAllocCtl() function in fs/jfs/jfs_dmap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Use-after-free

EUVDB-ID: #VU102020

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56605

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the l2cap_sock_alloc() function in net/bluetooth/l2cap_sock.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Improper locking

EUVDB-ID: #VU102165

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56609

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the rtw_usb_tx_handler() and rtw_usb_deinit_tx() functions in drivers/net/wireless/realtek/rtw88/usb.c, within the rtw_sdio_deinit_tx() function in drivers/net/wireless/realtek/rtw88/sdio.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Memory leak

EUVDB-ID: #VU101995

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56613

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the kernel/sched/fair.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Use-after-free

EUVDB-ID: #VU102022

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56619

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_put_page() function in fs/nilfs2/dir.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Input validation error

EUVDB-ID: #VU102283

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56622

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the read_req_latency_avg_show() and write_req_latency_avg_show() functions in drivers/ufs/core/ufs-sysfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Out-of-bounds read

EUVDB-ID: #VU102081

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56626

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the smb2_write() function in fs/smb/server/smb2pdu.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Use-after-free

EUVDB-ID: #VU102024

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56631

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sg_release() function in drivers/scsi/sg.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Use-after-free

EUVDB-ID: #VU102025

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56633

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sock_put() function in net/ipv4/tcp_bpf.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Input validation error

EUVDB-ID: #VU102185

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56638

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nft_inner_parse() and nft_inner_parse_needed() functions in net/netfilter/nft_inner.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) NULL pointer dereference

EUVDB-ID: #VU102117

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56649

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the EXPORT_SYMBOL_GPL() function in drivers/net/ethernet/freescale/enetc/enetc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) Incorrect calculation

EUVDB-ID: #VU102257

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56654

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the hci_le_create_big_complete_evt() function in net/bluetooth/hci_event.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) NULL pointer dereference

EUVDB-ID: #VU102118

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56660

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dr_domain_add_vport_cap() function in drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_domain.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Out-of-bounds read

EUVDB-ID: #VU102077

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56662

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the acpi_nfit_ctl() function in drivers/acpi/nfit/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) Input validation error

EUVDB-ID: #VU102187

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56663

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the NLA_POLICY_NESTED_ARRAY() function in net/wireless/nl80211.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) NULL pointer dereference

EUVDB-ID: #VU102121

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56667

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the capture_engine() function in drivers/gpu/drm/i915/i915_gpu_error.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Use-after-free

EUVDB-ID: #VU102035

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56672

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the blkcg_unpin_online() function in block/blk-cgroup.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Input validation error

EUVDB-ID: #VU102277

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56679

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the otx2_get_max_mtu() function in drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) Resource management error

EUVDB-ID: #VU102226

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56691

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the wcove_typec_probe() function in drivers/usb/typec/tcpm/wcove.c, within the ARRAY_SIZE(), bxtwc_add_chained_irq_chip() and bxtwc_probe() functions in drivers/mfd/intel_soc_pmic_bxtwc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) Input validation error

EUVDB-ID: #VU102266

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56720

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the sk_msg_shift_left() and BPF_CALL_4() functions in net/core/filter.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) Input validation error

EUVDB-ID: #VU102270

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56726

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the cn10k_alloc_leaf_profile() function in drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

135) Improper locking

EUVDB-ID: #VU102154

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56739

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the rtc_timer_do_work() function in drivers/rtc/interface.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

136) Memory leak

EUVDB-ID: #VU101983

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56742

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mlx5vf_add_migration_pages() function in drivers/vfio/pci/mlx5/cmd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

137) Memory leak

EUVDB-ID: #VU101982

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56745

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the reset_method_store() function in drivers/pci/pci.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

138) Memory leak

EUVDB-ID: #VU101980

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56747

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the qedi_alloc_and_init_sb() function in drivers/scsi/qedi/qedi_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

139) Input validation error

EUVDB-ID: #VU102265

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56755

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the fs/netfs/fscache_volume.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

140) Use-after-free

EUVDB-ID: #VU102008

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56756

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nvme_free_host_mem(), __nvme_alloc_host_mem() and kfree() functions in drivers/nvme/host/pci.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

141) Use-after-free

EUVDB-ID: #VU102393

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56759

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the btrfs_force_cow_block() and btrfs_cow_block() functions in fs/btrfs/ctree.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-75.0.0.68

python3-perf: before 6.6.0-75.0.0.68

perf-debuginfo: before 6.6.0-75.0.0.68

perf: before 6.6.0-75.0.0.68

kernel-tools-devel: before 6.6.0-75.0.0.68

kernel-tools-debuginfo: before 6.6.0-75.0.0.68

kernel-tools: before 6.6.0-75.0.0.68

kernel-source: before 6.6.0-75.0.0.68

kernel-headers: before 6.6.0-75.0.0.68

kernel-devel: before 6.6.0-75.0.0.68

kernel-debugsource: before 6.6.0-75.0.0.68

kernel-debuginfo: before 6.6.0-75.0.0.68

bpftool-debuginfo: before 6.6.0-75.0.0.68

bpftool: before 6.6.0-75.0.0.68

kernel: before 6.6.0-75.0.0.68

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1078

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

142) Resource management error

EUVDB-ID: #VU102404

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56763