openEuler 22.03 LTS SP3 update for kernel



Risk Low
Patch available YES
Number of vulnerabilities 7
CVE-ID CVE-2024-50150
CVE-2024-56650
CVE-2024-56658
CVE-2024-56754
CVE-2024-57792
CVE-2024-57795
CVE-2024-57857
CWE-ID CWE-416
CWE-125
CWE-20
CWE-119
Exploitation vector Local
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU100059

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50150

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the typec_altmode_release() and typec_register_altmode() functions in drivers/usb/typec/class.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-251.0.0.154

python3-perf: before 5.10.0-251.0.0.154

perf-debuginfo: before 5.10.0-251.0.0.154

perf: before 5.10.0-251.0.0.154

kernel-tools-devel: before 5.10.0-251.0.0.154

kernel-tools-debuginfo: before 5.10.0-251.0.0.154

kernel-tools: before 5.10.0-251.0.0.154

kernel-source: before 5.10.0-251.0.0.154

kernel-headers: before 5.10.0-251.0.0.154

kernel-devel: before 5.10.0-251.0.0.154

kernel-debugsource: before 5.10.0-251.0.0.154

kernel-debuginfo: before 5.10.0-251.0.0.154

kernel: before 5.10.0-251.0.0.154

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1202


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU102078

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56650

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the led_tg_check() function in net/netfilter/xt_LED.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-251.0.0.154

python3-perf: before 5.10.0-251.0.0.154

perf-debuginfo: before 5.10.0-251.0.0.154

perf: before 5.10.0-251.0.0.154

kernel-tools-devel: before 5.10.0-251.0.0.154

kernel-tools-debuginfo: before 5.10.0-251.0.0.154

kernel-tools: before 5.10.0-251.0.0.154

kernel-source: before 5.10.0-251.0.0.154

kernel-headers: before 5.10.0-251.0.0.154

kernel-devel: before 5.10.0-251.0.0.154

kernel-debugsource: before 5.10.0-251.0.0.154

kernel-debuginfo: before 5.10.0-251.0.0.154

kernel: before 5.10.0-251.0.0.154

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1202


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU102033

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56658

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the LLIST_HEAD(), net_free() and cleanup_net() functions in net/core/net_namespace.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-251.0.0.154

python3-perf: before 5.10.0-251.0.0.154

perf-debuginfo: before 5.10.0-251.0.0.154

perf: before 5.10.0-251.0.0.154

kernel-tools-devel: before 5.10.0-251.0.0.154

kernel-tools-debuginfo: before 5.10.0-251.0.0.154

kernel-tools: before 5.10.0-251.0.0.154

kernel-source: before 5.10.0-251.0.0.154

kernel-headers: before 5.10.0-251.0.0.154

kernel-devel: before 5.10.0-251.0.0.154

kernel-debugsource: before 5.10.0-251.0.0.154

kernel-debuginfo: before 5.10.0-251.0.0.154

kernel: before 5.10.0-251.0.0.154

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1202


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU102273

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56754

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the caam_qi_init() function in drivers/crypto/caam/qi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-251.0.0.154

python3-perf: before 5.10.0-251.0.0.154

perf-debuginfo: before 5.10.0-251.0.0.154

perf: before 5.10.0-251.0.0.154

kernel-tools-devel: before 5.10.0-251.0.0.154

kernel-tools-debuginfo: before 5.10.0-251.0.0.154

kernel-tools: before 5.10.0-251.0.0.154

kernel-source: before 5.10.0-251.0.0.154

kernel-headers: before 5.10.0-251.0.0.154

kernel-devel: before 5.10.0-251.0.0.154

kernel-debugsource: before 5.10.0-251.0.0.154

kernel-debuginfo: before 5.10.0-251.0.0.154

kernel: before 5.10.0-251.0.0.154

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1202


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU102978

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57792

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the set_charge_current_limit() function in drivers/power/supply/gpio-charger.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-251.0.0.154

python3-perf: before 5.10.0-251.0.0.154

perf-debuginfo: before 5.10.0-251.0.0.154

perf: before 5.10.0-251.0.0.154

kernel-tools-devel: before 5.10.0-251.0.0.154

kernel-tools-debuginfo: before 5.10.0-251.0.0.154

kernel-tools: before 5.10.0-251.0.0.154

kernel-source: before 5.10.0-251.0.0.154

kernel-headers: before 5.10.0-251.0.0.154

kernel-devel: before 5.10.0-251.0.0.154

kernel-debugsource: before 5.10.0-251.0.0.154

kernel-debuginfo: before 5.10.0-251.0.0.154

kernel: before 5.10.0-251.0.0.154

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1202


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU102906

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57795

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rxe_query_port(), rxe_enable_driver(), INIT_RDMA_OBJ_SIZE() and rxe_register_device() functions in drivers/infiniband/sw/rxe/rxe_verbs.c, within the rxe_parent_name(), rxe_net_add() and rxe_port_down() functions in drivers/infiniband/sw/rxe/rxe_net.c, within the rxe_mcast_add() function in drivers/infiniband/sw/rxe/rxe_mcast.c, within the rxe_dealloc(), rxe_init_device_param(), rxe_init_port_param() and rxe_set_mtu() functions in drivers/infiniband/sw/rxe/rxe.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-251.0.0.154

python3-perf: before 5.10.0-251.0.0.154

perf-debuginfo: before 5.10.0-251.0.0.154

perf: before 5.10.0-251.0.0.154

kernel-tools-devel: before 5.10.0-251.0.0.154

kernel-tools-debuginfo: before 5.10.0-251.0.0.154

kernel-tools: before 5.10.0-251.0.0.154

kernel-source: before 5.10.0-251.0.0.154

kernel-headers: before 5.10.0-251.0.0.154

kernel-devel: before 5.10.0-251.0.0.154

kernel-debugsource: before 5.10.0-251.0.0.154

kernel-debuginfo: before 5.10.0-251.0.0.154

kernel: before 5.10.0-251.0.0.154

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1202


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU102910

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57857

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the siw_query_device(), siw_query_port() and siw_query_qp() functions in drivers/infiniband/sw/siw/siw_verbs.c, within the siw_device_create(), siw_netdev_event() and siw_newlink() functions in drivers/infiniband/sw/siw/siw_main.c, within the siw_create_listen() and siw_cep_set_free_and_put() functions in drivers/infiniband/sw/siw/siw_cm.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-251.0.0.154

python3-perf: before 5.10.0-251.0.0.154

perf-debuginfo: before 5.10.0-251.0.0.154

perf: before 5.10.0-251.0.0.154

kernel-tools-devel: before 5.10.0-251.0.0.154

kernel-tools-debuginfo: before 5.10.0-251.0.0.154

kernel-tools: before 5.10.0-251.0.0.154

kernel-source: before 5.10.0-251.0.0.154

kernel-headers: before 5.10.0-251.0.0.154

kernel-devel: before 5.10.0-251.0.0.154

kernel-debugsource: before 5.10.0-251.0.0.154

kernel-debuginfo: before 5.10.0-251.0.0.154

kernel: before 5.10.0-251.0.0.154

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1202


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###