openEuler 22.03 LTS SP3 update for kernel



Risk Low
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2024-56606
CVE-2024-57908
CVE-2024-57912
CVE-2024-57977
CVE-2025-21650
CVE-2025-21651
CVE-2025-21731
CVE-2025-21815
CWE-ID CWE-416
CWE-401
CWE-667
CWE-125
CWE-399
Exploitation vector Local
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU102021

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56606

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the packet_create() function in net/packet/af_packet.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-252.0.0.155

python3-perf: before 5.10.0-252.0.0.155

perf-debuginfo: before 5.10.0-252.0.0.155

perf: before 5.10.0-252.0.0.155

kernel-tools-devel: before 5.10.0-252.0.0.155

kernel-tools-debuginfo: before 5.10.0-252.0.0.155

kernel-tools: before 5.10.0-252.0.0.155

kernel-source: before 5.10.0-252.0.0.155

kernel-headers: before 5.10.0-252.0.0.155

kernel-devel: before 5.10.0-252.0.0.155

kernel-debugsource: before 5.10.0-252.0.0.155

kernel-debuginfo: before 5.10.0-252.0.0.155

kernel: before 5.10.0-252.0.0.155

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1246


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU103004

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57908

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the kmx61_trigger_handler() function in drivers/iio/imu/kmx61.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-252.0.0.155

python3-perf: before 5.10.0-252.0.0.155

perf-debuginfo: before 5.10.0-252.0.0.155

perf: before 5.10.0-252.0.0.155

kernel-tools-devel: before 5.10.0-252.0.0.155

kernel-tools-debuginfo: before 5.10.0-252.0.0.155

kernel-tools: before 5.10.0-252.0.0.155

kernel-source: before 5.10.0-252.0.0.155

kernel-headers: before 5.10.0-252.0.0.155

kernel-devel: before 5.10.0-252.0.0.155

kernel-debugsource: before 5.10.0-252.0.0.155

kernel-debuginfo: before 5.10.0-252.0.0.155

kernel: before 5.10.0-252.0.0.155

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1246


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU103008

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57912

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the zpa2326_fill_sample_buffer() function in drivers/iio/pressure/zpa2326.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-252.0.0.155

python3-perf: before 5.10.0-252.0.0.155

perf-debuginfo: before 5.10.0-252.0.0.155

perf: before 5.10.0-252.0.0.155

kernel-tools-devel: before 5.10.0-252.0.0.155

kernel-tools-debuginfo: before 5.10.0-252.0.0.155

kernel-tools: before 5.10.0-252.0.0.155

kernel-source: before 5.10.0-252.0.0.155

kernel-headers: before 5.10.0-252.0.0.155

kernel-devel: before 5.10.0-252.0.0.155

kernel-debugsource: before 5.10.0-252.0.0.155

kernel-debuginfo: before 5.10.0-252.0.0.155

kernel: before 5.10.0-252.0.0.155

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1246


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper locking

EUVDB-ID: #VU105026

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57977

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dump_tasks() function in mm/oom_kill.c, within the mem_cgroup_scan_tasks() function in mm/memcontrol.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-252.0.0.155

python3-perf: before 5.10.0-252.0.0.155

perf-debuginfo: before 5.10.0-252.0.0.155

perf: before 5.10.0-252.0.0.155

kernel-tools-devel: before 5.10.0-252.0.0.155

kernel-tools-debuginfo: before 5.10.0-252.0.0.155

kernel-tools: before 5.10.0-252.0.0.155

kernel-source: before 5.10.0-252.0.0.155

kernel-headers: before 5.10.0-252.0.0.155

kernel-devel: before 5.10.0-252.0.0.155

kernel-debugsource: before 5.10.0-252.0.0.155

kernel-debuginfo: before 5.10.0-252.0.0.155

kernel: before 5.10.0-252.0.0.155

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1246


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU103015

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21650

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the hclgevf_get_regs_len() and hclgevf_get_regs() functions in drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c, within the hclge_fetch_pf_reg() function in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-252.0.0.155

python3-perf: before 5.10.0-252.0.0.155

perf-debuginfo: before 5.10.0-252.0.0.155

perf: before 5.10.0-252.0.0.155

kernel-tools-devel: before 5.10.0-252.0.0.155

kernel-tools-debuginfo: before 5.10.0-252.0.0.155

kernel-tools: before 5.10.0-252.0.0.155

kernel-source: before 5.10.0-252.0.0.155

kernel-headers: before 5.10.0-252.0.0.155

kernel-devel: before 5.10.0-252.0.0.155

kernel-debugsource: before 5.10.0-252.0.0.155

kernel-debuginfo: before 5.10.0-252.0.0.155

kernel: before 5.10.0-252.0.0.155

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1246


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource management error

EUVDB-ID: #VU103046

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21651

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the hclge_misc_irq_init(), hclge_init_ae_dev() and hclge_uninit_ae_dev() functions in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-252.0.0.155

python3-perf: before 5.10.0-252.0.0.155

perf-debuginfo: before 5.10.0-252.0.0.155

perf: before 5.10.0-252.0.0.155

kernel-tools-devel: before 5.10.0-252.0.0.155

kernel-tools-debuginfo: before 5.10.0-252.0.0.155

kernel-tools: before 5.10.0-252.0.0.155

kernel-source: before 5.10.0-252.0.0.155

kernel-headers: before 5.10.0-252.0.0.155

kernel-devel: before 5.10.0-252.0.0.155

kernel-debugsource: before 5.10.0-252.0.0.155

kernel-debuginfo: before 5.10.0-252.0.0.155

kernel: before 5.10.0-252.0.0.155

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1246


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU104969

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21731

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nbd_disconnect_and_put() function in drivers/block/nbd.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-252.0.0.155

python3-perf: before 5.10.0-252.0.0.155

perf-debuginfo: before 5.10.0-252.0.0.155

perf: before 5.10.0-252.0.0.155

kernel-tools-devel: before 5.10.0-252.0.0.155

kernel-tools-debuginfo: before 5.10.0-252.0.0.155

kernel-tools: before 5.10.0-252.0.0.155

kernel-source: before 5.10.0-252.0.0.155

kernel-headers: before 5.10.0-252.0.0.155

kernel-devel: before 5.10.0-252.0.0.155

kernel-debugsource: before 5.10.0-252.0.0.155

kernel-debuginfo: before 5.10.0-252.0.0.155

kernel: before 5.10.0-252.0.0.155

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1246


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU105137

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21815

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the isolate_freepages_block() function in mm/compaction.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-252.0.0.155

python3-perf: before 5.10.0-252.0.0.155

perf-debuginfo: before 5.10.0-252.0.0.155

perf: before 5.10.0-252.0.0.155

kernel-tools-devel: before 5.10.0-252.0.0.155

kernel-tools-debuginfo: before 5.10.0-252.0.0.155

kernel-tools: before 5.10.0-252.0.0.155

kernel-source: before 5.10.0-252.0.0.155

kernel-headers: before 5.10.0-252.0.0.155

kernel-devel: before 5.10.0-252.0.0.155

kernel-debugsource: before 5.10.0-252.0.0.155

kernel-debuginfo: before 5.10.0-252.0.0.155

kernel: before 5.10.0-252.0.0.155

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1246


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###