Anolis OS update for linux-firmware



Risk Low
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2022-27635
CVE-2022-36351
CVE-2022-38076
CVE-2022-40964
CVE-2022-46329
CWE-ID CWE-284
CWE-20
CWE-693
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 Anolis OS
Operating systems & Components / Operating system

linux-firmware
Operating systems & Components / Operating system package or component

iwl7260-firmware
Operating systems & Components / Operating system package or component

iwl6050-firmware
Operating systems & Components / Operating system package or component

iwl6000g2b-firmware
Operating systems & Components / Operating system package or component

iwl6000g2a-firmware
Operating systems & Components / Operating system package or component

iwl6000-firmware
Operating systems & Components / Operating system package or component

iwl5150-firmware
Operating systems & Components / Operating system package or component

iwl5000-firmware
Operating systems & Components / Operating system package or component

iwl4965-firmware
Operating systems & Components / Operating system package or component

iwl3945-firmware
Operating systems & Components / Operating system package or component

iwl3160-firmware
Operating systems & Components / Operating system package or component

iwl2030-firmware
Operating systems & Components / Operating system package or component

iwl2000-firmware
Operating systems & Components / Operating system package or component

iwl135-firmware
Operating systems & Components / Operating system package or component

iwl105-firmware
Operating systems & Components / Operating system package or component

iwl1000-firmware
Operating systems & Components / Operating system package or component

iwl100-firmware
Operating systems & Components / Operating system package or component

Vendor OpenAnolis

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Improper access control

EUVDB-ID: #VU79501

Risk: Low

CVSSv4.0: 5.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-27635

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. A local user can bypass implemented security restrictions and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

linux-firmware: before 20200421-83.git78c0348

iwl7260-firmware: before 25.30.13.0-83

iwl6050-firmware: before 41.28.5.1-83

iwl6000g2b-firmware: before 18.168.6.1-83

iwl6000g2a-firmware: before 18.168.6.1-83

iwl6000-firmware: before 9.221.4.1-83

iwl5150-firmware: before 8.24.2.2-83

iwl5000-firmware: before 8.83.5.1_1-83

iwl4965-firmware: before 228.61.2.24-83

iwl3945-firmware: before 15.32.2.9-83

iwl3160-firmware: before 25.30.13.0-83

iwl2030-firmware: before 18.168.6.1-83

iwl2000-firmware: before 18.168.6.1-83

iwl135-firmware: before 18.168.6.1-83

iwl105-firmware: before 18.168.6.1-83

iwl1000-firmware: before 39.31.5.1-83

iwl100-firmware: before 39.31.5.1-83

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0523


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU79526

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-36351

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can send specially crafted data to the system and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

linux-firmware: before 20200421-83.git78c0348

iwl7260-firmware: before 25.30.13.0-83

iwl6050-firmware: before 41.28.5.1-83

iwl6000g2b-firmware: before 18.168.6.1-83

iwl6000g2a-firmware: before 18.168.6.1-83

iwl6000-firmware: before 9.221.4.1-83

iwl5150-firmware: before 8.24.2.2-83

iwl5000-firmware: before 8.83.5.1_1-83

iwl4965-firmware: before 228.61.2.24-83

iwl3945-firmware: before 15.32.2.9-83

iwl3160-firmware: before 25.30.13.0-83

iwl2030-firmware: before 18.168.6.1-83

iwl2000-firmware: before 18.168.6.1-83

iwl135-firmware: before 18.168.6.1-83

iwl105-firmware: before 18.168.6.1-83

iwl1000-firmware: before 39.31.5.1-83

iwl100-firmware: before 39.31.5.1-83

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0523


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU79527

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-38076

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A local user can pass specially crafted input to the system and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

linux-firmware: before 20200421-83.git78c0348

iwl7260-firmware: before 25.30.13.0-83

iwl6050-firmware: before 41.28.5.1-83

iwl6000g2b-firmware: before 18.168.6.1-83

iwl6000g2a-firmware: before 18.168.6.1-83

iwl6000-firmware: before 9.221.4.1-83

iwl5150-firmware: before 8.24.2.2-83

iwl5000-firmware: before 8.83.5.1_1-83

iwl4965-firmware: before 228.61.2.24-83

iwl3945-firmware: before 15.32.2.9-83

iwl3160-firmware: before 25.30.13.0-83

iwl2030-firmware: before 18.168.6.1-83

iwl2000-firmware: before 18.168.6.1-83

iwl135-firmware: before 18.168.6.1-83

iwl105-firmware: before 18.168.6.1-83

iwl1000-firmware: before 39.31.5.1-83

iwl100-firmware: before 39.31.5.1-83

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0523


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU79502

Risk: Low

CVSSv4.0: 5.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-40964

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. A local user can bypass implemented security restrictions and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

linux-firmware: before 20200421-83.git78c0348

iwl7260-firmware: before 25.30.13.0-83

iwl6050-firmware: before 41.28.5.1-83

iwl6000g2b-firmware: before 18.168.6.1-83

iwl6000g2a-firmware: before 18.168.6.1-83

iwl6000-firmware: before 9.221.4.1-83

iwl5150-firmware: before 8.24.2.2-83

iwl5000-firmware: before 8.83.5.1_1-83

iwl4965-firmware: before 228.61.2.24-83

iwl3945-firmware: before 15.32.2.9-83

iwl3160-firmware: before 25.30.13.0-83

iwl2030-firmware: before 18.168.6.1-83

iwl2000-firmware: before 18.168.6.1-83

iwl135-firmware: before 18.168.6.1-83

iwl105-firmware: before 18.168.6.1-83

iwl1000-firmware: before 39.31.5.1-83

iwl100-firmware: before 39.31.5.1-83

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0523


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Protection Mechanism Failure

EUVDB-ID: #VU79525

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-46329

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures. A local user can bypass implemented security restrictions and elevate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

linux-firmware: before 20200421-83.git78c0348

iwl7260-firmware: before 25.30.13.0-83

iwl6050-firmware: before 41.28.5.1-83

iwl6000g2b-firmware: before 18.168.6.1-83

iwl6000g2a-firmware: before 18.168.6.1-83

iwl6000-firmware: before 9.221.4.1-83

iwl5150-firmware: before 8.24.2.2-83

iwl5000-firmware: before 8.83.5.1_1-83

iwl4965-firmware: before 228.61.2.24-83

iwl3945-firmware: before 15.32.2.9-83

iwl3160-firmware: before 25.30.13.0-83

iwl2030-firmware: before 18.168.6.1-83

iwl2000-firmware: before 18.168.6.1-83

iwl135-firmware: before 18.168.6.1-83

iwl105-firmware: before 18.168.6.1-83

iwl1000-firmware: before 39.31.5.1-83

iwl100-firmware: before 39.31.5.1-83

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0523


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###