Anolis OS update for linux-firmware
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-31346 |
| CWE-ID | CWE-665 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Anolis OS Operating systems & Components / Operating system linux-firmware Operating systems & Components / Operating system package or component libertas-usb8388-olpc-firmware Operating systems & Components / Operating system package or component libertas-usb8388-firmware Operating systems & Components / Operating system package or component libertas-sd8787-firmware Operating systems & Components / Operating system package or component libertas-sd8686-firmware Operating systems & Components / Operating system package or component iwl7260-firmware Operating systems & Components / Operating system package or component iwl6050-firmware Operating systems & Components / Operating system package or component iwl6000g2b-firmware Operating systems & Components / Operating system package or component iwl6000g2a-firmware Operating systems & Components / Operating system package or component iwl6000-firmware Operating systems & Components / Operating system package or component iwl5150-firmware Operating systems & Components / Operating system package or component iwl5000-firmware Operating systems & Components / Operating system package or component iwl4965-firmware Operating systems & Components / Operating system package or component iwl3945-firmware Operating systems & Components / Operating system package or component iwl3160-firmware Operating systems & Components / Operating system package or component iwl2030-firmware Operating systems & Components / Operating system package or component iwl2000-firmware Operating systems & Components / Operating system package or component iwl135-firmware Operating systems & Components / Operating system package or component iwl105-firmware Operating systems & Components / Operating system package or component iwl1000-firmware Operating systems & Components / Operating system package or component iwl100-firmware Operating systems & Components / Operating system package or component |
| Vendor | OpenAnolis |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Improper Initialization
EUVDB-ID: #VU94741
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-31346
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to improper initialization in SEV Firmware. A local user can run a specially crafted application to access stale data from other guests.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsAnolis OS: 8
linux-firmware: before 20240610-122.git90df68d2
libertas-usb8388-olpc-firmware: before 20240610-122.git90df68d2
libertas-usb8388-firmware: before 20240610-122.git90df68d2
libertas-sd8787-firmware: before 20240610-122.git90df68d2
libertas-sd8686-firmware: before 20240610-122.git90df68d2
iwl7260-firmware: before 25.30.13.0-122
iwl6050-firmware: before 41.28.5.1-122
iwl6000g2b-firmware: before 18.168.6.1-122
iwl6000g2a-firmware: before 18.168.6.1-122
iwl6000-firmware: before 9.221.4.1-122
iwl5150-firmware: before 8.24.2.2-122
iwl5000-firmware: before 8.83.5.1_1-122
iwl4965-firmware: before 228.61.2.24-122
iwl3945-firmware: before 15.32.2.9-122
iwl3160-firmware: before 25.30.13.0-122
iwl2030-firmware: before 18.168.6.1-122
iwl2000-firmware: before 18.168.6.1-122
iwl135-firmware: before 18.168.6.1-122
iwl105-firmware: before 18.168.6.1-122
iwl1000-firmware: before 39.31.5.1-122
iwl100-firmware: before 39.31.5.1-122
CPE2.3- cpe:2.3:o:openanolis:anolis_os:8:*:*:*:*:*:*:*
- cpe:2.3:a:openanolis:linux-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:libertas-usb8388-olpc-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:libertas-usb8388-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:libertas-sd8787-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:libertas-sd8686-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl7260-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6050-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000g2b-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000g2a-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl5150-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl5000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl4965-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl3945-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl3160-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl2030-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl2000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl135-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl105-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl1000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl100-firmware:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2024:0855
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
