openEuler update for kernel

Published: 2021-10-15

Risk	Medium
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2021-3669 CVE-2021-3764 CVE-2021-3744 CVE-2021-38300 CVE-2021-3752 CVE-2021-20317 CVE-2021-41864 CVE-2021-42008
CWE-ID	CWE-400 CWE-401 CWE-94 CWE-416 CWE-665 CWE-787
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #8 is available.
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system kernel-tools Operating systems & Components / Operating system package or component kernel-tools-devel Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component kernel-debugsource Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component python2-perf-debuginfo Operating systems & Components / Operating system package or component kernel-debuginfo Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component python2-perf Operating systems & Components / Operating system package or component perf-debuginfo Operating systems & Components / Operating system package or component python3-perf-debuginfo Operating systems & Components / Operating system package or component bpftool-debuginfo Operating systems & Components / Operating system package or component bpftool Operating systems & Components / Operating system package or component kernel-tools-debuginfo Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU63911

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3669

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to measuring usage of the shared memory does not scale with large shared memory segment counts. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

kernel-tools: before 4.19.90-2110.3.0.0116

kernel-tools-devel: before 4.19.90-2110.3.0.0116

perf: before 4.19.90-2110.3.0.0116

kernel-debugsource: before 4.19.90-2110.3.0.0116

python3-perf: before 4.19.90-2110.3.0.0116

python2-perf-debuginfo: before 4.19.90-2110.3.0.0116

kernel-debuginfo: before 4.19.90-2110.3.0.0116

kernel-source: before 4.19.90-2110.3.0.0116

python2-perf: before 4.19.90-2110.3.0.0116

perf-debuginfo: before 4.19.90-2110.3.0.0116

python3-perf-debuginfo: before 4.19.90-2110.3.0.0116

bpftool-debuginfo: before 4.19.90-2110.3.0.0116

bpftool: before 4.19.90-2110.3.0.0116

kernel-tools-debuginfo: before 4.19.90-2110.3.0.0116

kernel-devel: before 4.19.90-2110.3.0.0116

kernel: before 4.19.90-2110.3.0.0116

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1379

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU63817

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3764

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak error in the ccp_run_aes_gcm_cmd() function in Linux kernel. A local user can trigger a memory leak error and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

kernel-tools: before 4.19.90-2110.3.0.0116

kernel-tools-devel: before 4.19.90-2110.3.0.0116

perf: before 4.19.90-2110.3.0.0116

kernel-debugsource: before 4.19.90-2110.3.0.0116

python3-perf: before 4.19.90-2110.3.0.0116

python2-perf-debuginfo: before 4.19.90-2110.3.0.0116

kernel-debuginfo: before 4.19.90-2110.3.0.0116

kernel-source: before 4.19.90-2110.3.0.0116

python2-perf: before 4.19.90-2110.3.0.0116

perf-debuginfo: before 4.19.90-2110.3.0.0116

python3-perf-debuginfo: before 4.19.90-2110.3.0.0116

bpftool-debuginfo: before 4.19.90-2110.3.0.0116

bpftool: before 4.19.90-2110.3.0.0116

kernel-tools-debuginfo: before 4.19.90-2110.3.0.0116

kernel-devel: before 4.19.90-2110.3.0.0116

kernel: before 4.19.90-2110.3.0.0116

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1379

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU63813

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3744

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c. A local user can force the application to leak memory and perform denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

kernel-tools: before 4.19.90-2110.3.0.0116

kernel-tools-devel: before 4.19.90-2110.3.0.0116

perf: before 4.19.90-2110.3.0.0116

kernel-debugsource: before 4.19.90-2110.3.0.0116

python3-perf: before 4.19.90-2110.3.0.0116

python2-perf-debuginfo: before 4.19.90-2110.3.0.0116

kernel-debuginfo: before 4.19.90-2110.3.0.0116

kernel-source: before 4.19.90-2110.3.0.0116

python2-perf: before 4.19.90-2110.3.0.0116

perf-debuginfo: before 4.19.90-2110.3.0.0116

python3-perf-debuginfo: before 4.19.90-2110.3.0.0116

bpftool-debuginfo: before 4.19.90-2110.3.0.0116

bpftool: before 4.19.90-2110.3.0.0116

kernel-tools-debuginfo: before 4.19.90-2110.3.0.0116

kernel-devel: before 4.19.90-2110.3.0.0116

kernel: before 4.19.90-2110.3.0.0116

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1379

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Code Injection

EUVDB-ID: #VU63840

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-38300

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the arch/mips/net/bpf_jit.c in the Linux kernel. A local user can send a specially crafted request and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

kernel-tools: before 4.19.90-2110.3.0.0116

kernel-tools-devel: before 4.19.90-2110.3.0.0116

perf: before 4.19.90-2110.3.0.0116

kernel-debugsource: before 4.19.90-2110.3.0.0116

python3-perf: before 4.19.90-2110.3.0.0116

python2-perf-debuginfo: before 4.19.90-2110.3.0.0116

kernel-debuginfo: before 4.19.90-2110.3.0.0116

kernel-source: before 4.19.90-2110.3.0.0116

python2-perf: before 4.19.90-2110.3.0.0116

perf-debuginfo: before 4.19.90-2110.3.0.0116

python3-perf-debuginfo: before 4.19.90-2110.3.0.0116

bpftool-debuginfo: before 4.19.90-2110.3.0.0116

bpftool: before 4.19.90-2110.3.0.0116

kernel-tools-debuginfo: before 4.19.90-2110.3.0.0116

kernel-devel: before 4.19.90-2110.3.0.0116

kernel: before 4.19.90-2110.3.0.0116

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1379

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU63767

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3752

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Linux kernel’s Bluetooth subsystem when a user calls connect to the socket and disconnect simultaneously. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

kernel-tools: before 4.19.90-2110.3.0.0116

kernel-tools-devel: before 4.19.90-2110.3.0.0116

perf: before 4.19.90-2110.3.0.0116

kernel-debugsource: before 4.19.90-2110.3.0.0116

python3-perf: before 4.19.90-2110.3.0.0116

python2-perf-debuginfo: before 4.19.90-2110.3.0.0116

kernel-debuginfo: before 4.19.90-2110.3.0.0116

kernel-source: before 4.19.90-2110.3.0.0116

python2-perf: before 4.19.90-2110.3.0.0116

perf-debuginfo: before 4.19.90-2110.3.0.0116

python3-perf-debuginfo: before 4.19.90-2110.3.0.0116

bpftool-debuginfo: before 4.19.90-2110.3.0.0116

bpftool: before 4.19.90-2110.3.0.0116

kernel-tools-debuginfo: before 4.19.90-2110.3.0.0116

kernel-devel: before 4.19.90-2110.3.0.0116

kernel: before 4.19.90-2110.3.0.0116

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1379

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper Initialization

EUVDB-ID: #VU58208

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-20317

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization the Linux kernel. A corrupted timer tree causes the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. A local user can run a specially crafted application to crash the kernel.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

kernel-tools: before 4.19.90-2110.3.0.0116

kernel-tools-devel: before 4.19.90-2110.3.0.0116

perf: before 4.19.90-2110.3.0.0116

kernel-debugsource: before 4.19.90-2110.3.0.0116

python3-perf: before 4.19.90-2110.3.0.0116

python2-perf-debuginfo: before 4.19.90-2110.3.0.0116

kernel-debuginfo: before 4.19.90-2110.3.0.0116

kernel-source: before 4.19.90-2110.3.0.0116

python2-perf: before 4.19.90-2110.3.0.0116

perf-debuginfo: before 4.19.90-2110.3.0.0116

python3-perf-debuginfo: before 4.19.90-2110.3.0.0116

bpftool-debuginfo: before 4.19.90-2110.3.0.0116

bpftool: before 4.19.90-2110.3.0.0116

kernel-tools-debuginfo: before 4.19.90-2110.3.0.0116

kernel-devel: before 4.19.90-2110.3.0.0116

kernel: before 4.19.90-2110.3.0.0116

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1379

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds write

EUVDB-ID: #VU63855

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-41864

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing untrusted input. A local user can gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

kernel-tools: before 4.19.90-2110.3.0.0116

kernel-tools-devel: before 4.19.90-2110.3.0.0116

perf: before 4.19.90-2110.3.0.0116

kernel-debugsource: before 4.19.90-2110.3.0.0116

python3-perf: before 4.19.90-2110.3.0.0116

python2-perf-debuginfo: before 4.19.90-2110.3.0.0116

kernel-debuginfo: before 4.19.90-2110.3.0.0116

kernel-source: before 4.19.90-2110.3.0.0116

python2-perf: before 4.19.90-2110.3.0.0116

perf-debuginfo: before 4.19.90-2110.3.0.0116

python3-perf-debuginfo: before 4.19.90-2110.3.0.0116

bpftool-debuginfo: before 4.19.90-2110.3.0.0116

bpftool: before 4.19.90-2110.3.0.0116

kernel-tools-debuginfo: before 4.19.90-2110.3.0.0116

kernel-devel: before 4.19.90-2110.3.0.0116

kernel: before 4.19.90-2110.3.0.0116

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1379

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds write

EUVDB-ID: #VU63669

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-42008

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in the decode_data() function in drivers/net/hamradio/6pack.c in the Linux kernel. A local user can send input from a process that has the CAP_NET_ADMIN capability and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

kernel-tools: before 4.19.90-2110.3.0.0116

kernel-tools-devel: before 4.19.90-2110.3.0.0116

perf: before 4.19.90-2110.3.0.0116

kernel-debugsource: before 4.19.90-2110.3.0.0116

python3-perf: before 4.19.90-2110.3.0.0116

python2-perf-debuginfo: before 4.19.90-2110.3.0.0116

kernel-debuginfo: before 4.19.90-2110.3.0.0116

kernel-source: before 4.19.90-2110.3.0.0116

python2-perf: before 4.19.90-2110.3.0.0116

perf-debuginfo: before 4.19.90-2110.3.0.0116

python3-perf-debuginfo: before 4.19.90-2110.3.0.0116

bpftool-debuginfo: before 4.19.90-2110.3.0.0116

bpftool: before 4.19.90-2110.3.0.0116

kernel-tools-debuginfo: before 4.19.90-2110.3.0.0116

kernel-devel: before 4.19.90-2110.3.0.0116

kernel: before 4.19.90-2110.3.0.0116

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1379

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.