openEuler update for kernel

Published: 2022-01-22

Risk	Low
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2021-4203 CVE-2021-39633 CVE-2021-4197 CVE-2021-4202
CWE-ID	CWE-416 CWE-200 CWE-264
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system bpftool Operating systems & Components / Operating system package or component perf-debuginfo Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel-debugsource Operating systems & Components / Operating system package or component bpftool-debuginfo Operating systems & Components / Operating system package or component kernel-tools-debuginfo Operating systems & Components / Operating system package or component python2-perf Operating systems & Components / Operating system package or component kernel-tools-devel Operating systems & Components / Operating system package or component python3-perf-debuginfo Operating systems & Components / Operating system package or component kernel-debuginfo Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component python2-perf-debuginfo Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU63838

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4203

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in sock_getsockopt() function in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() function (and connect() function) in the Linux kernel. A local user can exploit the use-after-free error and crash the system or escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

bpftool: before 4.19.90-2201.3.0.0134

perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-devel: before 4.19.90-2201.3.0.0134

kernel-debugsource: before 4.19.90-2201.3.0.0134

bpftool-debuginfo: before 4.19.90-2201.3.0.0134

kernel-tools-debuginfo: before 4.19.90-2201.3.0.0134

python2-perf: before 4.19.90-2201.3.0.0134

kernel-tools-devel: before 4.19.90-2201.3.0.0134

python3-perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-debuginfo: before 4.19.90-2201.3.0.0134

python3-perf: before 4.19.90-2201.3.0.0134

perf: before 4.19.90-2201.3.0.0134

kernel-tools: before 4.19.90-2201.3.0.0134

python2-perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-source: before 4.19.90-2201.3.0.0134

kernel: before 4.19.90-2201.3.0.0134

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1495

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU59323

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-39633

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in OS kernel. A local application can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

bpftool: before 4.19.90-2201.3.0.0134

perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-devel: before 4.19.90-2201.3.0.0134

kernel-debugsource: before 4.19.90-2201.3.0.0134

bpftool-debuginfo: before 4.19.90-2201.3.0.0134

kernel-tools-debuginfo: before 4.19.90-2201.3.0.0134

python2-perf: before 4.19.90-2201.3.0.0134

kernel-tools-devel: before 4.19.90-2201.3.0.0134

python3-perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-debuginfo: before 4.19.90-2201.3.0.0134

python3-perf: before 4.19.90-2201.3.0.0134

perf: before 4.19.90-2201.3.0.0134

kernel-tools: before 4.19.90-2201.3.0.0134

python2-perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-source: before 4.19.90-2201.3.0.0134

kernel: before 4.19.90-2201.3.0.0134

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1495

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security restrictions bypass

EUVDB-ID: #VU61258

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4197

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to missing permissions checks within the cgroups (control groups) functionality of Linux Kernel when writing into a file descriptor. A local low privileged process can trick a higher privileged parent process into writing arbitrary data into files, which can result in denial of service or privileges escalation.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

bpftool: before 4.19.90-2201.3.0.0134

perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-devel: before 4.19.90-2201.3.0.0134

kernel-debugsource: before 4.19.90-2201.3.0.0134

bpftool-debuginfo: before 4.19.90-2201.3.0.0134

kernel-tools-debuginfo: before 4.19.90-2201.3.0.0134

python2-perf: before 4.19.90-2201.3.0.0134

kernel-tools-devel: before 4.19.90-2201.3.0.0134

python3-perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-debuginfo: before 4.19.90-2201.3.0.0134

python3-perf: before 4.19.90-2201.3.0.0134

perf: before 4.19.90-2201.3.0.0134

kernel-tools: before 4.19.90-2201.3.0.0134

python2-perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-source: before 4.19.90-2201.3.0.0134

kernel: before 4.19.90-2201.3.0.0134

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1495

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU63764

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4202

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the nci_request() function in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. A local user can cause a data race problem while the device is getting removed and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

bpftool: before 4.19.90-2201.3.0.0134

perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-devel: before 4.19.90-2201.3.0.0134

kernel-debugsource: before 4.19.90-2201.3.0.0134

bpftool-debuginfo: before 4.19.90-2201.3.0.0134

kernel-tools-debuginfo: before 4.19.90-2201.3.0.0134

python2-perf: before 4.19.90-2201.3.0.0134

kernel-tools-devel: before 4.19.90-2201.3.0.0134

python3-perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-debuginfo: before 4.19.90-2201.3.0.0134

python3-perf: before 4.19.90-2201.3.0.0134

perf: before 4.19.90-2201.3.0.0134

kernel-tools: before 4.19.90-2201.3.0.0134

python2-perf-debuginfo: before 4.19.90-2201.3.0.0134

kernel-source: before 4.19.90-2201.3.0.0134

kernel: before 4.19.90-2201.3.0.0134

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1495

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.