openEuler update for kernel

Published: 2022-03-07

Risk	Low
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2021-4159 CVE-2022-25258 CVE-2022-25375 CVE-2022-0617
CWE-ID	CWE-401 CWE-476 CWE-668
Exploitation vector	Local
Public exploit	Public exploit code for vulnerability #3 is available.
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system perf Operating systems & Components / Operating system package or component perf-debuginfo Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component bpftool-debuginfo Operating systems & Components / Operating system package or component kernel-debugsource Operating systems & Components / Operating system package or component bpftool Operating systems & Components / Operating system package or component python2-perf Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component python3-perf-debuginfo Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component kernel-debuginfo Operating systems & Components / Operating system package or component python2-perf-debuginfo Operating systems & Components / Operating system package or component kernel-tools-debuginfo Operating systems & Components / Operating system package or component kernel-tools-devel Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Memory leak

EUVDB-ID: #VU67913

Risk: Low

CVSSv3.1: 3.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4159

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in Linux kernel EBPF verifier when handling internal data structures. A local user with permissions to insert eBPF code to the kernel can force the kernel to leak internal kernel memory details and bypass mitigations, related to exploitation protection.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

perf: before 4.19.90-2203.1.0.0139

perf-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools: before 4.19.90-2203.1.0.0139

kernel-devel: before 4.19.90-2203.1.0.0139

bpftool-debuginfo: before 4.19.90-2203.1.0.0139

kernel-debugsource: before 4.19.90-2203.1.0.0139

bpftool: before 4.19.90-2203.1.0.0139

python2-perf: before 4.19.90-2203.1.0.0139

kernel-source: before 4.19.90-2203.1.0.0139

python3-perf-debuginfo: before 4.19.90-2203.1.0.0139

python3-perf: before 4.19.90-2203.1.0.0139

kernel-debuginfo: before 4.19.90-2203.1.0.0139

python2-perf-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools-devel: before 4.19.90-2203.1.0.0139

kernel: before 4.19.90-2203.1.0.0139

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1559

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU61270

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25258

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error drivers/usb/gadget/composite.c in the Linux kernel. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). A local user can run a specially crafted program to trigger memory corruption and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

perf: before 4.19.90-2203.1.0.0139

perf-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools: before 4.19.90-2203.1.0.0139

kernel-devel: before 4.19.90-2203.1.0.0139

bpftool-debuginfo: before 4.19.90-2203.1.0.0139

kernel-debugsource: before 4.19.90-2203.1.0.0139

bpftool: before 4.19.90-2203.1.0.0139

python2-perf: before 4.19.90-2203.1.0.0139

kernel-source: before 4.19.90-2203.1.0.0139

python3-perf-debuginfo: before 4.19.90-2203.1.0.0139

python3-perf: before 4.19.90-2203.1.0.0139

kernel-debuginfo: before 4.19.90-2203.1.0.0139

python2-perf-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools-devel: before 4.19.90-2203.1.0.0139

kernel: before 4.19.90-2203.1.0.0139

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1559

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Exposure of Resource to Wrong Sphere

EUVDB-ID: #VU61269

Risk: Low

CVSSv3.1: 3.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-25375

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

Exploit availability: Yes

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in drivers/usb/gadget/function/rndis.c in the Linux kernel. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. A local user can run a specially crafted program to gain access to kernel memory.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

perf: before 4.19.90-2203.1.0.0139

perf-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools: before 4.19.90-2203.1.0.0139

kernel-devel: before 4.19.90-2203.1.0.0139

bpftool-debuginfo: before 4.19.90-2203.1.0.0139

kernel-debugsource: before 4.19.90-2203.1.0.0139

bpftool: before 4.19.90-2203.1.0.0139

python2-perf: before 4.19.90-2203.1.0.0139

kernel-source: before 4.19.90-2203.1.0.0139

python3-perf-debuginfo: before 4.19.90-2203.1.0.0139

python3-perf: before 4.19.90-2203.1.0.0139

kernel-debuginfo: before 4.19.90-2203.1.0.0139

python2-perf-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools-devel: before 4.19.90-2203.1.0.0139

kernel: before 4.19.90-2203.1.0.0139

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1559

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) NULL pointer dereference

EUVDB-ID: #VU61210

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0617

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Linux kernel UDF file system functionality. A local user can supply a malicious UDF image to the udf_file_write_iter() function and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

perf: before 4.19.90-2203.1.0.0139

perf-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools: before 4.19.90-2203.1.0.0139

kernel-devel: before 4.19.90-2203.1.0.0139

bpftool-debuginfo: before 4.19.90-2203.1.0.0139

kernel-debugsource: before 4.19.90-2203.1.0.0139

bpftool: before 4.19.90-2203.1.0.0139

python2-perf: before 4.19.90-2203.1.0.0139

kernel-source: before 4.19.90-2203.1.0.0139

python3-perf-debuginfo: before 4.19.90-2203.1.0.0139

python3-perf: before 4.19.90-2203.1.0.0139

kernel-debuginfo: before 4.19.90-2203.1.0.0139

python2-perf-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools-debuginfo: before 4.19.90-2203.1.0.0139

kernel-tools-devel: before 4.19.90-2203.1.0.0139

kernel: before 4.19.90-2203.1.0.0139

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1559

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.