Security Bulletin
This security bulletin contains information about 8 vulnerabilities.
EUVDB-ID: #VU61199
Risk: Low
CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-0002
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to non-transparent sharing of branch predictor within a context. A local user can gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
python3-perf-debuginfo: before 4.19.90-2205.6.0.0152
bpftool: before 4.19.90-2205.6.0.0152
bpftool-debuginfo: before 4.19.90-2205.6.0.0152
kernel-debugsource: before 4.19.90-2205.6.0.0152
python3-perf: before 4.19.90-2205.6.0.0152
perf: before 4.19.90-2205.6.0.0152
python2-perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-devel: before 4.19.90-2205.6.0.0152
kernel-tools-devel: before 4.19.90-2205.6.0.0152
kernel-source: before 4.19.90-2205.6.0.0152
kernel-debuginfo: before 4.19.90-2205.6.0.0152
perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-tools-debuginfo: before 4.19.90-2205.6.0.0152
python2-perf: before 4.19.90-2205.6.0.0152
kernel-tools: before 4.19.90-2205.6.0.0152
kernel: before 4.19.90-2205.6.0.0152
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1691
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63792
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-29582
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the io_uring timeouts() function in the Linux kernel. A local user can trigger a race condition between timeout flush and removal to cause a denial of service or escalate privileges on the system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
python3-perf-debuginfo: before 4.19.90-2205.6.0.0152
bpftool: before 4.19.90-2205.6.0.0152
bpftool-debuginfo: before 4.19.90-2205.6.0.0152
kernel-debugsource: before 4.19.90-2205.6.0.0152
python3-perf: before 4.19.90-2205.6.0.0152
perf: before 4.19.90-2205.6.0.0152
python2-perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-devel: before 4.19.90-2205.6.0.0152
kernel-tools-devel: before 4.19.90-2205.6.0.0152
kernel-source: before 4.19.90-2205.6.0.0152
kernel-debuginfo: before 4.19.90-2205.6.0.0152
perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-tools-debuginfo: before 4.19.90-2205.6.0.0152
python2-perf: before 4.19.90-2205.6.0.0152
kernel-tools: before 4.19.90-2205.6.0.0152
kernel: before 4.19.90-2205.6.0.0152
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1691
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63430
Risk: Low
CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1195
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in the drivers/net/hamradio. A local user can cause a denial of service (DOS) when the mkiss or sixpack device is detached.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
python3-perf-debuginfo: before 4.19.90-2205.6.0.0152
bpftool: before 4.19.90-2205.6.0.0152
bpftool-debuginfo: before 4.19.90-2205.6.0.0152
kernel-debugsource: before 4.19.90-2205.6.0.0152
python3-perf: before 4.19.90-2205.6.0.0152
perf: before 4.19.90-2205.6.0.0152
python2-perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-devel: before 4.19.90-2205.6.0.0152
kernel-tools-devel: before 4.19.90-2205.6.0.0152
kernel-source: before 4.19.90-2205.6.0.0152
kernel-debuginfo: before 4.19.90-2205.6.0.0152
perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-tools-debuginfo: before 4.19.90-2205.6.0.0152
python2-perf: before 4.19.90-2205.6.0.0152
kernel-tools: before 4.19.90-2205.6.0.0152
kernel: before 4.19.90-2205.6.0.0152
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1691
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63352
Risk: Low
CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-20008
CWE-ID:
CWE-908 - Use of Uninitialized Resource
Exploit availability: No
DescriptionThe vulnerability allows a local application to bypass certain security restrictions.
The vulnerability exists due to usage of uninitialized resources within the mmc_blk_read_single() function in block.c. A local application can obtain potentially sensitive information from memory when reading from an SD card that triggers errors.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
python3-perf-debuginfo: before 4.19.90-2205.6.0.0152
bpftool: before 4.19.90-2205.6.0.0152
bpftool-debuginfo: before 4.19.90-2205.6.0.0152
kernel-debugsource: before 4.19.90-2205.6.0.0152
python3-perf: before 4.19.90-2205.6.0.0152
perf: before 4.19.90-2205.6.0.0152
python2-perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-devel: before 4.19.90-2205.6.0.0152
kernel-tools-devel: before 4.19.90-2205.6.0.0152
kernel-source: before 4.19.90-2205.6.0.0152
kernel-debuginfo: before 4.19.90-2205.6.0.0152
perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-tools-debuginfo: before 4.19.90-2205.6.0.0152
python2-perf: before 4.19.90-2205.6.0.0152
kernel-tools: before 4.19.90-2205.6.0.0152
kernel: before 4.19.90-2205.6.0.0152
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1691
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64079
Risk: Medium
CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1012
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient randomization in the net/ipv4/tcp.c when calculating port offsets in Linux kernel cause by small table perturb size. A remote attacker can cause memory leak and gain access to sensitive information.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
python3-perf-debuginfo: before 4.19.90-2205.6.0.0152
bpftool: before 4.19.90-2205.6.0.0152
bpftool-debuginfo: before 4.19.90-2205.6.0.0152
kernel-debugsource: before 4.19.90-2205.6.0.0152
python3-perf: before 4.19.90-2205.6.0.0152
perf: before 4.19.90-2205.6.0.0152
python2-perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-devel: before 4.19.90-2205.6.0.0152
kernel-tools-devel: before 4.19.90-2205.6.0.0152
kernel-source: before 4.19.90-2205.6.0.0152
kernel-debuginfo: before 4.19.90-2205.6.0.0152
perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-tools-debuginfo: before 4.19.90-2205.6.0.0152
python2-perf: before 4.19.90-2205.6.0.0152
kernel-tools: before 4.19.90-2205.6.0.0152
kernel: before 4.19.90-2205.6.0.0152
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1691
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64082
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1734
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to Marvell NFC device driver implementation in the Linux kernel did not properly perform memory cleanup operations in some situations. A local user can trigger use-after-free to escalate privileges on the system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
python3-perf-debuginfo: before 4.19.90-2205.6.0.0152
bpftool: before 4.19.90-2205.6.0.0152
bpftool-debuginfo: before 4.19.90-2205.6.0.0152
kernel-debugsource: before 4.19.90-2205.6.0.0152
python3-perf: before 4.19.90-2205.6.0.0152
perf: before 4.19.90-2205.6.0.0152
python2-perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-devel: before 4.19.90-2205.6.0.0152
kernel-tools-devel: before 4.19.90-2205.6.0.0152
kernel-source: before 4.19.90-2205.6.0.0152
kernel-debuginfo: before 4.19.90-2205.6.0.0152
perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-tools-debuginfo: before 4.19.90-2205.6.0.0152
python2-perf: before 4.19.90-2205.6.0.0152
kernel-tools: before 4.19.90-2205.6.0.0152
kernel: before 4.19.90-2205.6.0.0152
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1691
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63496
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-29581
CWE-ID:
CWE-911 - Improper Update of Reference Count
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper update of reference count in net/sched in Linux kernel. A local user can execute arbitrary code with root privileges.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
python3-perf-debuginfo: before 4.19.90-2205.6.0.0152
bpftool: before 4.19.90-2205.6.0.0152
bpftool-debuginfo: before 4.19.90-2205.6.0.0152
kernel-debugsource: before 4.19.90-2205.6.0.0152
python3-perf: before 4.19.90-2205.6.0.0152
perf: before 4.19.90-2205.6.0.0152
python2-perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-devel: before 4.19.90-2205.6.0.0152
kernel-tools-devel: before 4.19.90-2205.6.0.0152
kernel-source: before 4.19.90-2205.6.0.0152
kernel-debuginfo: before 4.19.90-2205.6.0.0152
perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-tools-debuginfo: before 4.19.90-2205.6.0.0152
python2-perf: before 4.19.90-2205.6.0.0152
kernel-tools: before 4.19.90-2205.6.0.0152
kernel: before 4.19.90-2205.6.0.0152
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1691
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63158
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1516
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference error in the Linux kernel’s X.25 set of standardized network protocols functionality. A local user can terminate session using a simulated Ethernet card and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
python3-perf-debuginfo: before 4.19.90-2205.6.0.0152
bpftool: before 4.19.90-2205.6.0.0152
bpftool-debuginfo: before 4.19.90-2205.6.0.0152
kernel-debugsource: before 4.19.90-2205.6.0.0152
python3-perf: before 4.19.90-2205.6.0.0152
perf: before 4.19.90-2205.6.0.0152
python2-perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-devel: before 4.19.90-2205.6.0.0152
kernel-tools-devel: before 4.19.90-2205.6.0.0152
kernel-source: before 4.19.90-2205.6.0.0152
kernel-debuginfo: before 4.19.90-2205.6.0.0152
perf-debuginfo: before 4.19.90-2205.6.0.0152
kernel-tools-debuginfo: before 4.19.90-2205.6.0.0152
python2-perf: before 4.19.90-2205.6.0.0152
kernel-tools: before 4.19.90-2205.6.0.0152
kernel: before 4.19.90-2205.6.0.0152
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1691
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.