SB2022062454 - openEuler update for kernel

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2022-20132)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the USB HID component in Linux Kernel. A local user can trigger the vulnerability to gain access to potentially sensitive information.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-20154)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to unspecified error in the Linux Kernel. A local user can bypass security restrictions and escalate privileges on the system.

3) Use-after-free (CVE-ID: CVE-2022-1966)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Linux kernel's Netfilter subsystem in net/netfilter/nf_tables_api.c. A local user can trigger use-after-free error to escalate privileges on the system.

4) Use of insufficiently random values (CVE-ID: CVE-2022-32296)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to Linux kernel allowing TCP servers to identify clients by observing what source ports are used. A local user can gain unauthorized access to sensitive information on the system.

5) Buffer overflow (CVE-ID: CVE-2022-32981)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in ptrace PEEKUSER and POKEUSER when accessing floating point registers on powerpc 32-bit platforms. A local user can trigger buffer overflow and execute arbitrary code with elevated privileges.

6) Use-after-free (CVE-ID: CVE-2022-32250)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free incorrect NFT_STATEFUL_EXPR in net/netfilter/nf_tables_api.c in Linux kernel. A local user with ability to create user/net namespaces can execute arbitrary code with root privileges.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1725