openEuler 20.03 LTS SP1 update for kernel

Published: 2022-10-29

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2022-3567 CVE-2022-3649 CVE-2022-3586
CWE-ID	CWE-362 CWE-416
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	openEuler Operating systems & Components / Operating system kernel-debuginfo Operating systems & Components / Operating system package or component kernel-tools-debuginfo Operating systems & Components / Operating system package or component bpftool-debuginfo Operating systems & Components / Operating system package or component python2-perf-debuginfo Operating systems & Components / Operating system package or component python3-perf-debuginfo Operating systems & Components / Operating system package or component perf-debuginfo Operating systems & Components / Operating system package or component python2-perf Operating systems & Components / Operating system package or component kernel-tools-devel Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component bpftool Operating systems & Components / Operating system package or component kernel-debugsource Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Race condition

EUVDB-ID: #VU69811

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3567

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the inet6_stream_ops() and inet6_dgram_ops() functions. A local user can exploit the race and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1

kernel-debuginfo: before 4.19.90-2210.5.0.0174

kernel-tools-debuginfo: before 4.19.90-2210.5.0.0174

bpftool-debuginfo: before 4.19.90-2210.5.0.0174

python2-perf-debuginfo: before 4.19.90-2210.5.0.0174

python3-perf-debuginfo: before 4.19.90-2210.5.0.0174

perf-debuginfo: before 4.19.90-2210.5.0.0174

python2-perf: before 4.19.90-2210.5.0.0174

kernel-tools-devel: before 4.19.90-2210.5.0.0174

perf: before 4.19.90-2210.5.0.0174

python3-perf: before 4.19.90-2210.5.0.0174

kernel-tools: before 4.19.90-2210.5.0.0174

kernel-source: before 4.19.90-2210.5.0.0174

kernel-devel: before 4.19.90-2210.5.0.0174

bpftool: before 4.19.90-2210.5.0.0174

kernel-debugsource: before 4.19.90-2210.5.0.0174

kernel: before 4.19.90-2210.5.0.0174

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2031

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU69298

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-3649

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the nilfs2 filesystem driver in nilfs_new_inode() function in fs/nilfs2/inode.c in Linux kernel. A remote attacker can trick the victim into mounting a specially crafted image, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1

kernel-debuginfo: before 4.19.90-2210.5.0.0174

kernel-tools-debuginfo: before 4.19.90-2210.5.0.0174

bpftool-debuginfo: before 4.19.90-2210.5.0.0174

python2-perf-debuginfo: before 4.19.90-2210.5.0.0174

python3-perf-debuginfo: before 4.19.90-2210.5.0.0174

perf-debuginfo: before 4.19.90-2210.5.0.0174

python2-perf: before 4.19.90-2210.5.0.0174

kernel-tools-devel: before 4.19.90-2210.5.0.0174

perf: before 4.19.90-2210.5.0.0174

python3-perf: before 4.19.90-2210.5.0.0174

kernel-tools: before 4.19.90-2210.5.0.0174

kernel-source: before 4.19.90-2210.5.0.0174

kernel-devel: before 4.19.90-2210.5.0.0174

bpftool: before 4.19.90-2210.5.0.0174

kernel-debugsource: before 4.19.90-2210.5.0.0174

kernel: before 4.19.90-2210.5.0.0174

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2031

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU69708

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3586

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1

kernel-debuginfo: before 4.19.90-2210.5.0.0174

kernel-tools-debuginfo: before 4.19.90-2210.5.0.0174

bpftool-debuginfo: before 4.19.90-2210.5.0.0174

python2-perf-debuginfo: before 4.19.90-2210.5.0.0174

python3-perf-debuginfo: before 4.19.90-2210.5.0.0174

perf-debuginfo: before 4.19.90-2210.5.0.0174

python2-perf: before 4.19.90-2210.5.0.0174

kernel-tools-devel: before 4.19.90-2210.5.0.0174

perf: before 4.19.90-2210.5.0.0174

python3-perf: before 4.19.90-2210.5.0.0174

kernel-tools: before 4.19.90-2210.5.0.0174

kernel-source: before 4.19.90-2210.5.0.0174

kernel-devel: before 4.19.90-2210.5.0.0174

bpftool: before 4.19.90-2210.5.0.0174

kernel-debugsource: before 4.19.90-2210.5.0.0174

kernel: before 4.19.90-2210.5.0.0174

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2031

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.