Security Bulletin
This security bulletin contains information about 11 vulnerabilities.
EUVDB-ID: #VU73772
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3523
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error when in mm/memory.c in Linux kernel. A local user can trigger a use-after-free error and perform a denial of service (DoS) attack.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69791
Risk: Low
CVSSv3.1: 2.2 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3535
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform DoS attack.
The vulnerability exists due memory leak within the mvpp2_dbgfs_port_init() function in drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c, when a device is probed. A local user can force the system to leak memory and perform denial of service attack.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69300
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3621
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the nilfs2 filesystem driver within the nilfs_bmap_lookup_at_level() function in fs/nilfs2/inode.c in Linux kernel. A remote attacker can trick the victim into mounting a specially crafted image and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69794
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3623
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition within the follow_page_pte() function in mm/gup.c. A local user can exploit the race and escalate privileges on the system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69397
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3625
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the devlink_param_set() and devlink_param_get() function in net/core/devlink.c in IPsec component of Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69398
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3635
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error within the drivers/atm/idt77252.c in IPsec component of Linux kernel. A local user can trigger a use-after-free error and crash the kernel.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69296
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-43750
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
Description The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU67812
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-2978
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the Linux kernel NILFS file system. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69706
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3629
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform DoS attack.
The vulnerability exists due memory leak within the vsock_connect() function in net/vmw_vsock/af_vsock.c in Linux kernel IPSec implementation. A local user can force the system to leak memory and perform denial of service attack.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU73749
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-42432
CWE-ID:
CWE-120 - Buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to memory safety bugs. A remote unauthenticated attacker can trick the victim into opening a specially crafted file, trigger buffer overflow and execute arbitrary code on the target system.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69299
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3646
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the nilfs2 filesystem driver within the nilfs_attach_log_writer() function in fs/nilfs2/segment.c in Linux kernel. A remote attacker can trick the victim into mounting a specially crafted image and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
kernel-debugsource: before 5.10.0-60.65.0.90
perf-debuginfo: before 5.10.0-60.65.0.90
kernel-source: before 5.10.0-60.65.0.90
kernel-devel: before 5.10.0-60.65.0.90
kernel-tools-devel: before 5.10.0-60.65.0.90
perf: before 5.10.0-60.65.0.90
bpftool-debuginfo: before 5.10.0-60.65.0.90
kernel-headers: before 5.10.0-60.65.0.90
kernel-debuginfo: before 5.10.0-60.65.0.90
kernel-tools-debuginfo: before 5.10.0-60.65.0.90
bpftool: before 5.10.0-60.65.0.90
kernel-tools: before 5.10.0-60.65.0.90
python3-perf: before 5.10.0-60.65.0.90
python3-perf-debuginfo: before 5.10.0-60.65.0.90
kernel: before 5.10.0-60.65.0.90
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2045
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.