SB2022122404 - openEuler update for kernel

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2022-20566)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the l2cap_chan_put() function in Bluetooth L2CAP implementation. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.

2) NULL pointer dereference (CVE-ID: CVE-2022-3107)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the netvsc_get_ethtool_stats() function in drivers/net/hyperv/netvsc_drv.c. A local user can perform a denial of service (DoS) attack.

3) Input validation error (CVE-ID: CVE-2022-3643)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of network packets. An attacker with access to the guest OS can trigger the related physical NIC on the host to reset, abort, or crash by sending certain kinds of packets.

4) Resource management error (CVE-ID: CVE-2022-3903)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an incorrect read request flaw in the Infrared Transceiver USB driver in Linux kernel. An attacker with physical access to the system can starve system resources and perform a denial of service (DoS) attack.

5) Resource management error (CVE-ID: CVE-2022-42328)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

6) Resource management error (CVE-ID: CVE-2022-42329)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2147