SB2022123016 - openEuler 20.03 LTS SP1 update for kernel

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2022-20568)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation within the io_uring subcomponent in Kernel components. A local application can execute arbitrary code.

2) Incorrect authorization (CVE-ID: CVE-2022-20572)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a missing permission check within the verity_target() function in dm-verity-target.c. A local user can modify read-only files and escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-2160