Anolis OS update for linux-firmware
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-20592 |
| CWE-ID | CWE-758 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Anolis OS Operating systems & Components / Operating system linux-firmware Operating systems & Components / Operating system package or component iwl7260-firmware Operating systems & Components / Operating system package or component iwl6050-firmware Operating systems & Components / Operating system package or component iwl6000g2b-firmware Operating systems & Components / Operating system package or component iwl6000g2a-firmware Operating systems & Components / Operating system package or component iwl6000-firmware Operating systems & Components / Operating system package or component iwl5150-firmware Operating systems & Components / Operating system package or component iwl5000-firmware Operating systems & Components / Operating system package or component iwl4965-firmware Operating systems & Components / Operating system package or component iwl3945-firmware Operating systems & Components / Operating system package or component iwl3160-firmware Operating systems & Components / Operating system package or component iwl2030-firmware Operating systems & Components / Operating system package or component iwl2000-firmware Operating systems & Components / Operating system package or component iwl135-firmware Operating systems & Components / Operating system package or component iwl105-firmware Operating systems & Components / Operating system package or component iwl1000-firmware Operating systems & Components / Operating system package or component iwl100-firmware Operating systems & Components / Operating system package or component |
| Vendor | OpenAnolis |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Reliance on undefined behavior
EUVDB-ID: #VU84028
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-20592
CWE-ID:
CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to unexpected behavior of the INVD instruction in some AMD CPUs. A malicious hypervisor can affect cache line write-back behavior of the CPU and modify guest virtual machine (VM) memory.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsAnolis OS: 7
linux-firmware: before 20200421-82.git78c0348
iwl7260-firmware: before 25.30.13.0-82
iwl6050-firmware: before 41.28.5.1-82
iwl6000g2b-firmware: before 18.168.6.1-82
iwl6000g2a-firmware: before 18.168.6.1-82
iwl6000-firmware: before 9.221.4.1-82
iwl5150-firmware: before 8.24.2.2-82
iwl5000-firmware: before 8.83.5.1_1-82
iwl4965-firmware: before 228.61.2.24-82
iwl3945-firmware: before 15.32.2.9-82
iwl3160-firmware: before 25.30.13.0-82
iwl2030-firmware: before 18.168.6.1-82
iwl2000-firmware: before 18.168.6.1-82
iwl135-firmware: before 18.168.6.1-82
iwl105-firmware: before 18.168.6.1-82
iwl1000-firmware: before 39.31.5.1-82
iwl100-firmware: before 39.31.5.1-82
CPE2.3- cpe:2.3:o:openanolis:anolis_os:7:*:*:*:*:*:*:*
- cpe:2.3:a:openanolis:linux-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl7260-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6050-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000g2b-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000g2a-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl5150-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl5000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl4965-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl3945-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl3160-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl2030-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl2000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl135-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl105-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl1000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl100-firmware:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2024:0099
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
