openEuler 20.03 LTS SP4 update for kernel



Risk Low
Patch available YES
Number of vulnerabilities 14
CVE-ID CVE-2022-48627
CVE-2022-48629
CVE-2023-47233
CVE-2023-52486
CVE-2023-52504
CVE-2023-52524
CVE-2023-52607
CVE-2023-7042
CVE-2024-24861
CVE-2024-25739
CVE-2024-26615
CVE-2024-26654
CVE-2024-26663
CVE-2024-26696
CWE-ID CWE-400
CWE-200
CWE-416
CWE-667
CWE-125
CWE-476
CWE-362
CWE-754
Exploitation vector Local
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python2-perf
Operating systems & Components / Operating system package or component

python2-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

bpftool
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

bpftool-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 14 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU92194

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48627

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU93004

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48629

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A local user can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU82755

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-47233

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows an attacker to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the brcm80211 in a brcmf_cfg80211_detach in the device unplugging (disconnect the USB by hotplug) code. An attacker with physical access to device can trigger a use-after-free error and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper locking

EUVDB-ID: #VU90801

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52486

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the drivers/gpu/drm/drm_plane.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU90347

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52504

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the apply_alternatives() function in arch/x86/kernel/alternative.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper locking

EUVDB-ID: #VU91319

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52524

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nfc_llcp_register_device() function in net/nfc/llcp_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) NULL pointer dereference

EUVDB-ID: #VU90841

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52607

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pgtable_cache_add() function in arch/powerpc/mm/init-common.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) NULL pointer dereference

EUVDB-ID: #VU85422

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-7042

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() function in drivers/net/wireless/ath/ath10k/wmi-tlv.c. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Race condition

EUVDB-ID: #VU91634

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-24861

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the xc4000 xc4000_get_frequency() function in the media/xc4000 device driver. A local user can exploit the race and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper check for unusual or exceptional conditions

EUVDB-ID: #VU92399

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-25739

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper check for unusual or exceptional conditions error within the ubi_read_volume_table() function in drivers/mtd/ubi/vtbl.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) NULL pointer dereference

EUVDB-ID: #VU90627

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26615

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __smc_diag_dump() function in net/smc/smc_diag.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Race condition

EUVDB-ID: #VU88148

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26654

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in sound/sh/aica.c. A local user can exploit the race and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) NULL pointer dereference

EUVDB-ID: #VU92073

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26663

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the tipc_nl_bearer_add() function in net/tipc/bearer.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper locking

EUVDB-ID: #VU90795

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26696

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nilfs_page_mkwrite() function in fs/nilfs2/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

python2-perf: before 4.19.90-2404.3.0.0274

python2-perf-debuginfo: before 4.19.90-2404.3.0.0274

python3-perf-debuginfo: before 4.19.90-2404.3.0.0274

perf-debuginfo: before 4.19.90-2404.3.0.0274

kernel-tools: before 4.19.90-2404.3.0.0274

bpftool: before 4.19.90-2404.3.0.0274

python3-perf: before 4.19.90-2404.3.0.0274

kernel-tools-debuginfo: before 4.19.90-2404.3.0.0274

kernel-debuginfo: before 4.19.90-2404.3.0.0274

bpftool-debuginfo: before 4.19.90-2404.3.0.0274

perf: before 4.19.90-2404.3.0.0274

kernel-tools-devel: before 4.19.90-2404.3.0.0274

kernel-debugsource: before 4.19.90-2404.3.0.0274

kernel-devel: before 4.19.90-2404.3.0.0274

kernel-source: before 4.19.90-2404.3.0.0274

kernel: before 4.19.90-2404.3.0.0274

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1497


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###