openEuler 24.03 LTS update for kernel



Risk Low
Patch available YES
Number of vulnerabilities 20
CVE-ID CVE-2024-36972
CVE-2024-40954
CVE-2024-40958
CVE-2024-41057
CVE-2024-42159
CVE-2024-43873
CVE-2024-44977
CVE-2024-44983
CVE-2024-44998
CVE-2024-46746
CVE-2024-49853
CVE-2024-49986
CVE-2024-50121
CVE-2024-50125
CVE-2024-50280
CVE-2024-53070
CVE-2024-53095
CVE-2024-53108
CVE-2024-53129
CVE-2024-53142
CWE-ID CWE-125
CWE-416
CWE-20
CWE-908
CWE-415
CWE-399
CWE-476
Exploitation vector Local
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

bpftool-debuginfo
Operating systems & Components / Operating system package or component

bpftool
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 20 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU91664

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36972

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the queue_oob(), unix_stream_recv_urg() and manage_oob() functions in net/unix/af_unix.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU94217

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40954

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sk_common_release() function in net/core/sock.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU94215

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40958

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the EXPORT_SYMBOL_GPL() function in net/core/net_namespace.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU94945

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41057

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cachefiles_free_volume() function in fs/cachefiles/volume.c, within the cachefiles_withdraw_objects() and cachefiles_withdraw_cache() functions in fs/cachefiles/cache.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU95089

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42159

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the mpi3mr_sas_port_add() function in drivers/scsi/mpi3mr/mpi3mr_transport.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use of uninitialized resource

EUVDB-ID: #VU96300

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43873

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the vhost_vsock_dev_open() and vhost_vsock_set_features() functions in drivers/vhost/vsock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds read

EUVDB-ID: #VU96844

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44977

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ta_if_load_debugfs_write() function in drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use of uninitialized resource

EUVDB-ID: #VU96869

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44983

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the nf_flow_skb_encap_protocol() function in net/netfilter/nf_flow_table_ip.c, within the nf_flow_offload_inet_hook() function in net/netfilter/nf_flow_table_inet.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU96842

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44998

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the dequeue_rx() function in drivers/atm/idt77252.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use-after-free

EUVDB-ID: #VU97494

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46746

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the amdtp_hid_remove() function in drivers/hid/amd-sfh-hid/amd_sfh_hid.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Double free

EUVDB-ID: #VU99059

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49853

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the scmi_optee_chan_free() function in drivers/firmware/arm_scmi/optee.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU98881

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49986

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the x86_android_tablet_probe() function in drivers/platform/x86/x86-android-tablets/core.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Use-after-free

EUVDB-ID: #VU99804

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50121

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nfs4_state_shutdown_net() function in fs/nfsd/nfs4state.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use-after-free

EUVDB-ID: #VU99806

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50125

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the SCO_CONN_TIMEOUT(), sco_sock_timeout() and sco_conn_del() functions in net/bluetooth/sco.c, within the bt_sock_unlink() function in net/bluetooth/af_bluetooth.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Use-after-free

EUVDB-ID: #VU100614

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50280

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the check_migrations(), destroy(), cache_create() and cache_ctr() functions in drivers/md/dm-cache-target.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Resource management error

EUVDB-ID: #VU100737

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53070

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the dwc3_suspend_common() function in drivers/usb/dwc3/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Use-after-free

EUVDB-ID: #VU100830

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53095

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the clean_demultiplex_info(), cifs_put_tcp_session() and generic_ip_connect() functions in fs/smb/client/connect.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Use-after-free

EUVDB-ID: #VU101101

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53108

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the parse_amd_vsdb() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) NULL pointer dereference

EUVDB-ID: #VU101224

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53129

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vop_plane_atomic_async_check() function in drivers/gpu/drm/rockchip/rockchip_drm_vop.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use of uninitialized resource

EUVDB-ID: #VU101347

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53142

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the do_name() and do_copy() functions in init/initramfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-72.0.0.64

python3-perf: before 6.6.0-72.0.0.64

perf-debuginfo: before 6.6.0-72.0.0.64

perf: before 6.6.0-72.0.0.64

kernel-tools-devel: before 6.6.0-72.0.0.64

kernel-tools-debuginfo: before 6.6.0-72.0.0.64

kernel-tools: before 6.6.0-72.0.0.64

kernel-source: before 6.6.0-72.0.0.64

kernel-headers: before 6.6.0-72.0.0.64

kernel-devel: before 6.6.0-72.0.0.64

kernel-debugsource: before 6.6.0-72.0.0.64

kernel-debuginfo: before 6.6.0-72.0.0.64

bpftool-debuginfo: before 6.6.0-72.0.0.64

bpftool: before 6.6.0-72.0.0.64

kernel: before 6.6.0-72.0.0.64

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2590


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###