openEuler 22.03 LTS SP3 update for kernel



Risk Low
Patch available YES
Number of vulnerabilities 20
CVE-ID CVE-2024-24858
CVE-2024-26813
CVE-2024-26857
CVE-2024-26956
CVE-2024-26966
CVE-2024-26969
CVE-2024-26974
CVE-2024-26981
CVE-2024-26996
CVE-2024-27001
CVE-2024-44969
CVE-2024-50279
CVE-2024-53050
CVE-2024-53226
CVE-2024-56549
CVE-2024-56626
CVE-2024-56648
CVE-2024-56690
CVE-2024-56728
CVE-2024-56758
CWE-ID CWE-362
CWE-476
CWE-908
CWE-119
CWE-125
CWE-416
CWE-399
CWE-20
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 20 vulnerabilities.

1) Race condition

EUVDB-ID: #VU92720

Risk: Low

CVSSv4.0: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-24858

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU90588

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26813

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vfio_platform_set_irq_unmask(), vfio_automasked_irq_handler(), vfio_irq_handler(), vfio_set_trigger(), vfio_platform_set_irq_trigger(), vfio_platform_set_irqs_ioctl(), vfio_platform_irq_init() and vfio_platform_irq_cleanup() functions in drivers/vfio/platform/vfio_platform_irq.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use of uninitialized resource

EUVDB-ID: #VU90876

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26857

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the geneve_rx() function in drivers/net/geneve.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU93155

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26956

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nilfs_direct_lookup_contig() function in fs/nilfs2/direct.c, within the nilfs_btree_lookup_contig() function in fs/nilfs2/btree.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU91394

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26966

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the F() function in drivers/clk/qcom/mmcc-apq8084.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

EUVDB-ID: #VU91397

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26969

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the F() function in drivers/clk/qcom/gcc-ipq8074.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU90185

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26974

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the adf_device_reset_worker() and adf_dev_aer_schedule_reset() functions in drivers/crypto/qat/qat_common/adf_aer.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU90318

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26981

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nilfs_type_by_mode[() function in fs/nilfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU90184

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26996

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ncm_set_alt() and ncm_disable() functions in drivers/usb/gadget/function/f_ncm.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource management error

EUVDB-ID: #VU92969

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27001

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vmk80xx_find_usb_endpoints() function in drivers/comedi/drivers/vmk80xx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU96885

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44969

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the sclp_sd_store_data() function in drivers/s390/char/sclp_sd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds read

EUVDB-ID: #VU100620

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50279

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the can_resize() function in drivers/md/dm-cache-target.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) NULL pointer dereference

EUVDB-ID: #VU100709

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53050

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the intel_dp_hdcp2_get_capability() function in drivers/gpu/drm/i915/display/intel_dp_hdcp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) NULL pointer dereference

EUVDB-ID: #VU102142

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53226

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hns_roce_set_page() and hns_roce_map_mr_sg() functions in drivers/infiniband/hw/hns/hns_roce_mr.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU102151

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56549

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cachefiles_ondemand_fd_write_iter() and cachefiles_ondemand_fd_llseek() functions in fs/cachefiles/ondemand.c, within the cachefiles_commit_object() and cachefiles_clean_up_object() functions in fs/cachefiles/interface.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Out-of-bounds read

EUVDB-ID: #VU102081

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56626

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the smb2_write() function in fs/smb/server/smb2pdu.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Out-of-bounds read

EUVDB-ID: #VU102079

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56648

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the fill_frame_info() function in net/hsr/hsr_forward.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Input validation error

EUVDB-ID: #VU102261

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56690

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pcrypt_aead_encrypt() and pcrypt_aead_decrypt() functions in crypto/pcrypt.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Input validation error

EUVDB-ID: #VU102272

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56728

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the otx2_get_pauseparam() and otx2_set_fecparam() functions in drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) NULL pointer dereference

EUVDB-ID: #VU102398

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56758

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the relocate_one_folio() function in fs/btrfs/relocation.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-247.0.0.149

python3-perf: before 5.10.0-247.0.0.149

perf-debuginfo: before 5.10.0-247.0.0.149

perf: before 5.10.0-247.0.0.149

kernel-tools-devel: before 5.10.0-247.0.0.149

kernel-tools-debuginfo: before 5.10.0-247.0.0.149

kernel-tools: before 5.10.0-247.0.0.149

kernel-source: before 5.10.0-247.0.0.149

kernel-headers: before 5.10.0-247.0.0.149

kernel-devel: before 5.10.0-247.0.0.149

kernel-debugsource: before 5.10.0-247.0.0.149

kernel-debuginfo: before 5.10.0-247.0.0.149

kernel: before 5.10.0-247.0.0.149

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1080


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###