Anolis OS update for linux-firmware
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-31315 |
| CWE-ID | CWE-264 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Anolis OS Operating systems & Components / Operating system linux-firmware Operating systems & Components / Operating system package or component iwl7260-firmware Operating systems & Components / Operating system package or component iwl6050-firmware Operating systems & Components / Operating system package or component iwl6000g2b-firmware Operating systems & Components / Operating system package or component iwl6000g2a-firmware Operating systems & Components / Operating system package or component iwl6000-firmware Operating systems & Components / Operating system package or component iwl5150-firmware Operating systems & Components / Operating system package or component iwl5000-firmware Operating systems & Components / Operating system package or component iwl4965-firmware Operating systems & Components / Operating system package or component iwl3945-firmware Operating systems & Components / Operating system package or component iwl3160-firmware Operating systems & Components / Operating system package or component iwl2030-firmware Operating systems & Components / Operating system package or component iwl2000-firmware Operating systems & Components / Operating system package or component iwl135-firmware Operating systems & Components / Operating system package or component iwl105-firmware Operating systems & Components / Operating system package or component iwl1000-firmware Operating systems & Components / Operating system package or component iwl100-firmware Operating systems & Components / Operating system package or component |
| Vendor | OpenAnolis |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU96619
Risk: Low
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-31315
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper validation in a model specific register (MSR). A malicious application with ring0 access can modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsAnolis OS: 7
linux-firmware: before 20200421-84.git78c0348
iwl7260-firmware: before 25.30.13.0-84
iwl6050-firmware: before 41.28.5.1-84
iwl6000g2b-firmware: before 18.168.6.1-84
iwl6000g2a-firmware: before 18.168.6.1-84
iwl6000-firmware: before 9.221.4.1-84
iwl5150-firmware: before 8.24.2.2-84
iwl5000-firmware: before 8.83.5.1_1-84
iwl4965-firmware: before 228.61.2.24-84
iwl3945-firmware: before 15.32.2.9-84
iwl3160-firmware: before 25.30.13.0-84
iwl2030-firmware: before 18.168.6.1-84
iwl2000-firmware: before 18.168.6.1-84
iwl135-firmware: before 18.168.6.1-84
iwl105-firmware: before 18.168.6.1-84
iwl1000-firmware: before 39.31.5.1-84
iwl100-firmware: before 39.31.5.1-84
CPE2.3- cpe:2.3:o:openanolis:anolis_os:7:*:*:*:*:*:*:*
- cpe:2.3:a:openanolis:linux-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl7260-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6050-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000g2b-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000g2a-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl6000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl5150-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl5000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl4965-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl3945-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl3160-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl2030-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl2000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl135-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl105-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl1000-firmware:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:a:openanolis:iwl100-firmware:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2024:0905
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
