SB2025042212 - Anolis OS update for kernel:4.18

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025042212

SB2025042212 - Anolis OS update for kernel:4.18

Published: April 22, 2025

Security Bulletin ID SB2025042212
CSH Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2024-53150)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber


The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the DESC_LENGTH_CHECK(), validate_clock_source() and validate_clock_selector() functions in sound/usb/clock.c. A local user can perform a denial of service (DoS) attack.


2) Processor optimization removal or modification of security-critical code (CVE-ID: CVE-2024-53241)

CWE-ID: CWE-1037 - Processor optimization removal or modification of security-critical code

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a malicious guest to gain access to sensitive information.

The vulnerability exists due to implemented mitigations for hardware vulnerabilities related to Xen hypercall page implementation the guest OS is relying on to work might not be fully functional, resulting in e.g. guest user processes being able to read data they ought not have access to.


Remediation

Install update from vendor's website.

References