Anolis OS update for kernel:4.18

Published: 2025-05-27 | Updated: 2025-07-03

Risk	Low
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2024-40906 CVE-2024-44970 CVE-2025-21756
CWE-ID	CWE-401 CWE-119 CWE-416
Exploitation vector	Local
Public exploit	Public exploit code for vulnerability #3 is available.
Vulnerable software	Anolis OS Operating systems & Components / Operating system kernel-doc Operating systems & Components / Operating system package or component kernel-abi-stablelists Operating systems & Components / Operating system package or component python3-perf Operating systems & Components / Operating system package or component perf Operating systems & Components / Operating system package or component kernel-tools-libs-devel Operating systems & Components / Operating system package or component kernel-tools-libs Operating systems & Components / Operating system package or component kernel-tools Operating systems & Components / Operating system package or component kernel-modules-extra Operating systems & Components / Operating system package or component kernel-modules Operating systems & Components / Operating system package or component kernel-headers Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel-debug-modules-extra Operating systems & Components / Operating system package or component kernel-debug-modules Operating systems & Components / Operating system package or component kernel-debug-devel Operating systems & Components / Operating system package or component kernel-debug-core Operating systems & Components / Operating system package or component kernel-debug Operating systems & Components / Operating system package or component kernel-cross-headers Operating systems & Components / Operating system package or component kernel-core Operating systems & Components / Operating system package or component kernel Operating systems & Components / Operating system package or component bpftool Operating systems & Components / Operating system package or component
Vendor	OpenAnolis

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Memory leak

EUVDB-ID: #VU94202

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40906

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mlx5_function_teardown() function in drivers/net/ethernet/mellanox/mlx5/core/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-553.53.1.0.1

kernel-abi-stablelists: before 4.18.0-553.53.1.0.1

python3-perf: before 4.18.0-553.53.1.0.1

perf: before 4.18.0-553.53.1.0.1

kernel-tools-libs-devel: before 4.18.0-553.53.1.0.1

kernel-tools-libs: before 4.18.0-553.53.1.0.1

kernel-tools: before 4.18.0-553.53.1.0.1

kernel-modules-extra: before 4.18.0-553.53.1.0.1

kernel-modules: before 4.18.0-553.53.1.0.1

kernel-headers: before 4.18.0-553.53.1.0.1

kernel-devel: before 4.18.0-553.53.1.0.1

kernel-debug-modules-extra: before 4.18.0-553.53.1.0.1

kernel-debug-modules: before 4.18.0-553.53.1.0.1

kernel-debug-devel: before 4.18.0-553.53.1.0.1

kernel-debug-core: before 4.18.0-553.53.1.0.1

kernel-debug: before 4.18.0-553.53.1.0.1

kernel-cross-headers: before 4.18.0-553.53.1.0.1

kernel-core: before 4.18.0-553.53.1.0.1

kernel: before 4.18.0-553.53.1.0.1

bpftool: before 4.18.0-553.53.1.0.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2025:0279

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU96876

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44970

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the drivers/net/ethernet/mellanox/mlx5/core/en_rx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-553.53.1.0.1

kernel-abi-stablelists: before 4.18.0-553.53.1.0.1

python3-perf: before 4.18.0-553.53.1.0.1

perf: before 4.18.0-553.53.1.0.1

kernel-tools-libs-devel: before 4.18.0-553.53.1.0.1

kernel-tools-libs: before 4.18.0-553.53.1.0.1

kernel-tools: before 4.18.0-553.53.1.0.1

kernel-modules-extra: before 4.18.0-553.53.1.0.1

kernel-modules: before 4.18.0-553.53.1.0.1

kernel-headers: before 4.18.0-553.53.1.0.1

kernel-devel: before 4.18.0-553.53.1.0.1

kernel-debug-modules-extra: before 4.18.0-553.53.1.0.1

kernel-debug-modules: before 4.18.0-553.53.1.0.1

kernel-debug-devel: before 4.18.0-553.53.1.0.1

kernel-debug-core: before 4.18.0-553.53.1.0.1

kernel-debug: before 4.18.0-553.53.1.0.1

kernel-cross-headers: before 4.18.0-553.53.1.0.1

kernel-core: before 4.18.0-553.53.1.0.1

kernel: before 4.18.0-553.53.1.0.1

bpftool: before 4.18.0-553.53.1.0.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2025:0279

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU104945

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2025-21756

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the EXPORT_SYMBOL_GPL() and __vsock_release() functions in net/vmw_vsock/af_vsock.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

kernel-doc: before 4.18.0-553.53.1.0.1

kernel-abi-stablelists: before 4.18.0-553.53.1.0.1

python3-perf: before 4.18.0-553.53.1.0.1

perf: before 4.18.0-553.53.1.0.1

kernel-tools-libs-devel: before 4.18.0-553.53.1.0.1

kernel-tools-libs: before 4.18.0-553.53.1.0.1

kernel-tools: before 4.18.0-553.53.1.0.1

kernel-modules-extra: before 4.18.0-553.53.1.0.1

kernel-modules: before 4.18.0-553.53.1.0.1

kernel-headers: before 4.18.0-553.53.1.0.1

kernel-devel: before 4.18.0-553.53.1.0.1

kernel-debug-modules-extra: before 4.18.0-553.53.1.0.1

kernel-debug-modules: before 4.18.0-553.53.1.0.1

kernel-debug-devel: before 4.18.0-553.53.1.0.1

kernel-debug-core: before 4.18.0-553.53.1.0.1

kernel-debug: before 4.18.0-553.53.1.0.1

kernel-cross-headers: before 4.18.0-553.53.1.0.1

kernel-core: before 4.18.0-553.53.1.0.1

kernel: before 4.18.0-553.53.1.0.1

bpftool: before 4.18.0-553.53.1.0.1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2025:0279

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.