SB20250704138 - openEuler 22.03 LTS SP4 update for kernel

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2022-50057)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ntfs_update_mftmirr() function in fs/ntfs3/fsntfs.c. A local user can perform a denial of service (DoS) attack.

2) Integer overflow (CVE-ID: CVE-2022-50167)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the array_map_alloc(), array_map_lookup_elem(), array_map_update_elem(), array_map_free_timers(), array_map_free(), bpf_array_map_seq_start(), bpf_array_map_seq_next() and bpf_for_each_array_elem() functions in kernel/bpf/arraymap.c. A local user can execute arbitrary code.

3) Buffer overflow (CVE-ID: CVE-2022-50230)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the SYM_FUNC_START_LOCAL() function in arch/arm64/kernel/head.S. A local user can perform a denial of service (DoS) attack.

4) Resource management error (CVE-ID: CVE-2024-26798)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the fbcon_do_set_font() function in drivers/video/fbdev/core/fbcon.c. A local user can perform a denial of service (DoS) attack.

5) Buffer overflow (CVE-ID: CVE-2025-21927)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the nvme_tcp_queue_id() and nvme_tcp_recv_pdu() functions in drivers/nvme/host/tcp.c. A local user can escalate privileges on the system.

6) Buffer overflow (CVE-ID: CVE-2025-22026)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nfsd_show() function in fs/nfsd/stats.c, within the nfsd_net_init() function in fs/nfsd/nfsctl.c. A local user can perform a denial of service (DoS) attack.

7) Memory leak (CVE-ID: CVE-2025-38031)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the padata_reorder() function in kernel/padata.c. A local user can perform a denial of service (DoS) attack.

8) Use-after-free (CVE-ID: CVE-2025-38078)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the snd_pcm_buffer_access_unlock() function in sound/core/pcm_native.c, within the snd_pcm_oss_change_params_locked() function in sound/core/oss/pcm_oss.c. A local user can escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1728