An update for kernel is now available for openEuler-20.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2023-1439 Final 1.0 1.0 2023-07-21 Initial 2023-07-21 2023-07-21 openEuler SA Tool V1.0 2023-07-21 kernel security update An update for kernel is now available for openEuler-20.03-LTS-SP3. The Linux Kernel, the operating system core itself. Security Fix(es): A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.(CVE-2023-1295) A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090) A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system.(CVE-2023-3117) An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.(CVE-2023-3220) A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system.(CVE-2023-3338) A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.(CVE-2023-3358) An update for kernel is now available for openEuler-20.03-LTS-SP3. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High kernel https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1439 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-1295 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-3090 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-3117 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-3220 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-3338 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-3358 https://nvd.nist.gov/vuln/detail/CVE-2023-1295 https://nvd.nist.gov/vuln/detail/CVE-2023-3090 https://nvd.nist.gov/vuln/detail/CVE-2023-3117 https://nvd.nist.gov/vuln/detail/CVE-2023-3220 https://nvd.nist.gov/vuln/detail/CVE-2023-3338 https://nvd.nist.gov/vuln/detail/CVE-2023-3358 openEuler-20.03-LTS-SP3 kernel-devel-4.19.90-2307.4.0.0210.oe1.aarch64.rpm kernel-tools-4.19.90-2307.4.0.0210.oe1.aarch64.rpm kernel-debuginfo-4.19.90-2307.4.0.0210.oe1.aarch64.rpm kernel-tools-debuginfo-4.19.90-2307.4.0.0210.oe1.aarch64.rpm kernel-tools-devel-4.19.90-2307.4.0.0210.oe1.aarch64.rpm kernel-4.19.90-2307.4.0.0210.oe1.aarch64.rpm bpftool-debuginfo-4.19.90-2307.4.0.0210.oe1.aarch64.rpm kernel-debugsource-4.19.90-2307.4.0.0210.oe1.aarch64.rpm python2-perf-debuginfo-4.19.90-2307.4.0.0210.oe1.aarch64.rpm python3-perf-debuginfo-4.19.90-2307.4.0.0210.oe1.aarch64.rpm perf-debuginfo-4.19.90-2307.4.0.0210.oe1.aarch64.rpm python2-perf-4.19.90-2307.4.0.0210.oe1.aarch64.rpm perf-4.19.90-2307.4.0.0210.oe1.aarch64.rpm kernel-source-4.19.90-2307.4.0.0210.oe1.aarch64.rpm python3-perf-4.19.90-2307.4.0.0210.oe1.aarch64.rpm bpftool-4.19.90-2307.4.0.0210.oe1.aarch64.rpm kernel-4.19.90-2307.4.0.0210.oe1.src.rpm perf-4.19.90-2307.4.0.0210.oe1.x86_64.rpm python2-perf-4.19.90-2307.4.0.0210.oe1.x86_64.rpm bpftool-4.19.90-2307.4.0.0210.oe1.x86_64.rpm python2-perf-debuginfo-4.19.90-2307.4.0.0210.oe1.x86_64.rpm kernel-debugsource-4.19.90-2307.4.0.0210.oe1.x86_64.rpm kernel-4.19.90-2307.4.0.0210.oe1.x86_64.rpm kernel-debuginfo-4.19.90-2307.4.0.0210.oe1.x86_64.rpm kernel-tools-debuginfo-4.19.90-2307.4.0.0210.oe1.x86_64.rpm kernel-tools-4.19.90-2307.4.0.0210.oe1.x86_64.rpm perf-debuginfo-4.19.90-2307.4.0.0210.oe1.x86_64.rpm kernel-tools-devel-4.19.90-2307.4.0.0210.oe1.x86_64.rpm python3-perf-4.19.90-2307.4.0.0210.oe1.x86_64.rpm bpftool-debuginfo-4.19.90-2307.4.0.0210.oe1.x86_64.rpm python3-perf-debuginfo-4.19.90-2307.4.0.0210.oe1.x86_64.rpm kernel-devel-4.19.90-2307.4.0.0210.oe1.x86_64.rpm kernel-source-4.19.90-2307.4.0.0210.oe1.x86_64.rpm A time-of-check to time-of-use issue exists in io_uring subsystem s IORING_OP_CLOSE operation in the Linux kernel s versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93. 2023-07-21 CVE-2023-1295 openEuler-20.03-LTS-SP3 High 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H kernel security update 2023-07-21 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1439 A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. 2023-07-21 CVE-2023-3090 openEuler-20.03-LTS-SP3 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H kernel security update 2023-07-21 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1439 A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system. 2023-07-21 CVE-2023-3117 openEuler-20.03-LTS-SP3 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H kernel security update 2023-07-21 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1439 An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference. 2023-07-21 CVE-2023-3220 openEuler-20.03-LTS-SP3 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H kernel security update 2023-07-21 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1439 A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system. 2023-07-21 CVE-2023-3338 openEuler-20.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H kernel security update 2023-07-21 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1439 A null pointer dereference was found in the Linux kernel s Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system. 2023-07-21 CVE-2023-3358 openEuler-20.03-LTS-SP3 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H kernel security update 2023-07-21 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1439