An update for kernel is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2022-2147 Final 1.0 1.0 2022-12-24 Initial 2022-12-24 2022-12-24 openEuler SA Tool V1.0 2022-12-24 kernel security update An update for kernel is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP3. The Linux Kernel, the operating system core itself. Security Fix(es): In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel(CVE-2022-20566) An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.(CVE-2022-3107) Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.(CVE-2022-3643) An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system.(CVE-2022-3903) Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).(CVE-2022-42329) An update for kernel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical kernel https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2147 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-20566 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-3107 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-3643 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-3903 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-42328 https://nvd.nist.gov/vuln/detail/CVE-2022-20566 https://nvd.nist.gov/vuln/detail/CVE-2022-3107 https://nvd.nist.gov/vuln/detail/CVE-2022-3643 https://nvd.nist.gov/vuln/detail/CVE-2022-3903 https://nvd.nist.gov/vuln/detail/CVE-2022-42328 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 kernel-debugsource-4.19.90-2212.3.0.0182.oe1.aarch64.rpm perf-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm python3-perf-4.19.90-2212.3.0.0182.oe1.aarch64.rpm bpftool-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm perf-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-source-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-tools-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-tools-devel-4.19.90-2212.3.0.0182.oe1.aarch64.rpm python3-perf-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-4.19.90-2212.3.0.0182.oe1.aarch64.rpm python2-perf-4.19.90-2212.3.0.0182.oe1.aarch64.rpm bpftool-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-devel-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-tools-4.19.90-2212.3.0.0182.oe1.aarch64.rpm python2-perf-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm bpftool-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm bpftool-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-tools-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-devel-4.19.90-2212.3.0.0182.oe1.aarch64.rpm python2-perf-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-4.19.90-2212.3.0.0182.oe1.aarch64.rpm perf-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm python2-perf-4.19.90-2212.3.0.0182.oe1.aarch64.rpm perf-4.19.90-2212.3.0.0182.oe1.aarch64.rpm python3-perf-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-tools-debuginfo-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-debugsource-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-tools-devel-4.19.90-2212.3.0.0182.oe1.aarch64.rpm python3-perf-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-source-4.19.90-2212.3.0.0182.oe1.aarch64.rpm kernel-4.19.90-2212.3.0.0182.oe1.src.rpm kernel-4.19.90-2212.3.0.0182.oe1.src.rpm kernel-tools-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm python2-perf-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-4.19.90-2212.3.0.0182.oe1.x86_64.rpm python2-perf-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-debugsource-4.19.90-2212.3.0.0182.oe1.x86_64.rpm perf-4.19.90-2212.3.0.0182.oe1.x86_64.rpm perf-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-devel-4.19.90-2212.3.0.0182.oe1.x86_64.rpm bpftool-4.19.90-2212.3.0.0182.oe1.x86_64.rpm python3-perf-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-source-4.19.90-2212.3.0.0182.oe1.x86_64.rpm python3-perf-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-tools-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-tools-devel-4.19.90-2212.3.0.0182.oe1.x86_64.rpm bpftool-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm bpftool-4.19.90-2212.3.0.0182.oe1.x86_64.rpm python2-perf-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-devel-4.19.90-2212.3.0.0182.oe1.x86_64.rpm python2-perf-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm python3-perf-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm perf-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm python3-perf-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-tools-4.19.90-2212.3.0.0182.oe1.x86_64.rpm perf-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-4.19.90-2212.3.0.0182.oe1.x86_64.rpm bpftool-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-tools-debuginfo-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-tools-devel-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-source-4.19.90-2212.3.0.0182.oe1.x86_64.rpm kernel-debugsource-4.19.90-2212.3.0.0182.oe1.x86_64.rpm In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel 2022-12-24 CVE-2022-20566 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H kernel security update 2022-12-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2147 An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference. 2022-12-24 CVE-2022-3107 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 High 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H kernel security update 2022-12-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2147 Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior. 2022-12-24 CVE-2022-3643 openEuler-20.03-LTS-SP1 Critical 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H kernel security update 2022-12-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2147 An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system. 2022-12-24 CVE-2022-3903 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 Medidum 4.6 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H kernel security update 2022-12-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2147 Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329). 2022-12-24 CVE-2022-42328 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 Medidum 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H kernel security update 2022-12-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2147