OESA-2024-1106

Dashboard / Vulnerabilities / OESA-2024-1106

OESA-2024-1106

Summary: kernel security update

Details: The Linux Kernel, the operating system core itself. Security Fix(es): An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap.(CVE-2022-48619) A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.(CVE-2024-0340) A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.(CVE-2024-0641)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1106, https://nvd.nist.gov/vuln/detail/CVE-2022-48619, https://nvd.nist.gov/vuln/detail/CVE-2024-0340, https://nvd.nist.gov/vuln/detail/CVE-2024-0641