{"schema_version":"1.7.2","id":"OESA-2023-1253","modified":"2023-04-21T11:05:12Z","published":"2023-04-21T11:05:12Z","upstream":["CVE-2022-1015","CVE-2022-36280","CVE-2023-30456","CVE-2023-1989","CVE-2023-1829"],"summary":"kernel security update","details":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.(CVE-2022-1015)\r\n\r\nAn out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file \u0026apos;/dev/dri/renderD128 (or Dxxx)\u0026apos;. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).(CVE-2022-36280)\r\n\r\nAn issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.(CVE-2023-30456)\r\n\r\nA use-after-free flaw was found in btsdio_remove in drivers\\bluetooth\\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices.(CVE-2023-1989)\r\n\r\nA use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.\nWe recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.\r\n\r\n(CVE-2023-1829)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS","name":"kernel","purl":"pkg:rpm/openEuler/kernel\u0026distro=openEuler-22.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-60.91.0.115.oe2203"}]}],"ecosystem_specific":{"aarch64":["kernel-debugsource-5.10.0-60.91.0.115.oe2203.aarch64.rpm","bpftool-5.10.0-60.91.0.115.oe2203.aarch64.rpm","kernel-devel-5.10.0-60.91.0.115.oe2203.aarch64.rpm","perf-5.10.0-60.91.0.115.oe2203.aarch64.rpm","kernel-5.10.0-60.91.0.115.oe2203.aarch64.rpm","bpftool-debuginfo-5.10.0-60.91.0.115.oe2203.aarch64.rpm","kernel-headers-5.10.0-60.91.0.115.oe2203.aarch64.rpm","python3-perf-debuginfo-5.10.0-60.91.0.115.oe2203.aarch64.rpm","kernel-tools-5.10.0-60.91.0.115.oe2203.aarch64.rpm","kernel-tools-devel-5.10.0-60.91.0.115.oe2203.aarch64.rpm","kernel-debuginfo-5.10.0-60.91.0.115.oe2203.aarch64.rpm","kernel-source-5.10.0-60.91.0.115.oe2203.aarch64.rpm","kernel-tools-debuginfo-5.10.0-60.91.0.115.oe2203.aarch64.rpm","perf-debuginfo-5.10.0-60.91.0.115.oe2203.aarch64.rpm","python3-perf-5.10.0-60.91.0.115.oe2203.aarch64.rpm"],"src":["kernel-5.10.0-60.91.0.115.oe2203.src.rpm"],"x86_64":["kernel-debuginfo-5.10.0-60.91.0.115.oe2203.x86_64.rpm","kernel-tools-devel-5.10.0-60.91.0.115.oe2203.x86_64.rpm","kernel-tools-5.10.0-60.91.0.115.oe2203.x86_64.rpm","kernel-5.10.0-60.91.0.115.oe2203.x86_64.rpm","kernel-debugsource-5.10.0-60.91.0.115.oe2203.x86_64.rpm","kernel-devel-5.10.0-60.91.0.115.oe2203.x86_64.rpm","kernel-source-5.10.0-60.91.0.115.oe2203.x86_64.rpm","python3-perf-debuginfo-5.10.0-60.91.0.115.oe2203.x86_64.rpm","python3-perf-5.10.0-60.91.0.115.oe2203.x86_64.rpm","perf-5.10.0-60.91.0.115.oe2203.x86_64.rpm","bpftool-debuginfo-5.10.0-60.91.0.115.oe2203.x86_64.rpm","kernel-headers-5.10.0-60.91.0.115.oe2203.x86_64.rpm","kernel-tools-debuginfo-5.10.0-60.91.0.115.oe2203.x86_64.rpm","perf-debuginfo-5.10.0-60.91.0.115.oe2203.x86_64.rpm","bpftool-5.10.0-60.91.0.115.oe2203.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1253"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1015"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36280"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30456"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1989"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1829"}],"database_specific":{"severity":"High"}}