Detections
Analytics

Google: sys-kernel/lakitu-kernel-5_10, sys-kernel/lakitu-kernel-5_15: security update to 17109.0.0

medium Tenable Cloud Security Plugin ID 452438

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to
 restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently
 allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass
 verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and
 unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for
 peripherals that do not verify firmware updates. We recommend upgrading past commit
 4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

Solution

Update the sys-kernel/lakitu-kernel-5_10 library and its related packages to version 17109.0.0 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-101.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 452438

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.92

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2022-2503

CVSS v3

Risk Factor: Medium

Base Score: 6.7

Temporal Score: 6

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/21/2021

Reference Information

CVE: CVE-2022-2503