Detections
Analytics

EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2025-1562)

critical Nessus Plugin ID 236908

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In the Linux kernel, the following vulnerability has been resolved:ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() The debugfs_create_dir() function returns error pointers. It never returns NULL. So use IS_ERR() to check it.(CVE-2023-52917)

 tracing: Free buffers when a used dynamic event is removed(CVE-2022-49006)

 block, bfq: fix possible UAF for bfqq-bic with merge chain(CVE-2024-47706)

 In the Linux kernel, the following vulnerability has been resolved:iommu: Return right value in iommu_sva_bind_device() iommu_sva_bind_device() should return either a sva bond handle or an ERR_PTR value in error cases. Existing drivers (idxd and uacce) only check the return value with IS_ERR(). This could potentially lead to a kernel NULL pointer dereference issue if the function returns NULL instead of an error pointer. In reality, this doesn't cause any problems because iommu_sva_bind_device() only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA. In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will return an error, and the device drivers won't call iommu_sva_bind_device() at all.(CVE-2024-40945)

 net: hns3: void array out of bound when loop tnl_num(CVE-2024-46833)

 KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3(CVE-2024-46707)

 net/mlx5: Fix bridge mode operations when there are no VFs(CVE-2024-46857)

 In the Linux kernel, the following vulnerability has been resolved:netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning.(CVE-2024-46855)

 fsnotify: clear PARENT_WATCHED flags lazily(CVE-2024-47660)

 tcp_bpf: fix return value of tcp_bpf_sendmsg()(CVE-2024-46783)

 mlxsw: spectrum_acl_erp: Fix object nesting warning(CVE-2024-43880)

 xdp: fix invalid wait context of page_pool_destroy()(CVE-2024-43834)

 virtio_net: Fix napi_skb_cache_put warning (CVE-2024-43835)

 net: hns3: fix kernel crash problem in concurrent scenario (CVE-2024-39507)

 xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()(CVE-2024-40959)

 In the Linux kernel, the following vulnerability has been resolved:net: ena: Add validation for completion descriptors consistency Validate that `first` flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur. A new reset reason for RX data corruption has been added.(CVE-2024-40999)

 ipvlan: Dont Use skb-sk in ipvlan_process_v{4,6}_outbound(CVE-2024-33621)

 net: relax socket state check at accept time(CVE-2024-36484)

 net: fix information leakage in /proc et/ptype(CVE-2022-48757)

 net: bridge: vlan: fix memory leak in __allowed_ingress(CVE-2022-48748)

 In the Linux kernel, the following vulnerability has been resolved:USB: usbtmc: prevent kernel-usb- infoleak The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields.(CVE-2024-47671)

 hv_netvsc: Register VF in netvsc_probe(CVE-2024-26820)

 vfs: Don't evict inode under the inode lru traversing context(CVE-2024-45003)

 perf/x86/intel: Limit the period on Haswell(CVE-2024-46848)

 ethtool: fail closed if we can't get max channel used in indirection tables(CVE-2024-46834)

 ELF: fix kernel.randomize_va_space double read(CVE-2024-46826)

 arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry(CVE-2024-46822)

 sched/smt: Fix unbalance sched_smt_present dec/inc(CVE-2024-44958)

 platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses(CVE-2024-46859)

 rtmutex: Drop rt_mutex::wait_lock before scheduling(CVE-2024-46829)

 drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[](CVE-2024-46815)

 drm/amd/display: Check link_index before accessing dc-links[](CVE-2024-46813)

 drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links(CVE-2024-46816)

 drm/amd/display: Check msg_id before processing transcation(CVE-2024-46814)

 thunderbolt: Mark XDomain as unplugged when router is removed(CVE-2024-46702)

 nvmet-tcp: fix kernel crash if commands allocation fails(CVE-2024-46737)

 of/irq: Prevent device address out-of-bounds read in interrupt map walk(CVE-2024-46743)

 VMCI: Fix use-after-free when removing resource in vmci_resource_remove()(CVE-2024-46738)

 usb: typec: ucsi: Fix null pointer dereference in trace(CVE-2024-46719)

 pktgen: use cpus_read_lock() in pg_net_init()(CVE-2024-46681)

 ethtool: check device is present when getting link settings(CVE-2024-46679)

 apparmor: fix possible NULL pointer dereference(CVE-2024-46721)

 selinux,smack: don't bypass permissions check in inode_setsecctx hook(CVE-2024-46695)

 bonding: change ipsec_lock from spin lock to mutex(CVE-2024-46678)

 PCI: Add missing bridge lock to pci_bus_lock()(CVE-2024-46750)

 ice: Add netif_device_attach/detach into PF reset flow(CVE-2024-46770)

 md: fix deadlock between mddev_suspend and flush bio(CVE-2024-43855)

 driver: iio: add missing checks on iio_info's callback access(CVE-2024-46715)

 uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind (CVE-2024-46739)

 Squashfs: sanity check symbolic link size(CVE-2024-46744)

 Input: MT - limit max slots(CVE-2024-45008)

 drm/amd/display: Assign linear_pitch_alignment even for VM(CVE-2024-46732)

 netem: fix return value if duplicate enqueue fails(CVE-2024-45016)

 sch etem: fix use after free in netem_dequeue(CVE-2024-46800)

 userfaultfd: fix checks for huge PMDs(CVE-2024-46787)

 netfilter: flowtable: initialise extack before use(CVE-2024-45018)

 rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back(CVE-2024-27414)

 xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING(CVE-2024-35976)

 net: atlantic: eliminate double free in error handling logic(CVE-2023-52664)

 netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()(CVE-2024-35898)

 net/ipv6: avoid possible UAF in ip6_route_mpath_notify()(CVE-2024-26852)

 udf: Avoid excessive partition lengths(CVE-2024-46777)

 scsi: aacraid: Fix double-free on probe failure(CVE-2024-46673)

 In the Linux kernel, the following vulnerability has been resolved:memcg_write_event_control(): fix a user-triggerable oops we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).(CVE-2024-45021)

 drm/client: fix null pointer dereference in drm_client_modeset_probe(CVE-2024-43894)

 drm/qxl: Add check for drm_cvt_mode(CVE-2024-43829)

 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation(CVE-2024-36017)

 net: core: reject skb_copy(_expand) for fraglist GSO skbs(CVE-2024-36929)

 perf/aux: Fix AUX buffer serialization(CVE-2024-46713)

 fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE(CVE-2024-45025)

 driver core: Fix uevent_show() vs driver detach race(CVE-2024-44952)

 x86/mtrr: Check if fixed MTRRs exist before saving them(CVE-2024-44948)

 bonding: fix null pointer deref in bond_ipsec_offload_ok(CVE-2024-44990)

 net: hns3: fix a deadlock problem when config TC during resetting(CVE-2024-44995)

 bonding: fix xfrm real_dev null pointer dereference(CVE-2024-44989)

 scsi: qla2xxx: Fix for possible memory corruption(CVE-2024-42288)

 xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration(CVE-2024-45006)

 dmaengine: idxd: Prevent use after free on completion memory(CVE-2022-48867)

 drm/vmwgfx: Remove rcu locks from user resources(CVE-2022-48887)

 RDMA/hns: Fix soft lockup under heavy CEQE load(CVE-2024-43872)

 ipv6: prevent UAF in ip6_send_skb()(CVE-2024-44987)

 md/raid5: avoid BUG_ON() while continue reshape after reassembling(CVE-2024-43914)

 kvm: s390: Reject memory region operations for ucontrol VMs(CVE-2024-43819)

 ipv6: fix possible UAF in ip6_finish_output2()(CVE-2024-44986)

 devres: Fix memory leakage caused by driver API devm_free_percpu()(CVE-2024-43871)

 drm/vmwgfx: Fix a deadlock in dma buf fence polling(CVE-2024-43863)

 media: xc2028: avoid use-after-free in load_firmware_cb()(CVE-2024-43900)

 gpio: prevent potential speculation leaks in gpio_device_get_desc()(CVE-2024-44931)

 netns: Make get_net_ns() handle zero refcount net(CVE-2024-40958)

 tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc(CVE-2023-52880)

 memcg: protect concurrent access to mem_cgroup_idr(CVE-2024-43892)

 netfilter: ctnetlink: use helper function to calculate expect ID(CVE-2024-44944)

 udf: Fix bogus checksum computation in udf_rename()(CVE-2024-43845)

 scsi: qla2xxx: validate nvme_local_port correctly(CVE-2024-42286)

 padata: Fix possible divide-by-0 panic in padata_mt_helper()(CVE-2024-43889)

 serial: core: check uartclk for zero to avoid divide by zero(CVE-2024-43893)

 sctp: Fix null-ptr-deref in reuseport_add_sock()(CVE-2024-44935)

 scsi: qla2xxx: Complete command early within lock(CVE-2024-42287)

 net: bridge: mcast: wait for previous gc cycles when removing port(CVE-2024-44934)

 bpf: Add schedule points in batch ops(CVE-2022-48939)

 apparmor: Fix null pointer deref when receiving skb during sock creation(CVE-2023-52889)

 dev/parport: fix the array out-of-bounds risk(CVE-2024-42301)

 block: initialize integrity buffer to zero before writing it to media(CVE-2024-43854)

 dma: fix call order in dmam_free_coherent(CVE-2024-43856)

 tracing: Fix overflow in get_free_elt()(CVE-2024-43890)

 ipv6: prevent possible NULL deref in fib6_nh_init()(CVE-2024-40961)

 sysctl: always initialize i_uid/i_gid(CVE-2024-42312)

 kobject_uevent: Fix OOB access within zap_modalias_env()(CVE-2024-42292)

 A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service.(CVE-2023-6356)

 A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.(CVE-2023-6535)

 bpf: sync_linked_regs() must preserve subreg_def(CVE-2024-53125)

 nvme-multipath: defer partition scanning(CVE-2024-53093)

 dm cache: fix flushing uninitialized delayed_work on cache_ctr error(CVE-2024-50280)

 net: fix data-races around sk-sk_forward_alloc(CVE-2024-53124)

 NFSD: Never decrement pending_async_copies on error(CVE-2024-53073)

 smb: client: Fix use-after-free of network namespace.(CVE-2024-53095)

 mm: resolve faulty mmap_region() error path behaviour(CVE-2024-53096)

 media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format(CVE-2024-53104)

 arm64: probes: Fix uprobes for big-endian kernels(CVE-2024-50194)

 HID: core: zero-initialize the report buffer(CVE-2024-50302)

 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find().(CVE-2024-50304)

 i40e: fix race condition by adding filter's intermediate sync state(CVE-2024-53088)

 media: dvbdev: prevent the risk of out of memory access(CVE-2024-53063)

 dm cache: fix potential out-of-bounds access on the first resume(CVE-2024-50278)

 dm cache: fix out-of-bounds access to the dirty bitset when resizing(CVE-2024-50279)

 net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT(CVE-2024-53057)

 usb: typec: altmode should keep reference to parent(CVE-2024-50150)

 vsock/virtio: Initialization of the dangling pointer occurring in vsk-trans(CVE-2024-50264)

 USB: serial: io_edgeport: fix use after free in debug printk(CVE-2024-50267)

 filemap: Fix bounds checking in filemap_read().(CVE-2024-50272)

 sctp: properly validate chunk size in sctp_sf_ootb().(CVE-2024-50299)

 bpf: Check validity of link-type in bpf_link_show_fdinfo().(CVE-2024-53099)

 media: av7110: fix a spectre vulnerability(CVE-2024-50289)

 RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages(CVE-2024-50208)

 security/keys: fix slab-out-of-bounds in key_task_permission(CVE-2024-50301)

 KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory(CVE-2024-50115)

 nfs: Fix KMSAN warning in decode_getfattr_attrs().(CVE-2024-53066)

 net: missing check virtio(CVE-2024-43817)

 io_uring/rw: fix missing NOWAIT check for O_DIRECT start write(CVE-2024-53052)

 An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF), which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or check_btf_info in kernel/bpf/verifier.c), aka CID-350a5c4dd245.(CVE-2021-29648)

 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start(CVE-2024-49944)

 be2net: fix potential memory leak in be_xmit().(CVE-2024-50167)

 netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6().(CVE-2024-50256)

 netfilter: nft_payload: sanitize offset and length before calling skb_checksum().(CVE-2024-50251)

 net: hns3: fix kernel crash when uninstalling driver(CVE-2024-50296)

 tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().(CVE-2024-50154)

 net: fix crash when config small gso_max_size/gso_ipv4_max_size(CVE-2024-50258)

 RDMA/bnxt_re: Add a check for memory allocation(CVE-2024-50209)

 netfilter: nf_tables: prevent nf_skb_duplicated corruption(CVE-2024-49952)

 udf: fix uninit-value use in udf_get_fileshortad(CVE-2024-50143)

 bpf: Fix out-of-bounds write in trie_get_next_key().(CVE-2024-50262)

 tpm: Lock TPM chip in tpm_pm_suspend() first(CVE-2024-53085)

 bpf: support non-r10 register spill/fill to/from stack in precision tracking(CVE-2023-52920)

 bpf, arm64: Fix address emission with tag-based KASAN enabled(CVE-2024-50203)

 mm/swapfile: skip HugeTLB pages for unuse_vma(CVE-2024-50199)

 secretmem: disable memfd_secret() if arch cannot set direct map(CVE-2024-50182)

 NFSD: Initialize struct nfsd4_copy earlier(CVE-2024-50241)

 nvme-pci: fix race condition between reset and nvme_dev_disable().(CVE-2024-50135)

 irqchip/gic-v4: Don't allow a VMOVP on a dying VPE(CVE-2024-50192)

 bpf: Use raw_spinlock_t in ringbuf(CVE-2024-50138)

 x86/sgx: Fix deadlock in SGX NUMA node search(CVE-2024-49856)

 KVM: x86: Acquire kvm-srcu when handling KVM_SET_VCPU_EVENTS(CVE-2024-46830)

 RDMA/mad: Improve handling of timed out WRs of mad agent(CVE-2024-50095)

 ceph: remove the incorrect Fw reference check when dirtying pages(CVE-2024-50179)

 kernel: Fix page corruption caused by racy check in __free_pages(CVE-2023-52739)

 xfrm: validate new SA's prefixlen using SA family when sel.family is unset(CVE-2024-50142)

 posix-clock: Fix missing timespec64 check in pc_clock_settime().(CVE-2024-50195)

 iommu/vt-d: Fix double list_add when enabling VMD in scalable mode(CVE-2022-48916)

 static_call: Replace pointless WARN_ON() in static_call_module_notify().(CVE-2024-49954)

 tracing: Consider the NULL character when validating the event length(CVE-2024-50131)

 tty: n_gsm: Fix use-after-free in gsm_cleanup_mux(CVE-2024-50073)

 arm64: probes: Remove broken LDR (literal) uprobe support(CVE-2024-50099)

 net: add more sanity checks to qdisc_pkt_len_init().(CVE-2024-49948)

 net: avoid potential underflow in qdisc_pkt_len_init() with UFO(CVE-2024-49949)

 l2tp: prevent possible tunnel refcount underflow(CVE-2024-49940)

 RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency(CVE-2024-47696)

 smb: client: fix OOBs when building SMB2_IOCTL request(CVE-2024-50151)

 platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug(CVE-2024-49886)

 resource: fix region_intersects() vs add_memory_driver_managed().(CVE-2024-49878)

 sched: Fix yet more sched_fork() races(CVE-2022-48944)

 sched/fair: Fix fault in reweight_entity(CVE-2022-48921)

 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name(CVE-2024-49934)

 usb: xhci: Check endpoint is valid before dereferencing it(CVE-2023-52901)

 gso: fix udp gso fraglist segmentation after pull from frag_list(CVE-2024-49978)

 NFSD: Limit the number of concurrent async COPY operations(CVE-2024-49974)

 drm/amd/display: Initialize denominators' default to 1(CVE-2024-49899)

 igb: Initialize mailbox message for VF reset(CVE-2022-48949)

 tipc: guard against string buffer overrun(CVE-2024-49995)

 net/mlx5: Fix error path in multi-packet WQE transmit(CVE-2024-50001)

 static_call: Handle module init failure correctly in static_call_del_module().(CVE-2024-50002)

 blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race(CVE-2024-50082)

 iommu/vt-d: Fix PCI device refcount leak in has_external_pci()(CVE-2022-49000)

 drm/amd/display: Skip wbscl_set_scaler_filter if filter is null(CVE-2024-46714)

 memcg: fix possible use-after-free in memcg_write_event_control().(CVE-2022-48988)

 ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference(CVE-2022-48999)

 drm/amd/display: Avoid overflow assignment in link_dp_cts(CVE-2024-50016)

 x86/bugs: Use code segment selector for VERW operand(CVE-2024-50072)

 parport: Proper fix for array out-of-bounds access(CVE-2024-50074)

 net: phy: fix null-ptr-deref while probe() failed(CVE-2022-49021)

 ext4: fix timer use-after-free on failed mount(CVE-2024-49960)

 ext4: fix i_data_sem unlock order in ext4_ind_migrate().(CVE-2024-50006)

 ext4: fix access to uninitialised lock in fc replay path(CVE-2024-50014)

 bpf: Prevent tail call between progs attached to different hooks(CVE-2024-50063)

 RDMA/cxgb4: Added NULL check for lookup_atid(CVE-2024-47749)

 nfsd: map the EBADMSG to nfserr_io to avoid warning(CVE-2024-49875)

 iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()(CVE-2022-49002)

 nbd: fix race between timeout and normal completion(CVE-2024-49855)

 io_uring: check if we need to reschedule during overflow flush(CVE-2024-50060)

 ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free(CVE-2024-49983)

 net: Fix an unsafe loop on the list(CVE-2024-50024)

 rtc: cmos: Fix event handler registration ordering issue(CVE-2022-48953)

 gpiolib: fix memory leak in gpiochip_setup_dev().(CVE-2022-48975)

 thermal: core: Reference count the zone in thermal_zone_get_by_id().(CVE-2024-50028)

 nfsd: return -EINVAL when namelen is 0(CVE-2024-47692)

 IB/core: Fix ib_cache_setup_one error flow cleanup(CVE-2024-47693)

 efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption(CVE-2024-49858)

 igb: Do not bring the device up after non-fatal error(CVE-2024-50040)

 uprobes: fix kernel info leak via '[uprobes]' vma(CVE-2024-49975)

 serial: protect uart_port_dtr_rts() in uart_shutdown() too(CVE-2024-50058)

 bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error(CVE-2024-47728)

 NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies().(CVE-2024-50046)

 lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc().(CVE-2024-47668)

 iavf: Fix error handling in iavf_init_module().(CVE-2022-49027)

 netfilter: xtables: avoid NFPROTO_UNSPEC where needed(CVE-2024-50038)

 net: mdio: fix unbalanced fwnode reference count in mdio_device_release().(CVE-2022-48961)

 bpf, lsm: Add check for BPF LSM return value(CVE-2024-47703)

 net/sched: accept TCA_STAB only for root qdisc(CVE-2024-50039)

 block: fix potential invalid pointer dereference in blk_add_partition(CVE-2024-47705)

 drm/amd/display: Check null pointers before using dc-clk_mgr(CVE-2024-49907)

 scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths(CVE-2024-49891)

 nfsd: call cache_put if xdr_reserve_space returns NULL(CVE-2024-47737)

 padata: use integer wrap around to prevent deadlock on seq_nr overflow(CVE-2024-47739)

 ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev().(CVE-2024-47707)

 HID: core: fix shift-out-of-bounds in hid_report_raw_event(CVE-2022-48978)

 af_unix: Get user_ns from in_skb in unix_diag_get_exact().(CVE-2022-48970)

 icmp: change the order of rate limits(CVE-2024-47678)

 vfs: fix race between evice_inodes() and find_inode()iput().(CVE-2024-47679)

 ixgbevf: Fix resource leak in ixgbevf_init_module().(CVE-2022-49028)

 tipc: re-fetch skb cb after tipc_msg_validate(CVE-2022-49017)

 net: tun: Fix use-after-free in tun_detach()(CVE-2022-49014)

 net/mlx5e: Fix use-after-free when reverting termination table(CVE-2022-49025)

 drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error(CVE-2024-47697)

 smb: client: fix UAF in async decryption(CVE-2024-50047)

 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error(CVE-2024-47698)

 crypto: hisilicon/qm - inject error before stopping queue(CVE-2024-47730)

 bpf: Fix helper writes to read-only maps(CVE-2024-49861)

 ppp: fix ppp_async_encode() illegal access(CVE-2024-50035)

 cifs: Fix buffer overflow when parsing NFS reparse points(CVE-2024-49996)

 libbpf: Handle size overflow for ringbuf mmap(CVE-2022-49030)

 slip: make slhc_remember() more robust against malicious packets(CVE-2024-50033)

 netfilter: br_netfilter: fix panic with metadata_dst skb(CVE-2024-50045)

 ACPI: sysfs: validate return type of _STR method(CVE-2024-49860)

 firmware_loader: Block path traversal(CVE-2024-47742)

 drm/amd/display: Fix index out of bounds in degamma hardware format translation(CVE-2024-49894)

 vhost/scsi: null-ptr-dereference in vhost_scsi_get_req().(CVE-2024-49863)

 uprobe: avoid out-of-bounds memory access of fetching args(CVE-2024-50067)

 ACPI: battery: Fix possible crash when unregistering a battery hook(CVE-2024-49955)

 jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error(CVE-2024-49959)

 ext4: dax: fix overflowing extents beyond inode size when partially writing(CVE-2024-50015)

 udf: Fix preallocation discarding at indirect extent boundary(CVE-2022-48946)

 ext4: avoid OOB when system.data xattr changes underneath the filesystem(CVE-2024-47701)

 fbdev: efifb: Register sysfs groups through driver core(CVE-2024-49925)

 net: do not delay dst_entries_add() in dst_release()(CVE-2024-50036)

 ext4: avoid use-after-free in ext4_ext_show_leaf().(CVE-2024-49889)

 ext4: fix slab-use-after-free in ext4_split_extent_at().(CVE-2024-49884)

 ext4: aovid use-after-free in ext4_ext_insert_extent().(CVE-2024-49883)

 ext4: fix double brelse() the buffer of the extents path(CVE-2024-49882)

 ext4: update orig_path in ext4_find_extent().(CVE-2024-49881)

 ACPI: PAD: fix crash in exit_round_robin().(CVE-2024-49935)

 netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()(CVE-2024-47685)

 scsi: fnic: Move flush_work initialization out of if block(CVE-2024-50025)

 tpm: Clean up TPM space after command failure(CVE-2024-49851)

 tcp: check skb is non-NULL in tcp_rto_delta_us().(CVE-2024-47684)

 sock_map: Add a cond_resched() in sock_hash_free().(CVE-2024-47710)

 vhost_vdpa: assign irq bypass producer token correctly(CVE-2024-47748)

 mm: call the security_mmap_file() LSM hook in remap_file_pages().(CVE-2024-47745)

 x86/ioapic: Handle allocation failures gracefully(CVE-2024-49927)

 mm: avoid leaving partial pfn mappings around in error case(CVE-2024-47674)

 blk_iocost: fix more out of bound shifts(CVE-2024-49933)

 ice: protect XDP configuration with a mutex(CVE-2024-46765)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

See Also

http://www.nessus.org/u?7feb509a

Plugin Details

Severity: Critical

ID: 236908

File Name: EulerOS_SA-2025-1562.nasl

Version: 1.1

Type: local

Published: 5/17/2025

Updated: 5/17/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 4

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2021-29648

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS Score Source: CVE-2024-47685

Vulnerability Information

CPE: cpe:/o:huawei:euleros:uvp:2.12.0, p-cpe:/a:huawei:euleros:kernel-tools-libs, p-cpe:/a:huawei:euleros:bpftool, p-cpe:/a:huawei:euleros:kernel-tools, p-cpe:/a:huawei:euleros:kernel, p-cpe:/a:huawei:euleros:python3-perf, p-cpe:/a:huawei:euleros:kernel-abi-stablelists

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/12/2025

Vulnerability Publication Date: 3/30/2021

CISA Known Exploited Vulnerability Due Dates: 2/26/2025, 3/25/2025

Reference Information

CVE: CVE-2021-29648, CVE-2022-48748, CVE-2022-48757, CVE-2022-48867, CVE-2022-48887, CVE-2022-48916, CVE-2022-48921, CVE-2022-48939, CVE-2022-48944, CVE-2022-48946, CVE-2022-48949, CVE-2022-48953, CVE-2022-48961, CVE-2022-48970, CVE-2022-48975, CVE-2022-48978, CVE-2022-48988, CVE-2022-48999, CVE-2022-49000, CVE-2022-49002, CVE-2022-49006, CVE-2022-49014, CVE-2022-49017, CVE-2022-49021, CVE-2022-49025, CVE-2022-49027, CVE-2022-49028, CVE-2022-49030, CVE-2023-52664, CVE-2023-52739, CVE-2023-52880, CVE-2023-52889, CVE-2023-52901, CVE-2023-52917, CVE-2023-52920, CVE-2023-6356, CVE-2023-6535, CVE-2024-26820, CVE-2024-26852, CVE-2024-27414, CVE-2024-33621, CVE-2024-35898, CVE-2024-35976, CVE-2024-36017, CVE-2024-36484, CVE-2024-36929, CVE-2024-39507, CVE-2024-40945, CVE-2024-40958, CVE-2024-40959, CVE-2024-40961, CVE-2024-40999, CVE-2024-42286, CVE-2024-42287, CVE-2024-42288, CVE-2024-42292, CVE-2024-42301, CVE-2024-42312, CVE-2024-43817, CVE-2024-43819, CVE-2024-43829, CVE-2024-43834, CVE-2024-43835, CVE-2024-43845, CVE-2024-43854, CVE-2024-43855, CVE-2024-43856, CVE-2024-43863, CVE-2024-43871, CVE-2024-43872, CVE-2024-43880, CVE-2024-43889, CVE-2024-43890, CVE-2024-43892, CVE-2024-43893, CVE-2024-43894, CVE-2024-43900, CVE-2024-43914, CVE-2024-44931, CVE-2024-44934, CVE-2024-44935, CVE-2024-44944, CVE-2024-44948, CVE-2024-44952, CVE-2024-44958, CVE-2024-44986, CVE-2024-44987, CVE-2024-44989, CVE-2024-44990, CVE-2024-44995, CVE-2024-45003, CVE-2024-45006, CVE-2024-45008, CVE-2024-45016, CVE-2024-45018, CVE-2024-45021, CVE-2024-45025, CVE-2024-46673, CVE-2024-46678, CVE-2024-46679, CVE-2024-46681, CVE-2024-46695, CVE-2024-46702, CVE-2024-46707, CVE-2024-46713, CVE-2024-46714, CVE-2024-46715, CVE-2024-46719, CVE-2024-46721, CVE-2024-46732, CVE-2024-46737, CVE-2024-46738, CVE-2024-46739, CVE-2024-46743, CVE-2024-46744, CVE-2024-46750, CVE-2024-46765, CVE-2024-46770, CVE-2024-46777, CVE-2024-46783, CVE-2024-46787, CVE-2024-46800, CVE-2024-46813, CVE-2024-46814, CVE-2024-46815, CVE-2024-46816, CVE-2024-46822, CVE-2024-46826, CVE-2024-46829, CVE-2024-46830, CVE-2024-46833, CVE-2024-46834, CVE-2024-46848, CVE-2024-46855, CVE-2024-46857, CVE-2024-46859, CVE-2024-47660, CVE-2024-47668, CVE-2024-47671, CVE-2024-47674, CVE-2024-47678, CVE-2024-47679, CVE-2024-47684, CVE-2024-47685, CVE-2024-47692, CVE-2024-47693, CVE-2024-47696, CVE-2024-47697, CVE-2024-47698, CVE-2024-47701, CVE-2024-47703, CVE-2024-47705, CVE-2024-47706, CVE-2024-47707, CVE-2024-47710, CVE-2024-47728, CVE-2024-47730, CVE-2024-47737, CVE-2024-47739, CVE-2024-47742, CVE-2024-47745, CVE-2024-47748, CVE-2024-47749, CVE-2024-49851, CVE-2024-49855, CVE-2024-49856, CVE-2024-49858, CVE-2024-49860, CVE-2024-49861, CVE-2024-49863, CVE-2024-49875, CVE-2024-49878, CVE-2024-49881, CVE-2024-49882, CVE-2024-49883, CVE-2024-49884, CVE-2024-49886, CVE-2024-49889, CVE-2024-49891, CVE-2024-49894, CVE-2024-49899, CVE-2024-49907, CVE-2024-49925, CVE-2024-49927, CVE-2024-49933, CVE-2024-49934, CVE-2024-49935, CVE-2024-49940, CVE-2024-49944, CVE-2024-49948, CVE-2024-49949, CVE-2024-49952, CVE-2024-49954, CVE-2024-49955, CVE-2024-49959, CVE-2024-49960, CVE-2024-49974, CVE-2024-49975, CVE-2024-49978, CVE-2024-49983, CVE-2024-49995, CVE-2024-49996, CVE-2024-50001, CVE-2024-50002, CVE-2024-50006, CVE-2024-50014, CVE-2024-50015, CVE-2024-50016, CVE-2024-50024, CVE-2024-50025, CVE-2024-50028, CVE-2024-50033, CVE-2024-50035, CVE-2024-50036, CVE-2024-50038, CVE-2024-50039, CVE-2024-50040, CVE-2024-50045, CVE-2024-50046, CVE-2024-50047, CVE-2024-50058, CVE-2024-50060, CVE-2024-50063, CVE-2024-50067, CVE-2024-50072, CVE-2024-50073, CVE-2024-50074, CVE-2024-50082, CVE-2024-50095, CVE-2024-50099, CVE-2024-50115, CVE-2024-50131, CVE-2024-50135, CVE-2024-50138, CVE-2024-50142, CVE-2024-50143, CVE-2024-50150, CVE-2024-50151, CVE-2024-50154, CVE-2024-50167, CVE-2024-50179, CVE-2024-50182, CVE-2024-50192, CVE-2024-50194, CVE-2024-50195, CVE-2024-50199, CVE-2024-50203, CVE-2024-50208, CVE-2024-50209, CVE-2024-50241, CVE-2024-50251, CVE-2024-50256, CVE-2024-50258, CVE-2024-50262, CVE-2024-50264, CVE-2024-50267, CVE-2024-50272, CVE-2024-50278, CVE-2024-50279, CVE-2024-50280, CVE-2024-50289, CVE-2024-50296, CVE-2024-50299, CVE-2024-50301, CVE-2024-50302, CVE-2024-50304, CVE-2024-53052, CVE-2024-53057, CVE-2024-53063, CVE-2024-53066, CVE-2024-53073, CVE-2024-53085, CVE-2024-53088, CVE-2024-53093, CVE-2024-53095, CVE-2024-53096, CVE-2024-53099, CVE-2024-53104, CVE-2024-53124, CVE-2024-53125