Lucene search

K
openvasCopyright (C) 2024 Greenbone AGOPENVAS:1361412562311220242206
HistoryAug 21, 2024 - 12:00 a.m.

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2024-2206)

2024-08-2100:00:00
Copyright (C) 2024 Greenbone AG
plugins.openvas.org
11
huawei euleros
security advisory
kernel
multiple cves

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

10

Confidence

High

EPSS

0.001

Percentile

43.8%

The remote host is missing an update for the Huawei EulerOS

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.1.2.2024.2206");
  script_cve_id("CVE-2021-47265", "CVE-2021-47427", "CVE-2021-47469", "CVE-2022-48651", "CVE-2022-48666", "CVE-2022-48689", "CVE-2022-48692", "CVE-2022-48703", "CVE-2023-52652", "CVE-2023-52656", "CVE-2023-52672", "CVE-2023-52676", "CVE-2023-52677", "CVE-2023-52683", "CVE-2023-52693", "CVE-2023-52698", "CVE-2023-52732", "CVE-2023-52752", "CVE-2023-52753", "CVE-2023-52757", "CVE-2023-52759", "CVE-2023-52762", "CVE-2023-52764", "CVE-2023-52796", "CVE-2023-52808", "CVE-2023-52814", "CVE-2023-52818", "CVE-2023-52831", "CVE-2023-52832", "CVE-2023-52835", "CVE-2023-52843", "CVE-2023-52847", "CVE-2023-52859", "CVE-2023-52864", "CVE-2023-52868", "CVE-2023-52869", "CVE-2024-26830", "CVE-2024-26845", "CVE-2024-26857", "CVE-2024-26915", "CVE-2024-26923", "CVE-2024-26924", "CVE-2024-26925", "CVE-2024-26931", "CVE-2024-26934", "CVE-2024-26935", "CVE-2024-26937", "CVE-2024-26947", "CVE-2024-26953", "CVE-2024-26958", "CVE-2024-26960", "CVE-2024-26961", "CVE-2024-26973", "CVE-2024-26974", "CVE-2024-26976", "CVE-2024-26982", "CVE-2024-26984", "CVE-2024-26988", "CVE-2024-26993", "CVE-2024-27004", "CVE-2024-27008", "CVE-2024-27010", "CVE-2024-27011", "CVE-2024-27012", "CVE-2024-27013", "CVE-2024-27014", "CVE-2024-27017", "CVE-2024-27019", "CVE-2024-27020", "CVE-2024-27038", "CVE-2024-27043", "CVE-2024-27044", "CVE-2024-27046", "CVE-2024-27059", "CVE-2024-27065", "CVE-2024-27073", "CVE-2024-27075", "CVE-2024-27389", "CVE-2024-27395", "CVE-2024-27397", "CVE-2024-27403", "CVE-2024-27415", "CVE-2024-27431", "CVE-2024-35790", "CVE-2024-35791", "CVE-2024-35807", "CVE-2024-35808", "CVE-2024-35809", "CVE-2024-35823", "CVE-2024-35835", "CVE-2024-35847", "CVE-2024-35852", "CVE-2024-35854", "CVE-2024-35855", "CVE-2024-35870", "CVE-2024-35877", "CVE-2024-35879", "CVE-2024-35886", "CVE-2024-35888", "CVE-2024-35895", "CVE-2024-35896", "CVE-2024-35897", "CVE-2024-35900", "CVE-2024-35904", "CVE-2024-35905", "CVE-2024-35910", "CVE-2024-35924", "CVE-2024-35925", "CVE-2024-35939", "CVE-2024-35950", "CVE-2024-35958", "CVE-2024-35960", "CVE-2024-35967", "CVE-2024-35973", "CVE-2024-35984", "CVE-2024-35989", "CVE-2024-35995", "CVE-2024-35997", "CVE-2024-36000", "CVE-2024-36004", "CVE-2024-36006", "CVE-2024-36007", "CVE-2024-36008", "CVE-2024-36015", "CVE-2024-36016", "CVE-2024-36020", "CVE-2024-36021", "CVE-2024-36031", "CVE-2024-36883", "CVE-2024-36886", "CVE-2024-36898", "CVE-2024-36899", "CVE-2024-36900", "CVE-2024-36901", "CVE-2024-36902", "CVE-2024-36903", "CVE-2024-36904", "CVE-2024-36905", "CVE-2024-36908", "CVE-2024-36914", "CVE-2024-36916", "CVE-2024-36917", "CVE-2024-36919", "CVE-2024-36924", "CVE-2024-36927", "CVE-2024-36933", "CVE-2024-36938", "CVE-2024-36939", "CVE-2024-36940", "CVE-2024-36949", "CVE-2024-36950", "CVE-2024-36953", "CVE-2024-36954", "CVE-2024-36959", "CVE-2024-36968", "CVE-2024-36971", "CVE-2024-36978", "CVE-2024-38564", "CVE-2024-38601", "CVE-2024-38662");
  script_tag(name:"creation_date", value:"2024-08-21 04:43:08 +0000 (Wed, 21 Aug 2024)");
  script_version("2024-08-21T05:05:38+0000");
  script_tag(name:"last_modification", value:"2024-08-21 05:05:38 +0000 (Wed, 21 Aug 2024)");
  script_tag(name:"cvss_base", value:"6.8");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2024-08-19 18:31:13 +0000 (Mon, 19 Aug 2024)");

  script_name("Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2024-2206)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("Huawei EulerOS Local Security Checks");
  script_dependencies("gb_huawei_euleros_consolidation.nasl");
  script_mandatory_keys("ssh/login/euleros", "ssh/login/rpms", re:"ssh/login/release=EULEROS\-2\.0SP11");

  script_xref(name:"Advisory-ID", value:"EulerOS-SA-2024-2206");
  script_xref(name:"URL", value:"https://developer.huaweicloud.com/intl/en-us/euleros/securitydetail.html?secId=EulerOS-SA-2024-2206");

  script_tag(name:"summary", value:"The remote host is missing an update for the Huawei EulerOS 'kernel' package(s) announced via the EulerOS-SA-2024-2206 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list. sockets are AF_UNIX/SOCK_STREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped connect(S, addr) sendmsg(S, [V]), close(V) __unix_gc() ---------------- ------------------------- ----------- NS = unix_create1() skb1 = sock_wmalloc(NS) L = unix_find_other(addr) unix_state_lock(L) unix_peer(S) = NS // V count=1 inflight=0 NS = unix_peer(S) skb2 = sock_alloc() skb_queue_tail(NS, skb2[V]) // V became in-flight // V count=2 inflight=1 close(V) // V count=1 inflight=1 // GC candidate condition met for u in gc_inflight_list: if (total_refs == inflight_refs) add u to gc_candidates // gc_candidates={L, V} for u in gc_candidates: scan_children(u, dec_inflight) // embryo (skb1) was not // reachable from L yet, so V's // inflight remains unchanged __skb_queue_tail(L, skb1) unix_state_unlock(L) for u in gc_candidates: if (u.inflight) scan_children(u, inc_inflight_move_tail) // V count=1 inflight=2 (!) If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains unaffected.(CVE-2024-26923)

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - resolve race condition during AER recovery During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data structure's memory. If the device restart will take more than 10 seconds the function scheduling that restart will exit due to a timeout, and the reset_data structure will be freed. However, this data structure is used for completion notification after the restart is completed, which leads to a UAF bug. (CVE-2024-26974)

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit Allows us to detect subsequent IH ring buffer overflows as well.(CVE-2024-26915)

In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case ... [Please see the references for more information on the vulnerabilities]");

  script_tag(name:"affected", value:"'kernel' package(s) on Huawei EulerOS V2.0SP11.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");
  script_xref(name:"CISA", value:"Known Exploited Vulnerability (KEV) catalog");
  script_xref(name:"URL", value:"https://www.cisa.gov/known-exploited-vulnerabilities-catalog");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "EULEROS-2.0SP11") {

  if(!isnull(res = isrpmvuln(pkg:"bpftool", rpm:"bpftool~5.10.0~60.18.0.50.h1479.eulerosv2r11", rls:"EULEROS-2.0SP11"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"kernel", rpm:"kernel~5.10.0~60.18.0.50.h1479.eulerosv2r11", rls:"EULEROS-2.0SP11"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"kernel-abi-stablelists", rpm:"kernel-abi-stablelists~5.10.0~60.18.0.50.h1479.eulerosv2r11", rls:"EULEROS-2.0SP11"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"kernel-tools", rpm:"kernel-tools~5.10.0~60.18.0.50.h1479.eulerosv2r11", rls:"EULEROS-2.0SP11"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"kernel-tools-libs", rpm:"kernel-tools-libs~5.10.0~60.18.0.50.h1479.eulerosv2r11", rls:"EULEROS-2.0SP11"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"python3-perf", rpm:"python3-perf~5.10.0~60.18.0.50.h1479.eulerosv2r11", rls:"EULEROS-2.0SP11"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

10

Confidence

High

EPSS

0.001

Percentile

43.8%