OESA-2023-1252 (CVE-2022-36280)
Vulnerability from osv_openeuler – Published: 2023-04-21 11:05 – Updated: 2026-08-06 11:05 – Source websiteThe Linux Kernel, the operating system core itself.
Security Fix(es):
An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).(CVE-2022-36280)
When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.(CVE-2022-27672)
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.(CVE-2023-30456)
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices.(CVE-2023-1989)
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.
(CVE-2023-1829)
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"kernel-debuginfo-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"kernel-tools-debuginfo-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"kernel-tools-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"python3-perf-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"python3-perf-debuginfo-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"python2-perf-debuginfo-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"kernel-tools-devel-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"bpftool-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"kernel-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"perf-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"bpftool-debuginfo-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"python2-perf-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"kernel-devel-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"perf-debuginfo-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"kernel-debugsource-4.19.90-2304.4.0.0198.oe1.aarch64.rpm",
"kernel-source-4.19.90-2304.4.0.0198.oe1.aarch64.rpm"
],
"src": [
"kernel-4.19.90-2304.4.0.0198.oe1.src.rpm"
],
"x86_64": [
"bpftool-debuginfo-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"perf-debuginfo-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"kernel-tools-devel-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"kernel-devel-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"python2-perf-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"python2-perf-debuginfo-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"kernel-debugsource-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"kernel-tools-debuginfo-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"kernel-source-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"kernel-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"bpftool-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"kernel-tools-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"perf-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"python3-perf-debuginfo-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"python3-perf-4.19.90-2304.4.0.0198.oe1.x86_64.rpm",
"kernel-debuginfo-4.19.90-2304.4.0.0198.oe1.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:20.03-LTS-SP3",
"name": "kernel",
"purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-20.03-LTS-SP3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.19.90-2304.4.0.0198.oe1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nAn out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file \u0026apos;/dev/dri/renderD128 (or Dxxx)\u0026apos;. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).(CVE-2022-36280)\r\n\r\nWhen SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.(CVE-2022-27672)\r\n\r\nAn issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.(CVE-2023-30456)\r\n\r\nA use-after-free flaw was found in btsdio_remove in drivers\\bluetooth\\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices.(CVE-2023-1989)\r\n\r\nA use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation.\u00a0The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure.\u00a0A local attacker user can use this vulnerability to elevate its privileges to root.\nWe recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.\r\n\r\n(CVE-2023-1829)",
"id": "OESA-2023-1252",
"modified": "2026-08-06T11:05:43Z",
"published": "2023-04-21T11:05:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1252"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36280"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27672"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30456"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1989"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1829"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "kernel security update",
"upstream": [
"CVE-2022-36280",
"CVE-2022-27672",
"CVE-2023-30456",
"CVE-2023-1989",
"CVE-2023-1829"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.