{"schema_version":"1.7.2","id":"OESA-2024-2549","modified":"2026-08-06T11:08:02Z","published":"2024-12-13T11:08:02Z","upstream":["CVE-2023-20584","CVE-2023-31356"],"summary":"linux-firmware security update","details":"This package contains firmware images required by some devices.\r\n\r\nSecurity Fix(es):\r\n\r\nIOMMU improperly handles certain special address\nranges with invalid device table entries (DTEs), which may allow an attacker\nwith privileges and a compromised Hypervisor to\ninduce DTE faults to bypass RMP checks in SEV-SNP, potentially leading to a\nloss of guest integrity.(CVE-2023-20584)\r\n\r\nIncomplete system memory cleanup in SEV firmware could\nallow a privileged attacker to corrupt guest private memory, potentially\nresulting in a loss of data integrity.(CVE-2023-31356)","affected":[{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"linux-firmware","purl":"pkg:rpm/openEuler/linux-firmware&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241017-1.oe2003sp4"}]}],"ecosystem_specific":{"noarch":["linux-firmware-20241017-1.oe2003sp4.noarch.rpm"],"src":["linux-firmware-20241017-1.oe2003sp4.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2549"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20584"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31356"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N"}],"database_specific":{"severity":"Medium"}}