摘要:
wpa_supplicant security update
安全等级: High
公告ID: KylinSec-SA-2024-3875
发布日期: 2024年9月14日
关联CVE: CVE-2024-5290
wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver.
Security Fix(es):
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.(CVE-2024-5290)
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2024-5290 | KY3.5.2 | wpa_supplicant | Fixed |
| CVE-2024-5290 | V6 | wpa_supplicant | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| wpa_supplicant | x86_64 | 2.10-7.ks6.kb1 |
| wpa_supplicant-gui | x86_64 | 2.10-7.ks6.kb1 |
| wpa_supplicant-help | x86_64 | 2.10-7.ks6.kb1 |
| wpa_supplicant | aarch64 | 2.10-7.ks6.kb1 |
| wpa_supplicant-gui | aarch64 | 2.10-7.ks6.kb1 |
| wpa_supplicant-help | aarch64 | 2.10-7.ks6.kb1 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| wpa_supplicant | x86_64 | 2.6-32.ky3_5 |
| wpa_supplicant-gui | x86_64 | 2.6-32.ky3_5 |
| wpa_supplicant-help | x86_64 | 2.6-32.ky3_5 |
| wpa_supplicant | aarch64 | 2.6-32.ky3_5 |
| wpa_supplicant-gui | aarch64 | 2.6-32.ky3_5 |
| wpa_supplicant-help | aarch64 | 2.6-32.ky3_5 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
