Vulnerability · Published Apr 15, 2023 · Assigned by VulDB

CVE-2023-2091KylinSoft youker-assistant adjust_cpufreq_scaling_governer os command injection

High 7.8

In plain English

A high-severity OS command injection in youker-assistant from KylinSoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)1.5%top 26.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scaling_governer. The manipulation leads to os command injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.4.13 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226099.

Affected products (as reported)

Vendor	Product	Versions
KylinSoft	youker-assistant	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://vuldb.com/?id.226099 vdb-entry, technical-description
https://vuldb.com/?ctiid.226099 signature, permissions-required
https://github.com/i900008/vulndb/blob/main/youker-assistant_vuln.md broken-link, exploit
https://kylinos.cn/support/loophole/patch/3375.html patch