Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-9516: A flaw was found in the Linux kernel in the hid_debug_events_read() function in the drivers/hid/hid-debug.c file. A lack of the certain checks may allow a privileged user ("root") to achieve an out-of-bounds write and thus receiving user space buffer corruption. CVE-2018-11412: The fs/ext4/inline.c:ext4_read_inline_data() function in the Linux kernel performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode. The unbound copy can cause memory corruption or possible privilege escalation.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.55-68.37.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.55-68.37.amzn2 |
Vulnerabilities 2
-
Unscored —
In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrust…
-
Unscored —
In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds ch…