Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-13094: An issue was discovered in the XFS filesystem in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel. A NULL pointer dereference may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. This can lead to a system crash and a denial of service. 1597771: CVE-2018-13094 kernel: NULL pointer dereference in xfs_da_shrink_inode function CVE-2018-13093: An issue was discovered in the XFS filesystem in fs/xfs/xfs_icache.c in the Linux kernel. There is a NULL pointer dereference leading to a system panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during an allocation. 1597766: CVE-2018-13093 kernel: NULL pointer dereference in lookup_slow function
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.59-68.43.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.59-68.43.amzn2 |
Vulnerabilities 2
-
Unscored —
An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference …
-
Unscored —
An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a co…