Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33200: A flaw was found in kernel/bpf/verifier.c in BPF in the Linux kernel. An incorrect limit is enforced for pointer arithmetic operations which can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1965458: CVE-2021-33200 kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations by BPF verifier
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.232-177.418 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.232-177.418.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.232-177.418.amzn2 |
Vulnerabilities 1
-
Unscored —
kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, a…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-33200.html