Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33909: An out-of-bounds write flaw was found in the Linux kernel's seq_file in the Filesystem layer. This flaw allows a local attacker with a user privilege to gain access to out-of-bound memory, leading to a system crash or a leak of internal kernel information. The issue results from not validating the size_t-to-int conversion prior to performing operations. The highest threat from this vulnerability is to data integrity, confidentiality and system availability. 1970273: CVE-2021-33909 kernel: size_t-to-int conversion vulnerability in the filesystem layer
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.238-182.422 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.238-182.422.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.238-182.422.amzn2 |
Vulnerabilities 1
-
Unscored —CVE-2021-33909 Public exploit
fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-33909.html