Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-0492: The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set of capabilities. Therefore require capabilities when setting the release_agent. CVE-2021-47609: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Fix string overflow in SCPI genpd driver CVE-2021-47606: In the Linux kernel, the following vulnerability has been resolved: net: netlink: af_netlink: Prevent empty skb by adding a check on len. CVE-2021-47603: In the Linux kernel, the following vulnerability has been resolved: audit: improve robustness of the audit queue handling CVE-2021-47600: In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() CVE-2021-47589: In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` CVE-2021-47588: In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6_dev_free() from sit_init_net() CVE-2021-47576: In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() CVE-2021-47566: In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() CVE-2021-47565: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix kernel panic during drive powercycle test CVE-2021-47548: In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() CVE-2021-47541: In the Linux kernel, the following vulnerability has been resolved: net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() CVE-2021-47527: In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak CVE-2021-47515: In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block CVE-2021-47506: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race CVE-2021-46936: In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler CVE-2021-46929: In the Linux kernel, the following vulnerability has been resolved: sctp: use call_rcu to free endpoint CVE-2021-44733: A use-after-free flaw in the Linux kernel TEE (Trusted Execution Environment) subsystem was found in the way user calls ioctl TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE. A local user could use this flaw to crash the system or escalate their privileges on the system. If the Linux system non configured with the CONFIG_PREEMPT option or CONFIG_CPU_SW_DOMAIN_PAN option enabled, then it is unlikely that a user can trigger this issue. CVE-2021-4155: A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. CVE-2021-3923: A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms. CVE-2021-28715: Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. CVE-2021-28714: Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. CVE-2021-28713: A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests. A local user could use this flaw to starve the resources resulting in a denial of service. CVE-2021-28712: A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests. A local user could use this flaw to starve the resources resulting in a denial of service. CVE-2021-28711: A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests. A local user could use this flaw to starve the resources resulting in a denial of service.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.262-200.489 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.262-200.489.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.262-200.489.amzn2 |
Vulnerabilities 26
-
High 7.8
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. T…
KEV Jun 2, 2026 -
Critical 9.8
nfsd: fix use-after-free due to delegation race
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_…
-
Critical 9.8
ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF…
-
High 7.8
sctp: use call_rcu to free endpoint
In the Linux kernel, the following vulnerability has been resolved: sctp: use call_rcu to free endpoint This patch is to delay the endpoint free by calling call_rcu() to fix another use-after-free issue in sctp_sock_dump(): BUG: KASAN: use-after-free in __loc…
-
High 7.8
net: fix use-after-free in tw_timer_handler
In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe6…
-
High 7.8
net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
In the Linux kernel, the following vulnerability has been resolved: net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and tmp->tx_cq will be freed on the error path of mlx4_…
-
High 7.8
scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() In resp_mode_select() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in resp_mode_…
-
High 7.8
sit: do not call ipip6_dev_free() from sit_init_net()
In the Linux kernel, the following vulnerability has been resolved: sit: do not call ipip6_dev_free() from sit_init_net() ipip6_dev_free is sit dev->priv_destructor, already called by register_netdevice() if something goes wrong. Alternative would be to make …
-
High 7.8
dm btree remove: fix use after free in rebalance_children()
In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tm_unlock() after dm_tm_dec().
-
High 7.5
seg6: fix the iif in the IPv6 socket control block
In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving interface index into the IPv4 socket control block (v5.16-rc4, net/…
-
Medium 6.5
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to mult…
-
Low 2.3
A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local acco…
-
Unscored —
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs;…
-
Unscored —
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs;…
-
Unscored —
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs;…
-
Unscored —
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to mult…
-
Unscored —
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…
-
Unscored —
A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files wi…
-
Unscored —CVE-2021-44733 Public exploit
A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …
-
Unscored —
serial: core: fix transmit-buffer reset and memleak
In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close") converted serial core to use tty_port_close() but failed…
-
Unscored —
scsi: mpt3sas: Fix kernel panic during drive powercycle test
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix kernel panic during drive powercycle test While looping over shost's sdev list it is possible that one of the drives is getting removed and its sas_target object is freed b…
-
Unscored —
proc/vmcore: fix clearing user buffer by properly using clear_user()
In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a…
-
Unscored —
igbvf: fix double free in `igbvf_probe`
In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just b…
-
Unscored —
audit: improve robustness of the audit queue handling
In the Linux kernel, the following vulnerability has been resolved: audit: improve robustness of the audit queue handling If the audit daemon were ever to get stuck in a stopped state the kernel's kauditd_thread() could get blocked attempting to send audit re…
-
Unscored —
net: netlink: af_netlink: Prevent empty skb by adding a check on len.
In the Linux kernel, the following vulnerability has been resolved: net: netlink: af_netlink: Prevent empty skb by adding a check on len. Adding a check on len parameter to avoid empty skb. This prevents a division error in netem_enqueue function which is cau…
-
Unscored —
firmware: arm_scpi: Fix string overflow in SCPI genpd driver
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpi_pd->name, it could result in the buffer overflow when copying the SCPI device name from the corr…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-28711.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-28712.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-28713.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-28714.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-28715.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-3923.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-4083.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-4155.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-44733.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-46929.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-46936.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47506.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47515.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47527.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47541.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47548.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47565.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47566.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47576.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47588.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47589.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47600.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47603.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47606.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47609.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-0492.html