Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48924: In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: fix memory leak in int3400_notify() CVE-2022-28356: In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. CVE-2022-27666: A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat. CVE-2022-26490: A buffer overflow flaw was found in the Linux kernel's NFC protocol functionality. This flaw allows a local user to crash or escalate their privileges on the system.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.275-207.503 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.275-207.503.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.275-207.503.amzn2 |
Vulnerabilities 4
-
Medium 5.5
In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.
-
Unscored —
st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTI…
-
Unscored —CVE-2022-27666 Public exploit
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This fla…
-
Unscored —
thermal: int340x: fix memory leak in int3400_notify()
In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: fix memory leak in int3400_notify() It is easy to hit the below memory leaks in my TigerLake platform: unreferenced object 0xffff927c8b91dbc0 (size 32): comm "kworker/0:2", …