Skip to content
OpenAdvisories
High ALAS2-2022-1798 12 CVEs

Important: kernel security update (Amazon Linux 2)

Published May 31, 2022 · Updated Oct 2, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4459: A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup. CVE-2023-4387: A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem. CVE-2022-49291: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls CVE-2022-48910: In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6_mc_down() at most once CVE-2022-48853: In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE CVE-2022-48619: An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap. CVE-2022-30594: The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. CVE-2022-29581: Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions. CVE-2022-2639: An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2022-1729: perf: Fix sys_perf_event_open() race against self CVE-2022-0854: A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space. CVE-2021-47435: In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when completing IO

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.281-212.502.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.281-212.502.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.281-212.502.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.281-212.502.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.281-212.502.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.281-212.502.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.281-212.502 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.281-212.502.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.281-212.502.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.281-212.502.amzn2
Amazon Linux · 2 perf 0:4.14.281-212.502.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.281-212.502.amzn2
Amazon Linux · 2 python-perf 0:4.14.281-212.502.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.281-212.502.amzn2

Vulnerabilities 12

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-47435.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-0854.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-1729.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-2639.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-29581.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-30594.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48619.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48853.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48910.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-49291.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-4387.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-4459.html