Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-49731: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() CVE-2022-49727: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg CVE-2022-49725: In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setup_tx_descriptors CVE-2022-49708: In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on ext4_mb_use_inode_pa CVE-2022-49707: In the Linux kernel, the following vulnerability has been resolved: ext4: add reserved GDT blocks check CVE-2022-49561: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion CVE-2022-49554: In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration CVE-2022-49532: In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes CVE-2022-49492: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags CVE-2022-49472: In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Allow probing without .driver_data CVE-2022-49450: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix listen() setting the bar too high for the prealloc rings CVE-2022-49442: In the Linux kernel, the following vulnerability has been resolved: drivers/base/node.c: fix compaction sysfs file leak CVE-2022-49441: In the Linux kernel, the following vulnerability has been resolved: tty: fix deadlock caused by calling printk() under tty_port->lock CVE-2022-49434: In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() CVE-2022-49421: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup CVE-2022-49407: In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read CVE-2022-49389: In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stub_probe() CVE-2022-49388: In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed CVE-2022-49372: In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_rtx_synack() can be called from process context CVE-2022-49370: In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle CVE-2022-49350: In the Linux kernel, the following vulnerability has been resolved: net: mdio: unexport __init-annotated mdio_bus_init() CVE-2022-49349: In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_rename_dir_prepare CVE-2022-49347: In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in ext4_writepages CVE-2022-49345: In the Linux kernel, the following vulnerability has been resolved: net: xfrm: unexport __init-annotated xfrm4_protocol_init() CVE-2022-49343: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid cycles in directory h-tree CVE-2022-49339: In the Linux kernel, the following vulnerability has been resolved: net: ipv6: unexport __init-annotated seg6_hmac_init() CVE-2022-49330: In the Linux kernel, the following vulnerability has been resolved: tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd CVE-2022-49322: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix sleeping function called from invalid context on RT kernel CVE-2022-49321: In the Linux kernel, the following vulnerability has been resolved: xprtrdma: treat all calls not a bcall when bc_serv is NULL CVE-2022-49308: In the Linux kernel, the following vulnerability has been resolved: extcon: Modify extcon device to be created after driver data is set CVE-2022-49307: In the Linux kernel, the following vulnerability has been resolved: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() CVE-2022-49300: In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbd_alloc_config() and module removal CVE-2022-49297: In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device CVE-2022-49295: In the Linux kernel, the following vulnerability has been resolved: nbd: call genl_unregister_family() first in nbd_cleanup() CVE-2022-49264: In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty CVE-2022-48710: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix a possible null pointer dereference CVE-2022-32981: An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. CVE-2022-32296: The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. CVE-2022-32250: net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. CVE-2022-21166: A flaw was found in hw. Incomplete cleanup in specific special register write operations for some Intel® Processors may allow an authenticated user to enable information disclosure via local access. CVE-2022-21125: A flaw was found in hw. Incomplete clea
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.285-215.501 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.285-215.501.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.285-215.501.amzn2 |
Vulnerabilities 47
-
Critical 9.8
dlm: fix plock invalid read
In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plock_op" and a followed send_op() will append it to a global send_list data str…
-
Critical 9.8
netfilter: conntrack: re-fetch conntrack after insertion
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found …
-
High 7.8
exec: Force single empty string when argv is empty
In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name o…
-
High 7.8
ext4: avoid cycles in directory h-tree
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid cycles in directory h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes …
-
High 7.8
ext4: fix use-after-free in ext4_rename_dir_prepare
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_rename_dir_prepare We got issue as follows: EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue ext4_get_first_dir_block: bh->b_data=0…
-
High 7.8
ubi: ubi_create_volume: Fix use-after-free when volume creation failed
In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol…
-
High 7.8
zsmalloc: fix races between asynchronous zspage free and page migration
In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration.…
-
High 7.8
i40e: Fix call trace in setup_tx_descriptors
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setup_tx_descriptors After PF reset and ethtool -t there was call trace in dmesg sometimes leading to panic. When there was some time, around 5 seconds, between reset …
-
High 7.5
xprtrdma: treat all calls not a bcall when bc_serv is NULL
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: treat all calls not a bcall when bc_serv is NULL When a rdma server returns a fault format reply, nfs v3 client may treats it as a bcall when bc service is not exist. The debug mess…
-
High 7.5
tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
In the Linux kernel, the following vulnerability has been resolved: tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd syzbot got a new report [1] finally pointing to a very old bug, added in initial support for MTU probing. tcp_mtu_probe() has checks about st…
-
High 7.0
nbd: call genl_unregister_family() first in nbd_cleanup()
In the Linux kernel, the following vulnerability has been resolved: nbd: call genl_unregister_family() first in nbd_cleanup() Otherwise there may be race between module removal and the handling of netlink command, which can lead to the oops as shown below: BU…
-
Medium 5.5
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potenti…
-
Medium 5.5
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to po…
-
Medium 5.5
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticate…
-
Medium 5.5
tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
In the Linux kernel, the following vulnerability has been resolved: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() When the driver fails at alloc_hdlcdev(), and then we remove the driver module, we will get the following splat: [ 25.065966] ge…
-
Medium 5.5
tracing: Fix sleeping function called from invalid context on RT kernel
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix sleeping function called from invalid context on RT kernel When setting bootparams="trace_event=initcall:initcall_start tp_printk=1" in the cmdline, the output_printk() was calle…
-
Medium 5.5
firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add() If this function re…
-
Medium 5.5
usb: usbip: fix a refcount leak in stub_probe()
In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stub_probe() usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. …
-
Medium 5.5
tty: fix deadlock caused by calling printk() under tty_port->lock
In the Linux kernel, the following vulnerability has been resolved: tty: fix deadlock caused by calling printk() under tty_port->lock pty_write() invokes kmalloc() which may invoke a normal printk() to print failure message. This can cause a deadlock in the s…
-
Medium 5.5
rxrpc: Fix listen() setting the bar too high for the prealloc rings
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix listen() setting the bar too high for the prealloc rings AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation cir…
-
Medium 5.5
net: phy: micrel: Allow probing without .driver_data
In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Allow probing without .driver_data Currently, if the .probe element is present in the phy_driver structure and the .driver_data is not, a NULL pointer dereference happens. A…
-
Medium 5.5
nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags In nvme_alloc_admin_tags, the admin_q can be set to an error (typically -ENOMEM) if the blk_mq_init_queue call fails to set u…
-
Medium 5.5
drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.56…
-
Medium 5.5
ext4: add reserved GDT blocks check
In the Linux kernel, the following vulnerability has been resolved: ext4: add reserved GDT blocks check We capture a NULL pointer issue when resizing a corrupt ext4 image which is freshly clear resize_inode feature (not run e2fsck). It could be simply reprodu…
-
Medium 5.5
ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be overflow. To fix, we can follow what udpv6 does and subtract the tran…
-
Medium 5.5
ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() In an unlikely (and probably wrong?) case that the 'ppi' parameter of ata_host_alloc_pinfo() points to an array starting wit…
-
Medium 4.7
nbd: fix race between nbd_alloc_config() and module removal
In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbd_alloc_config() and module removal When nbd module is being removing, nbd_alloc_config() may be called concurrently by nbd_genl_connect(), although try_module_get() w…
-
Unscored —
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kern…
-
Unscored —
An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This fla…
-
Unscored —
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table pe…
-
Unscored —
A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. Th…
-
Unscored —
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. …
-
Unscored —CVE-2022-32250 Public exploit
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespace…
-
Unscored —
The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occ…
-
Unscored —CVE-2022-32981 Public exploit
An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in p…
-
Unscored —
drm/radeon: fix a possible null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix a possible null pointer dereference In radeon_fp_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on …
-
Unscored —
nbd: fix io hung while disconnecting device
In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, "qemu-nbd" triggers a io hung: INFO: task qemu-nbd:11445 blocked for more than 368 seconds. Not tainted 5.18.0-rc3-next-20220422-0000…
-
Unscored —
extcon: Modify extcon device to be created after driver data is set
In the Linux kernel, the following vulnerability has been resolved: extcon: Modify extcon device to be created after driver data is set Currently, someone can invoke the sysfs such as state_show() intermittently before dev_set_drvdata() is done. And it can be…
-
Unscored —
net: ipv6: unexport __init-annotated seg6_hmac_init()
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: unexport __init-annotated seg6_hmac_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot …
-
Unscored —
net: xfrm: unexport __init-annotated xfrm4_protocol_init()
In the Linux kernel, the following vulnerability has been resolved: net: xfrm: unexport __init-annotated xfrm4_protocol_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules ca…
-
Unscored —
ext4: fix bug_on in ext4_writepages
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in ext4_writepages we got issue as follows: EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free …
-
Unscored —
net: mdio: unexport __init-annotated mdio_bus_init()
In the Linux kernel, the following vulnerability has been resolved: net: mdio: unexport __init-annotated mdio_bus_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot u…
-
Unscored —
tcp: tcp_rtx_synack() can be called from process context
In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_rtx_synack() can be called from process context Laurent reported the enclosed report [1] This bug triggers with following coditions: 0) Kernel built with CONFIG_DEBUG_PREEMPT=y 1) A …
-
Unscored —
video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
In the Linux kernel, the following vulnerability has been resolved: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. A…
-
Unscored —
PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() The sysfs sriov_numvfs_store() path acquires the device lock before the config space access lock: sriov_numvfs_store device_…
-
Unscored —
drivers/base/node.c: fix compaction sysfs file leak
In the Linux kernel, the following vulnerability has been resolved: drivers/base/node.c: fix compaction sysfs file leak Compaction sysfs file is created via compaction_register_node in register_node. But we forgot to remove it in unregister_node. Thus compact…
-
Unscored —
ext4: fix bug_on ext4_mb_use_inode_pa
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on ext4_mb_use_inode_pa Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/mballoc.c:3211! [...] RIP: 0010:ex…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-0494.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-0812.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-1012.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-1184.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-1966.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-21123.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-21125.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-21166.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-32250.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-32296.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-32981.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-48710.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49264.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49295.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49297.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49300.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49307.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49308.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49321.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49322.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49330.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49339.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49343.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49345.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49347.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49349.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49350.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49370.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49372.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49388.html