Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1095: In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference. CVE-2022-50228: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 CVE-2022-50220: In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect CVE-2022-50215: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Allow waiting for commands to complete on removed device CVE-2022-50211: In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning CVE-2022-50206: In the Linux kernel, the following vulnerability has been resolved: arm64: fix oops in concurrently setting insn_emulation sysctls CVE-2022-50205: In the Linux kernel, the following vulnerability has been resolved: ext2: Add more validity checks for inode counts CVE-2022-50202: In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: defer device probing when resuming from hibernation CVE-2022-50200: In the Linux kernel, the following vulnerability has been resolved: selinux: Add boundary check in put_entry() CVE-2022-50185: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() CVE-2022-50161: In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in of_flash_probe_versatile CVE-2022-50160: In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in ap_flash_init CVE-2022-50153: In the Linux kernel, the following vulnerability has been resolved: usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe CVE-2022-50127: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix error unwind in rxe_create_qp() CVE-2022-50126: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted CVE-2022-50109: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: amba-clcd: Fix refcount leak bugs CVE-2022-50097: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: s3fb: Check the size of screen before memset_io() CVE-2022-50085: In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_resume CVE-2022-50084: In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_status CVE-2022-50083: In the Linux kernel, the following vulnerability has been resolved: ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h CVE-2022-50022: In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug CVE-2022-50020: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size CVE-2022-49611: In the Linux kernel, the following vulnerability has been resolved: x86/speculation: Fill RSB on vmexit for IBRS CVE-2022-36946: A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash the system or a remote user to crash the system when the libnetfilter_queue is used by a local user. CVE-2022-29901: Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. CVE-2022-28693: A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to enable information disclosure via local access. CVE-2022-26373: Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. CVE-2022-2588: A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege escalation problem. CVE-2022-2153: A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. CVE-2022-20566: In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel CVE-2022-1679: A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2019-25162: In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just mo
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.291-218.527 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.291-218.527.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.291-218.527.amzn2 |
Vulnerabilities 32
-
High 7.8CVE-2019-25162 Public exploit
i2c: Fix a potential use after free
In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment…
-
High 7.8
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local e…
-
High 7.8
drivers:md:fix a potential use-after-free bug
In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 28…
-
High 7.8
selinux: Add boundary check in put_entry()
In the Linux kernel, the following vulnerability has been resolved: selinux: Add boundary check in put_entry() Just like next_entry(), boundary check is necessary to prevent memory out-of-bound access.
-
High 7.8
scsi: sg: Allow waiting for commands to complete on removed device
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Allow waiting for commands to complete on removed device When a SCSI device is removed while in active use, currently sg will immediately return -ENODEV on any attempt to wait for a…
-
High 7.5CVE-2022-36946 Public exploit
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …
-
High 7.1
video: fbdev: s3fb: Check the size of screen before memset_io()
In the Linux kernel, the following vulnerability has been resolved: video: fbdev: s3fb: Check the size of screen before memset_io() In the function s3fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper v…
-
Medium 5.6
Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary…
-
Medium 5.5
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…
-
Medium 5.5
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction …
-
Medium 5.3CVE-2022-2588 Public exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the …
-
Medium 4.7
Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized …
-
Unscored —CVE-2022-1679 Public exploit
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9…
-
Unscored —
A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbe…
-
Unscored —
x86/speculation: Fill RSB on vmexit for IBRS
In the Linux kernel, the following vulnerability has been resolved: x86/speculation: Fill RSB on vmexit for IBRS Prevent RSB underflow/poisoning attacks with RSB. While at it, add a bunch of comments to attempt to document the current state of tribal knowledg…
-
Unscored —
ext4: avoid resizing to a partial cluster size
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to clust…
-
Unscored —CVE-2022-50083 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
dm raid: fix address sanitizer warning in raid_status
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_status There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-te…
-
Unscored —
dm raid: fix address sanitizer warning in raid_resume
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_resume There is a KASAN warning in raid_resume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev->raid_disks…
-
Unscored —
video: fbdev: amba-clcd: Fix refcount leak bugs
In the Linux kernel, the following vulnerability has been resolved: video: fbdev: amba-clcd: Fix refcount leak bugs In clcdfb_of_init_display(), we should call of_node_put() for the references returned by of_graph_get_next_endpoint() and of_graph_get_remote_p…
-
Unscored —
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Following process will fail assertion 'jh->b_frozen_data == NULL' in jbd2_journal_dirty_metadata(): jbd2_journal_c…
-
Unscored —
RDMA/rxe: Fix error unwind in rxe_create_qp()
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix error unwind in rxe_create_qp() In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like the spin locks are not setup until rxe_qp_…
-
Unscored —
usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
In the Linux kernel, the following vulnerability has been resolved: usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_n…
-
Unscored —
mtd: maps: Fix refcount leak in ap_flash_init
In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in ap_flash_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of…
-
Unscored —
mtd: maps: Fix refcount leak in of_flash_probe_versatile
In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in of_flash_probe_versatile of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need an…
-
Unscored —
drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() The last case label can write two buffers 'mc_reg_address[j]' and 'mc_data[j]' with 'j' offset equal to SMC_NISLANDS…
-
Unscored —
PM: hibernate: defer device probing when resuming from hibernation
In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: defer device probing when resuming from hibernation syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count va…
-
Unscored —
ext2: Add more validity checks for inode counts
In the Linux kernel, the following vulnerability has been resolved: ext2: Add more validity checks for inode counts Add checks verifying number of inodes stored in the superblock matches the number computed from number of inodes per group. Also verify we have…
-
Unscored —
arm64: fix oops in concurrently setting insn_emulation sysctls
In the Linux kernel, the following vulnerability has been resolved: arm64: fix oops in concurrently setting insn_emulation sysctls emulation_proc_handler() changes table->data for proc_dointvec_minmax and can generate the following Oops if called concurrently…
-
Unscored —
md-raid10: fix KASAN warning
In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is val…
-
Unscored —
usbnet: Fix linkwatch use-after-free on disconnect
In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited…
-
Unscored —
KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KV…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-25162.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-1679.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-20566.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2153.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2588.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-26373.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-28693.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-29901.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-36946.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49611.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50020.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50022.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50083.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50084.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50085.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50097.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50109.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50126.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50127.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50153.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50160.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50161.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50185.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50200.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50202.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50205.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50206.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50211.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50215.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50220.html