Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-50884: In the Linux kernel, the following vulnerability has been resolved: drm: Prevent drm_copy_field() to attempt copying a NULL pointer CVE-2022-50733: In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open CVE-2022-50676: In the Linux kernel, the following vulnerability has been resolved: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() CVE-2022-50671: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix "kernel NULL pointer dereference" error CVE-2022-50569: In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed CVE-2022-50544: In the Linux kernel, the following vulnerability has been resolved: usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() CVE-2022-50519: In the Linux kernel, the following vulnerability has been resolved: nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure CVE-2022-50435: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid crash when inline data creation follows DIO write CVE-2022-50419: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times CVE-2022-50409: In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory CVE-2022-50386: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free CVE-2022-50367: In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy CVE-2022-50344: In the Linux kernel, the following vulnerability has been resolved: ext4: fix null-ptr-deref in ext4_write_info CVE-2022-50330: In the Linux kernel, the following vulnerability has been resolved: crypto: cavium - prevent integer overflow loading firmware CVE-2022-50314: In the Linux kernel, the following vulnerability has been resolved: nbd: Fix hung when signal interrupts nbd_start_device_ioctl() CVE-2022-50299: In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf CVE-2022-50271: In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: Use kvmalloc/kvfree for larger packets. CVE-2022-48672: In the Linux kernel, the following vulnerability has been resolved: of: fdt: fix off-by-one error in unflatten_dt_nodes() CVE-2022-48659: In the Linux kernel, the following vulnerability has been resolved: mm/slub: fix to return errno if kmalloc() fails CVE-2022-48651: In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header If an AF_PACKET socket is used to send packets through ipvlan and the default xmit function of the AF_PACKET socket is changed from dev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option name of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset and remains as the initial value of 65535, this may trigger slab-out-of-bounds bugs as following: CVE-2022-48641: In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix memory leak when blob is malformed CVE-2022-43750: drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. CVE-2022-41850: roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress. CVE-2022-41849: drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect. CVE-2022-40768: drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case. CVE-2022-39842: An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. CVE-2022-3649: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992. CVE-2022-3646: A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability. CVE-2022-3621: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211920. CVE-2022-3594: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by th
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.296-222.539 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.296-222.539.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.296-222.539.amzn2 |
Vulnerabilities 34
-
Critical 9.8
inet: fully convert sk->sk_rx_dst to RCU rules
In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearl…
-
High 8.8
Bluetooth: L2CAP: Fix user-after-free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_c…
-
High 8.8
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_add shall not be called multiple times as stated in its documentation: 'Do not call this routine or device_regist…
-
High 7.8
fs: fix UAF/GPF bug in nilfs_mdt_destroy
In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_m…
-
High 7.8
xfrm: Update ipcomp_scratches with NULL when freed
In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu sc…
-
High 7.7
ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header If an AF_PACKET socket is used to send packets through ipvlan and the default xmit function of the AF_PACKET socket is changed fr…
-
High 7.5
RDMA/rxe: Fix "kernel NULL pointer dereference" error
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix "kernel NULL pointer dereference" error When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized. Because of cr…
-
High 7.5
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
In the Linux kernel, the following vulnerability has been resolved: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() syzbot is reporting lockdep warning at rds_tcp_reset_callbacks() [1], for commit ac3615e7f3cffe2a ("RDS: TCP…
-
High 7.1
crypto: cavium - prevent integer overflow loading firmware
In the Linux kernel, the following vulnerability has been resolved: crypto: cavium - prevent integer overflow loading firmware The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you …
-
Medium 6.7
drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client …
-
Medium 5.5CVE-2022-3542 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
Medium 5.5
ext4: fix null-ptr-deref in ext4_write_info
In the Linux kernel, the following vulnerability has been resolved: ext4: fix null-ptr-deref in ext4_write_info I caught a null-ptr-deref bug as follows: ================================================================== KASAN: null-ptr-deref in range [0x0000…
-
Medium 5.3
Linux Kernel BPF r8152.c intr_callback logging of excessive data
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The att…
-
Medium 4.6
Linux Kernel Bluetooth l1oip_core.c del_timer use after free
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recomme…
-
Medium 4.3
Linux Kernel nilfs2 inode.c nilfs_bmap_lookup_at_level null pointer dereference
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to …
-
Low 3.1
Linux Kernel BPF segment.c nilfs_attach_log_writer memory leak
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initia…
-
Low 3.1
Linux Kernel BPF inode.c nilfs_new_inode use after free
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remote…
-
Unscored —
A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_…
-
Unscored —
An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the c…
-
Unscored —
drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel m…
-
Unscored —
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if …
-
Unscored —
roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant …
-
Unscored —
netfilter: ebtables: fix memory leak when blob is malformed
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix memory leak when blob is malformed The bug fix was incomplete, it "replaced" crash with a memory leak. The old code had an assignment to "ret" embedded into the condi…
-
Unscored —
mm/slub: fix to return errno if kmalloc() fails
In the Linux kernel, the following vulnerability has been resolved: mm/slub: fix to return errno if kmalloc() fails In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to out-of-memory, if it fails, return errno correctly rather than triggering panic vi…
-
Unscored —
of: fdt: fix off-by-one error in unflatten_dt_nodes()
In the Linux kernel, the following vulnerability has been resolved: of: fdt: fix off-by-one error in unflatten_dt_nodes() Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") forgot to fix up the depth check in the loop body in unflatten…
-
Unscored —
vhost/vsock: Use kvmalloc/kvfree for larger packets.
In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: Use kvmalloc/kvfree for larger packets. When copying a large file over sftp over vsock, data size is usually 32kB, and kmalloc seems to fail to try to allocate 32 32kB regions. v…
-
Unscored —
md: Replace snprintf with scnprintf
In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf() returns…
-
Unscored —
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
In the Linux kernel, the following vulnerability has been resolved: nbd: Fix hung when signal interrupts nbd_start_device_ioctl() syzbot reported hung task [1]. The following program is a simplified version of the reproducer: int main(void) { int sv[2], fd; i…
-
Unscored —
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+…
-
Unscored —
ext4: avoid crash when inline data creation follows DIO write
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid crash when inline data creation follows DIO write When inode is created and written to using direct IO, there is nothing to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when in…
-
Unscored —
nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
In the Linux kernel, the following vulnerability has been resolved: nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure If creation or finalization of a checkpoint fails due to anomalies in the checkpoint metadata on disk, a kernel warn…
-
Unscored —
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
In the Linux kernel, the following vulnerability has been resolved: usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() xhci_alloc_stream_info() allocates stream context array for stream_info ->stream_ctx_array with xhci_alloc_stream_ctx().…
-
Unscored —
usb: idmouse: fix an uninit-value in idmouse_open
In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..…
-
Unscored —
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
In the Linux kernel, the following vulnerability has been resolved: drm: Prevent drm_copy_field() to attempt copying a NULL pointer There are some struct drm_driver fields that are required by drivers since drm_copy_field() attempts to copy them to user-space…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47103.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2978.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3542.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3565.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3594.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3621.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3646.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3649.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-39842.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-40768.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-41849.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-41850.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-43750.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-48641.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-48651.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-48659.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-48672.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50271.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50299.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50314.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50330.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50344.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50367.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50386.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50409.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50419.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50435.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50519.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50544.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50569.html