Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0468: A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_refs. This flaw may cause a NULL pointer dereference. CVE-2022-50640: In the Linux kernel, the following vulnerability has been resolved: mmc: core: Fix kernel panic when remove non-standard SDIO card CVE-2022-50482: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clean up si_domain in the init_dmars() error path CVE-2022-50470: In the Linux kernel, the following vulnerability has been resolved: xhci: Remove device endpoints from bandwidth list when freeing the device CVE-2022-50432: In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove CVE-2022-50427: In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() CVE-2022-50352: In the Linux kernel, the following vulnerability has been resolved: net: hns: fix possible memory leak in hnae_ae_register() CVE-2022-50315: In the Linux kernel, the following vulnerability has been resolved: ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS CVE-2022-50291: In the Linux kernel, the following vulnerability has been resolved: kcm: annotate data-races around kcm->rx_psock CVE-2022-50285: In the Linux kernel, the following vulnerability has been resolved: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages CVE-2022-50265: In the Linux kernel, the following vulnerability has been resolved: kcm: annotate data-races around kcm->rx_wait CVE-2022-50257: In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: Prevent leaking grants CVE-2022-49927: In the Linux kernel, the following vulnerability has been resolved: nfs4: Fix kmemleak when allocate slot failed CVE-2022-49921: In the Linux kernel, the following vulnerability has been resolved: net: sched: Fix use after free in red_enqueue() CVE-2022-49915: In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible memory leak in mISDN_register_device() CVE-2022-49914: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at resolve_indirect_refs() CVE-2022-49912: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ulist leaks in error paths of qgroup self tests CVE-2022-49910: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu CVE-2022-49909: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() CVE-2022-49907: In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in bit shift for __mdiobus_register CVE-2022-49904: In the Linux kernel, the following vulnerability has been resolved: net, neigh: Fix null-ptr-deref in neigh_table_clear() CVE-2022-49890: In the Linux kernel, the following vulnerability has been resolved: capabilities: fix potential memleak on error path from vfs_getxattr_alloc() CVE-2022-49880: In the Linux kernel, the following vulnerability has been resolved: ext4: fix warning in 'ext4_da_release_space' CVE-2022-42895: There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url CVE-2022-3564: A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087. CVE-2022-26373: Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. CVE-2022-20567: In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. CVE-2022-20369: In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-223375145References: Upstream kernel
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.299-223.520 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.299-223.520.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.299-223.520.amzn2 |
Vulnerabilities 28
-
High 8.8
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu Fix the race condition between the following two flows that run in parallel: 1. l2cap_reassemble_sdu -> chan->ops->recv (l2…
-
High 7.8
net: sched: Fix use after free in red_enqueue()
In the Linux kernel, the following vulnerability has been resolved: net: sched: Fix use after free in red_enqueue() We can't use "skb" again after passing it to qdisc_enqueue(). This is basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb len …
-
High 7.8
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
In the Linux kernel, the following vulnerability has been resolved: ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS UBSAN complains about array-index-out-of-bounds: [ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0…
-
High 7.8
kernfs: fix use-after-free in __kernfs_remove
In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The r…
-
High 7.4
In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local …
-
Medium 5.5
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…
-
Medium 5.5CVE-2022-3564 Public exploit
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommende…
-
Medium 5.5
ext4: fix warning in 'ext4_da_release_space'
In the Linux kernel, the following vulnerability has been resolved: ext4: fix warning in 'ext4_da_release_space' Syzkaller report issue as follows: EXT4-fs (loop0): Free/Dirty block details EXT4-fs (loop0): free_blocks=0 EXT4-fs (loop0): dirty_blocks=0 EXT4-f…
-
Medium 5.5
capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
In the Linux kernel, the following vulnerability has been resolved: capabilities: fix potential memleak on error path from vfs_getxattr_alloc() In cap_inode_getsecurity(), we will use vfs_getxattr_alloc() to complete the memory allocation of tmpbuf, if we hav…
-
Medium 5.5
net, neigh: Fix null-ptr-deref in neigh_table_clear()
In the Linux kernel, the following vulnerability has been resolved: net, neigh: Fix null-ptr-deref in neigh_table_clear() When IPv6 module gets initialized but hits an error in the middle, kenel panic with: KASAN: null-ptr-deref in range [0x0000000000000598-0…
-
Medium 5.5
mISDN: fix possible memory leak in mISDN_register_device()
In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible memory leak in mISDN_register_device() Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamicall…
-
Medium 5.5
nfs4: Fix kmemleak when allocate slot failed
In the Linux kernel, the following vulnerability has been resolved: nfs4: Fix kmemleak when allocate slot failed If one of the slot allocate failed, should cleanup all the other allocated slots, otherwise, the allocated slots will leak: unreferenced object 0x…
-
Medium 5.5
net: hns: fix possible memory leak in hnae_ae_register()
In the Linux kernel, the following vulnerability has been resolved: net: hns: fix possible memory leak in hnae_ae_register() Inject fault while probing module, if device_register() fails, but the refcount of kobject is not decreased to 0, the name allocated i…
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
Medium 4.7
A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Ke…
-
Unscored —
In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This …
-
Unscored —
net: mdio: fix undefined behavior in bit shift for __mdiobus_register
In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in bit shift for __mdiobus_register Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrac…
-
Unscored —CVE-2022-49909 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
btrfs: fix ulist leaks in error paths of qgroup self tests
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ulist leaks in error paths of qgroup self tests In the test_no_shared_qgroup() and test_multiple_refs() qgroup self tests, if we fail to add the tree ref, remove the extent item or…
-
Unscored —
btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at resolve_indirect_refs() During backref walking, at resolve_indirect_refs(), if we get an error we jump to the 'out' label and call ulist_f…
-
Unscored —
xen/gntdev: Prevent leaking grants
In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: Prevent leaking grants Prior to this commit, if a grant mapping operation failed partially, some of the entries in the map_ops array would be invalid, whereas all of the entries i…
-
Unscored —
kcm: annotate data-races around kcm->rx_wait
In the Linux kernel, the following vulnerability has been resolved: kcm: annotate data-races around kcm->rx_wait kcm->rx_psock can be read locklessly in kcm_rfree(). Annotate the read and writes accordingly. syzbot reported: BUG: KCSAN: data-race in kcm_rcv_s…
-
Unscored —
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
In the Linux kernel, the following vulnerability has been resolved: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages The h->*_huge_pages counters are protected by the hugetlb_lock, but alloc_huge_page has a corner case where it can decreme…
-
Unscored —
kcm: annotate data-races around kcm->rx_psock
In the Linux kernel, the following vulnerability has been resolved: kcm: annotate data-races around kcm->rx_psock kcm->rx_psock can be read locklessly in kcm_rfree(). Annotate the read and writes accordingly. We do the same for kcm->rx_wait in the following p…
-
Unscored —
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() If device_register() fails in snd_ac97_dev_register(), it should call put_device() to give up reference, or the name allocated …
-
Unscored —
xhci: Remove device endpoints from bandwidth list when freeing the device
In the Linux kernel, the following vulnerability has been resolved: xhci: Remove device endpoints from bandwidth list when freeing the device Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed. If xHC…
-
Unscored —
iommu/vt-d: Clean up si_domain in the init_dmars() error path
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clean up si_domain in the init_dmars() error path A splat from kmem_cache_destroy() was seen with a kernel prior to commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mem…
-
Unscored —
mmc: core: Fix kernel panic when remove non-standard SDIO card
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Fix kernel panic when remove non-standard SDIO card SDIO tuple is only allocated for standard SDIO card, especially it causes memory corruption issues when the non-standard SDIO ca…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-20369.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-20567.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-26373.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3564.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-42895.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49880.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49890.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49904.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49907.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49909.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49910.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49912.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49914.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49915.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49921.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49927.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50257.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50265.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50285.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50291.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50315.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50352.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50427.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50432.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50470.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50482.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50640.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0468.html