Skip to content
OpenAdvisories
High ALAS2-2022-1889 1 CVE

Important: libbpf security update (Amazon Linux 2)

Published Dec 1, 2022 · Updated Dec 6, 2022

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3534: A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 libbpf 0:0.5.0-2.amzn2.0.3
Amazon Linux · 2 libbpf-debuginfo 0:0.5.0-2.amzn2.0.3
Amazon Linux · 2 libbpf-devel 0:0.5.0-2.amzn2.0.3
Amazon Linux · 2 libbpf-static 0:0.5.0-2.amzn2.0.3

Vulnerabilities 1

  • Medium 5.5
    CVE-2022-3534

    Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free

    A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. Upgrading to ve…

    Linux kernel libbpf libbpf Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-3534.html