Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26607: In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c. CVE-2022-49874: In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: fix possible memory leak in mousevsc_probe() CVE-2022-49872: In the Linux kernel, the following vulnerability has been resolved: net: gso: fix panic on frag_list with mixed head alloc types CVE-2022-49870: In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK CVE-2022-49865: In the Linux kernel, the following vulnerability has been resolved: ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network CVE-2022-49862: In the Linux kernel, the following vulnerability has been resolved: tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header CVE-2022-49853: In the Linux kernel, the following vulnerability has been resolved: net: macvlan: fix memory leaks of macvlan_common_newlink CVE-2022-49850: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix deadlock in nilfs_count_free_blocks() CVE-2022-49846: In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() CVE-2022-49842: In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Fix use-after-free in snd_soc_exit() CVE-2022-49840: In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() CVE-2022-49834: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of ns_writer on remount CVE-2022-49832: In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map CVE-2022-49814: In the Linux kernel, the following vulnerability has been resolved: kcm: close race conditions on sk_receive_queue CVE-2022-49811: In the Linux kernel, the following vulnerability has been resolved: drbd: use after free in drbd_create_device() CVE-2022-49802: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix null pointer dereference in ftrace_add_mod() CVE-2022-49788: In the Linux kernel, the following vulnerability has been resolved: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() CVE-2022-49787: In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() CVE-2022-49776: In the Linux kernel, the following vulnerability has been resolved: macvlan: enforce a consistent minimal mtu CVE-2022-49771: In the Linux kernel, the following vulnerability has been resolved: dm ioctl: fix misbehavior if list_versions races with module loading CVE-2022-49769: In the Linux kernel, the following vulnerability has been resolved: gfs2: Check sb_bsize_shift after reading superblock CVE-2022-49763: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix use-after-free in ntfs_attr_find() CVE-2022-49762: In the Linux kernel, the following vulnerability has been resolved: ntfs: check overflow when iterating ATTR_RECORDs CVE-2022-49033: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() CVE-2022-49021: In the Linux kernel, the following vulnerability has been resolved: net: phy: fix null-ptr-deref while probe() failed CVE-2022-49015: In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free CVE-2022-49007: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() CVE-2022-49002: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() CVE-2022-42896: A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_connect and l2cap_le_connect_req functions. An attacker with physical access within the range of standard Bluetooth transmission could execute code leaking kernel memory via Bluetooth if within proximity of the victim. CVE-2022-3524: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.301-224.520 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.301-224.520.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.301-224.520.amzn2 |
Vulnerabilities 30
-
High 8.8
net: hsr: Fix potential use-after-free
In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free.
-
High 8.0CVE-2022-42896 Public exploit
Info Leak in l2cap_core in the Linux Kernel
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker coul…
-
High 7.8
ntfs: fix use-after-free in ntfs_attr_find()
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix use-after-free in ntfs_attr_find() Patch series "ntfs: fix bugs about Attribute", v2. This patchset fixes three bugs relative to Attribute in record: Patch 1 adds a sanity check to …
-
High 7.8
kcm: close race conditions on sk_receive_queue
In the Linux kernel, the following vulnerability has been resolved: kcm: close race conditions on sk_receive_queue sk->sk_receive_queue is protected by skb queue lock, but for KCM sockets its RX path takes mux->rx_lock to protect more than just skb queue. How…
-
High 7.8
nilfs2: fix use-after-free bug of ns_writer on remount
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of ns_writer on remount If a nilfs2 filesystem is downgraded to read-only due to metadata corruption on disk and is remounted read/write, or if emergency read-o…
-
High 7.8
bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() We got a syzkaller problem because of aarch64 alignment fault if KFENCE enabled. When the size from user bpf program is an odd …
-
High 7.8
ASoC: core: Fix use-after-free in snd_soc_exit()
In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Fix use-after-free in snd_soc_exit() KASAN reports a use-after-free: BUG: KASAN: use-after-free in device_del+0xb5b/0xc60 Read of size 8 at addr ffff888008655050 by task rmmod/387…
-
High 7.8
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() Syzbot reported a slab-out-of-bounds Write bug: loop0: detected capacity change from 0 to 2048 ====================================…
-
High 7.5
net: gso: fix panic on frag_list with mixed head alloc types
In the Linux kernel, the following vulnerability has been resolved: net: gso: fix panic on frag_list with mixed head alloc types Since commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list"), …
-
High 7.1CVE-2023-26607 Public exploit
In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
-
Medium 5.5
nilfs2: fix deadlock in nilfs_count_free_blocks()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix deadlock in nilfs_count_free_blocks() A semaphore deadlock can occur if nilfs_get_block() detects metadata corruption while locating data blocks and a superblock writeback occurs …
-
Medium 5.5
net: macvlan: fix memory leaks of macvlan_common_newlink
In the Linux kernel, the following vulnerability has been resolved: net: macvlan: fix memory leaks of macvlan_common_newlink kmemleak reports memory leaks in macvlan_common_newlink, as follows: ip link add link eth0 name .. type macvlan mode source macaddr ad…
-
Medium 5.5
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
In the Linux kernel, the following vulnerability has been resolved: tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header This is a follow-up for commit 974cb0e3e7c9 ("tipc: fix uninit-value in tipc_nl_compat_name_table_dump") where it…
-
Medium 5.5
HID: hyperv: fix possible memory leak in mousevsc_probe()
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: fix possible memory leak in mousevsc_probe() If hid_add_device() returns error, it should call hid_destroy_device() to free hid_dev which is allocated in hid_allocate_device().
-
Medium 4.3
Linux Kernel IPv6 ipv6_renew_options memory leak
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is …
-
Unscored —
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the referen…
-
Unscored —
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Syzbot reported a null-ptr-deref bug: NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequenc…
-
Unscored —
net: phy: fix null-ptr-deref while probe() failed
In the Linux kernel, the following vulnerability has been resolved: net: phy: fix null-ptr-deref while probe() failed I got a null-ptr-deref report as following when doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 O…
-
Unscored —
btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Syzkaller reported BUG as follows: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:2…
-
Unscored —
ntfs: check overflow when iterating ATTR_RECORDs
In the Linux kernel, the following vulnerability has been resolved: ntfs: check overflow when iterating ATTR_RECORDs Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). Because the ATTR_RECORDs are next to each other, kernel can get the next …
-
Unscored —
gfs2: Check sb_bsize_shift after reading superblock
In the Linux kernel, the following vulnerability has been resolved: gfs2: Check sb_bsize_shift after reading superblock Fuzzers like to scribble over sb_bsize_shift but in reality it's very unlikely that this field would be corrupted on its own. Nevertheless …
-
Unscored —
dm ioctl: fix misbehavior if list_versions races with module loading
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: fix misbehavior if list_versions races with module loading __list_versions will first estimate the required space using the "dm_target_iterate(list_version_get_needed, &needed)" cal…
-
Unscored —
macvlan: enforce a consistent minimal mtu
In the Linux kernel, the following vulnerability has been resolved: macvlan: enforce a consistent minimal mtu macvlan should enforce a minimal mtu of 68, even at link creation. This patch avoids the current behavior (which could lead to crashes in ipv6 stack …
-
Unscored —
mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() pci_get_device() will increase the reference count for the returned pci_dev. We need to use pci_dev_put() to decrease …
-
Unscored —
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
In the Linux kernel, the following vulnerability has been resolved: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() `struct vmci_event_qp` allocated by qp_notify_peer() contains padding, which may carry uninitialized data to the userspace, a…
-
Unscored —
ftrace: Fix null pointer dereference in ftrace_add_mod()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix null pointer dereference in ftrace_add_mod() The @ftrace_mod is allocated by kzalloc(), so both the members {prev,next} of @ftrace_mode->list are NULL, it's not a valid state to c…
-
Unscored —
drbd: use after free in drbd_create_device()
In the Linux kernel, the following vulnerability has been resolved: drbd: use after free in drbd_create_device() The drbd_destroy_connection() frees the "connection" so use the _safe() iterator to prevent a use after free.
-
Unscored —
pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map Here is the BUG report by KASAN about null pointer dereference: BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50 Read of…
-
Unscored —
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
In the Linux kernel, the following vulnerability has been resolved: ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network When copying a `struct ifaddrlblmsg` to the network, __ifal_reserved remained uninitialized, resulting in a 1-byte in…
-
Unscored —
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace li…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3524.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-42896.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49002.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49007.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49015.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49021.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49033.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49762.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49763.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49769.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49771.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49776.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49787.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49788.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49802.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49811.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49814.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49832.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49834.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49840.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49842.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49846.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49850.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49853.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49862.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49865.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49870.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49872.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49874.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-26607.html