Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-7324: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses CVE-2023-7192: kernel: refcount leak in ctnetlink_create_conntrack() CVE-2023-54317: In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page CVE-2023-54305: In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted CVE-2023-54214: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free CVE-2023-54198: In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() CVE-2023-54087: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix possible null-ptr-deref in ubi_free_volume() CVE-2023-53862: In the Linux kernel, the following vulnerability has been resolved: hfs: fix missing hfs_bnode_get() in __hfs_bnode_create CVE-2023-53826: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() CVE-2023-53803: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() CVE-2023-53800: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume resizing failed CVE-2023-53675: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses CVE-2023-53521: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() CVE-2023-53506: In the Linux kernel, the following vulnerability has been resolved: udf: Do not bother merging very long extents CVE-2023-53481: In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed CVE-2023-53453: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: free iio for atombios when driver shutdown CVE-2023-53431: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Don't attach if enclosure has no components CVE-2023-53373: In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly CVE-2023-53307: In the Linux kernel, the following vulnerability has been resolved: rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails CVE-2023-53295: In the Linux kernel, the following vulnerability has been resolved: udf: Do not update file length for failed writes to inline files CVE-2023-53271: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() CVE-2023-53265: In the Linux kernel, the following vulnerability has been resolved: ubi: ensure that VID header offset + VID header size <= alloc, size CVE-2023-53234: In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix kmemleak in watchdog_cdev_register CVE-2023-53191: In the Linux kernel, the following vulnerability has been resolved: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains CVE-2023-52979: In the Linux kernel, the following vulnerability has been resolved: squashfs: harden sanity check in squashfs_read_xattr_id_table CVE-2023-52977: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new CVE-2023-52974: In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress CVE-2023-52933: In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count CVE-2023-52932: In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: add cond_resched() in get_swap_pages() CVE-2023-52742: In the Linux kernel, the following vulnerability has been resolved: net: USB: Fix wrong-direction WARNING in plusb.c CVE-2023-52730: In the Linux kernel, the following vulnerability has been resolved: mmc: sdio: fix possible resource leaks in some error paths CVE-2023-52705: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix underflow in second superblock position calculations CVE-2023-52703: In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path CVE-2023-52646: In the Linux kernel, the following vulnerability has been resolved: aio: fix mremap after fork null-deref CVE-2023-45862: An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. CVE-2023-3161: A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing a font->width and font->height greater than 32 to the fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs, leading to undefined behavior and possible denial of service. CVE-2023-2985: A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service. CVE-2023-26545: In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. CVE-2023-2162: A use-after-free flaw was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in the SCSI sub-component in the Linux Kernel. This issue could allow an attacker to leak kernel internal information. CVE-2023-1998: When plain IBRS is enabled (not enhanced IB
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.309-231.529 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.309-231.529.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.309-231.529.amzn2 |
Vulnerabilities 44
-
High 8.8
scsi: ses: Handle enclosure with just a primary component gracefully
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling…
-
High 8.8
scsi: ses: Fix possible desc_ptr out-of-bounds accesses
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process().
-
High 8.8
Bluetooth: L2CAP: Fix potential user-after-free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which mak…
-
High 8.1
scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043…
-
High 8.1
scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Sanitize possible addl_desc_ptr out-of-bounds accesses in ses_enclosure_data_process().
-
High 7.8CVE-2023-1281 Public exploit
UAF in Linux kernel's tcindex (traffic control index filter) implementation
Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the d…
-
High 7.8CVE-2023-1829 Public exploit
Use-after-free in tcindex (traffic control index filter) in the Linux Kernel
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting…
-
High 7.8
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipadd…
-
High 7.8
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
In the Linux kernel, the following vulnerability has been resolved: rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails If getting an ID or setting up a work queue in rbd_dev_create() fails, use-after-free on rbd_dev->rbd_client, rbd_dev->sp…
-
High 7.8
crypto: seqiv - Handle EBUSY correctly
In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…
-
High 7.8
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed Following process will trigger an infinite loop in ubi_wl_put_peb(): ubifs_bgt ubi_bgt ubifs_leb_unmap ubi_leb_unmap ubi_…
-
High 7.8
udf: Do not bother merging very long extents
In the Linux kernel, the following vulnerability has been resolved: udf: Do not bother merging very long extents When merging very long extents we try to push as much length as possible to the first extent. However this is unnecessarily complicated and not re…
-
High 7.8
ubi: Fix use-after-free when volume resizing failed
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume resizing failed There is an use-after-free problem reported by KASAN: ================================================================== BUG: KASAN: use-af…
-
High 7.8
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
In the Linux kernel, the following vulnerability has been resolved: hfs: fix missing hfs_bnode_get() in __hfs_bnode_create Syzbot found a kernel BUG in hfs_bnode_put(): kernel BUG at fs/hfs/bnode.c:466! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: …
-
High 7.8
tty: fix out-of-bounds access in tty_driver_lookup_tty()
In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking wheth…
-
High 7.8
dm flakey: don't corrupt the zero page
In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page When we need to zero some range on a block device, the function __blkdev_issue_zero_pages submits a write bio with the bio vector pointing to the zero p…
-
High 7.1
ubi: ensure that VID header offset + VID header size <= alloc, size
In the Linux kernel, the following vulnerability has been resolved: ubi: ensure that VID header offset + VID header size <= alloc, size Ensure that the VID header offset + VID header size does not exceed the allocated area to avoid slab OOB. BUG: KASAN: slab-…
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 5.5
net: sched: fix memory leak in tcindex_set_parms
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix memory leak in tcindex_set_parms Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810c287f00 (size…
-
Medium 5.5
A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-compone…
-
Medium 5.5
A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a…
-
Medium 5.5
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height gr…
-
Medium 5.5
mm/swapfile: add cond_resched() in get_swap_pages()
In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: add cond_resched() in get_swap_pages() The softlockup still occurs in get_swap_pages() under memory pressure. 64 CPU cores, 64GB memory, and 28 zram devices, the disksize of each…
-
Medium 5.5
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is not freed when an allocation of a key fails. BUG: memory …
-
Medium 5.5
watchdog: Fix kmemleak in watchdog_cdev_register
In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix kmemleak in watchdog_cdev_register kmemleak reports memory leaks in watchdog_dev_register, as follows: unreferenced object 0xffff888116233000 (size 2048): comm ""modprobe"", pid…
-
Medium 5.5
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() There is a memory leaks problem reported by kmemleak: unreferenced object 0xffff888102007a00 (size 128): comm "ubirsvo…
-
Medium 5.5
udf: Do not update file length for failed writes to inline files
In the Linux kernel, the following vulnerability has been resolved: udf: Do not update file length for failed writes to inline files When write to inline file fails (or happens only partly), we still updated length of inline data as if the whole write succeed…
-
Medium 5.5
Kernel: refcount leak in ctnetlink_create_conntrack()
A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.
-
Medium 5.3
Spectre V1 Gadget in do_prlimit in the Linux Kernel
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
-
Low 3.3
net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path syzbot reported that act_len in kalmia_send_init_packet() is uninitialized when passing it to the first usb_bulk_msg error path.…
-
Unscored —
An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before…
-
Unscored —
aio: fix mremap after fork null-deref
In the Linux kernel, the following vulnerability has been resolved: aio: fix mremap after fork null-deref Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced a null-deref if mremap is called on an old aio mapping after fork as mm->ioctx…
-
Unscored —
nilfs2: fix underflow in second superblock position calculations
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix underflow in second superblock position calculations Macro NILFS_SB2_OFFSET_BYTES, which computes the position of the second superblock, underflows when the argument device size i…
-
Unscored —
mmc: sdio: fix possible resource leaks in some error paths
In the Linux kernel, the following vulnerability has been resolved: mmc: sdio: fix possible resource leaks in some error paths If sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can not release the resources, because the sdio function is not pre…
-
Unscored —
net: USB: Fix wrong-direction WARNING in plusb.c
In the Linux kernel, the following vulnerability has been resolved: net: USB: Fix wrong-direction WARNING in plusb.c The syzbot fuzzer detected a bug in the plusb network driver: A zero-length control-OUT transfer was treated as a read instead of a write. In …
-
Unscored —
Squashfs: fix handling and sanity checking of xattr_ids count
In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem.…
-
Unscored —CVE-2023-52979 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
In the Linux kernel, the following vulnerability has been resolved: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anym…
-
Unscored —
drm/radeon: free iio for atombios when driver shutdown
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: free iio for atombios when driver shutdown Fix below kmemleak when unload radeon driver: unreferenced object 0xffff9f8608ede200 (size 512): comm "systemd-udevd", pid 326, jiffies …
-
Unscored —
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() A fix for: BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/120…
-
Unscored —
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example: __erase_…
-
Unscored —
ubi: Fix possible null-ptr-deref in ubi_free_volume()
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix possible null-ptr-deref in ubi_free_volume() It willl cause null-ptr-deref in the following case: uif_init() ubi_add_volume() cdev_add() -> if it fails, call kill_volumes() device_re…
-
Unscored —
ext4: refuse to create ea block when umounted
In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted The ea block expansion need to access s_root while it is already set as NULL when umount is triggered. Refuse this request to avoid panic.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50396.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0458.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1281.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1829.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1998.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2162.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-26545.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2985.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3161.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-45862.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52646.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52703.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52705.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52730.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52742.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52932.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52933.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52974.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52977.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52979.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53191.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53234.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53265.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53271.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53295.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53307.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53373.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53431.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53453.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53481.html