Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-54265: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix an uninit variable access bug in __ip6_make_skb() CVE-2023-53623: In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() CVE-2023-53608: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() CVE-2023-53440: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix sysfs interface lifetime CVE-2023-53246: In the Linux kernel, the following vulnerability has been resolved: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL CVE-2023-53081: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write CVE-2023-53078: In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() CVE-2023-53062: In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc95xx: Limit packet length to skb->len CVE-2023-53060: In the Linux kernel, the following vulnerability has been resolved: igb: revert rtnl_lock() that causes deadlock CVE-2023-53051: In the Linux kernel, the following vulnerability has been resolved: dm crypt: add cond_resched() to dmcrypt_write() CVE-2023-53044: In the Linux kernel, the following vulnerability has been resolved: dm stats: check for and propagate alloc_percpu failure CVE-2023-53035: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() CVE-2023-33203: The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device. CVE-2023-23454: cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). CVE-2023-2194: An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. CVE-2023-2124: An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2023-2002: An insufficient permission check has been found in the Bluetooth subsystem of the Linux kernel when handling ioctl system calls of HCI sockets. This causes tasks without the proper CAP_NET_ADMIN capability can easily mark HCI sockets as _trusted_. Trusted sockets are intended to enable the sending and receiving of management commands and events, such as pairing or connecting with a new device. As a result, unprivileged users can acquire a trusted socket, leading to unauthorized execution of management commands. The exploit requires only the presence of a set of commonly used setuid programs (e.g., su, sudo). CVE-2023-1838: A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.313-235.533 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.313-235.533.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.313-235.533.amzn2 |
Vulnerabilities 18
-
High 7.8
nilfs2: fix sysfs interface lifetime
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix sysfs interface lifetime The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, u…
-
High 7.8
nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() The finalization of nilfs_segctor_thread() can race with nilfs_segctor_kill_thread() which terminates that thread, …
-
Medium 6.7
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->bl…
-
Medium 6.4
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/e…
-
Medium 5.5
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (sl…
-
Unscored —
A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the L…
-
Unscored —CVE-2023-2002 Public exploit
A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock…
-
Unscored —
An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image…
-
Unscored —
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a metadata array to/from user space, may copy uninitialized buffer re…
-
Unscored —
dm stats: check for and propagate alloc_percpu failure
In the Linux kernel, the following vulnerability has been resolved: dm stats: check for and propagate alloc_percpu failure Check alloc_precpu()'s return value and return an error from dm_stats_init() if it fails. Update alloc_dev() to fail if dm_stats_init() …
-
Unscored —
dm crypt: add cond_resched() to dmcrypt_write()
In the Linux kernel, the following vulnerability has been resolved: dm crypt: add cond_resched() to dmcrypt_write() The loop in dmcrypt_write may be running for unbounded amount of time, thus we need cond_resched() in it. This commit fixes the following warni…
-
Unscored —
igb: revert rtnl_lock() that causes deadlock
In the Linux kernel, the following vulnerability has been resolved: igb: revert rtnl_lock() that causes deadlock The commit 6faee3d4ee8b ("igb: Add lock to avoid data race") adds rtnl_lock to eliminate a false data race shown below (FREE from device detaching…
-
Unscored —
net: usb: smsc95xx: Limit packet length to skb->len
In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc95xx: Limit packet length to skb->len Packet length retrieved from descriptor may be larger than the actual socket buffer length. In such case the cloned skb passed up the netwo…
-
Unscored —
scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced ob…
-
Unscored —
ocfs2: fix data corruption after failed write
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write When buffered write fails to copy data into underlying page cache page, ocfs2_write_end_nolock() just zeroes out and dirties the page. This can l…
-
Unscored —
cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
In the Linux kernel, the following vulnerability has been resolved: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL…
-
Unscored —
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lock must be held when deleting the si from the available list. Otherwise, another thread can re-add the si to …
-
Unscored —
ipv6: Fix an uninit variable access bug in __ip6_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix an uninit variable access bug in __ip6_make_skb() Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in arch_atomic64…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1838.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2002.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2124.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-23454.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-33203.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53035.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53044.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53051.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53060.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53062.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53078.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53081.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53246.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53440.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53608.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53623.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54265.html