Skip to content
OpenAdvisories
Medium ALAS2-2023-2035 2 CVEs

Moderate: kernel security update (Amazon Linux 2)

Published May 11, 2023 · Updated May 16, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31436: qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. CVE-2023-2513: A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.314-237.533.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.314-237.533.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.314-237.533.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.314-237.533.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.314-237.533.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.314-237.533.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.314-237.533 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.314-237.533.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.314-237.533.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.314-237.533.amzn2
Amazon Linux · 2 perf 0:4.14.314-237.533.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.314-237.533.amzn2
Amazon Linux · 2 python-perf 0:4.14.314-237.533.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.314-237.533.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-2513.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-31436.html