Skip to content
OpenAdvisories
High ALAS2-2023-2050 1 CVE

Important: kernel security update (Amazon Linux 2)

Published May 25, 2023 · Updated Jun 1, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32233: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.314-238.539.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.314-238.539.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.314-238.539.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.314-238.539.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.314-238.539.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.314-238.539.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.314-238.539 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.314-238.539.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.314-238.539.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.314-238.539.amzn2
Amazon Linux · 2 perf 0:4.14.314-238.539.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.314-238.539.amzn2
Amazon Linux · 2 python-perf 0:4.14.314-238.539.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.314-238.539.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-32233.html