Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-0775: A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free. CVE-2023-54244: In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: Fix oops when removing custom query handlers CVE-2023-54218: In the Linux kernel, the following vulnerability has been resolved: net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). CVE-2023-54213: In the Linux kernel, the following vulnerability has been resolved: USB: sisusbvga: Add endpoint checks CVE-2023-54062: In the Linux kernel, the following vulnerability has been resolved: ext4: fix invalid free tracking in ext4_xattr_move_to_block() CVE-2023-54044: In the Linux kernel, the following vulnerability has been resolved: spmi: Add a check for remove callback when removing a SPMI driver CVE-2023-54021: In the Linux kernel, the following vulnerability has been resolved: ext4: set goal start correctly in ext4_mb_normalize_request CVE-2023-53853: In the Linux kernel, the following vulnerability has been resolved: netlink: annotate accesses to nlk->cb_running CVE-2023-53845: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfs_mdt_get_block() CVE-2023-53804: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() CVE-2023-53786: In the Linux kernel, the following vulnerability has been resolved: dm flakey: fix a crash with invalid table line CVE-2023-53705: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() CVE-2023-53683: In the Linux kernel, the following vulnerability has been resolved: fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() CVE-2023-53667: In the Linux kernel, the following vulnerability has been resolved: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize CVE-2023-53604: In the Linux kernel, the following vulnerability has been resolved: dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path CVE-2023-53587: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction CVE-2023-53569: In the Linux kernel, the following vulnerability has been resolved: ext2: Check block size validity during mount CVE-2023-53489: In the Linux kernel, the following vulnerability has been resolved: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. CVE-2023-53484: In the Linux kernel, the following vulnerability has been resolved: lib: cpu_rmap: Avoid use after free on rmap->obj array entries CVE-2023-53450: In the Linux kernel, the following vulnerability has been resolved: ext4: remove a BUG_ON in ext4_mb_release_group_pa() CVE-2023-53337: In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not write dirty data after degenerating to read-only CVE-2023-53299: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio->remaining' for recovery CVE-2023-53285: In the Linux kernel, the following vulnerability has been resolved: ext4: add bounds checking in get_max_inline_xattr_value_size() CVE-2023-53182: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid undefined behavior: applying zero offset to null pointer CVE-2023-53176: In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Reinit port->pm on port specific driver unbind CVE-2023-34256: An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. CVE-2023-3141: A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. CVE-2023-3111: A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). CVE-2023-3090: A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. CVE-2023-28466: do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). CVE-2023-2269: A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. CVE-2022-50213: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow SET_ID to refer to another table CVE-2022-50067: In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() CVE-2022-34918: A heap buffer overflow flaw was found in the Linux kernel's Netfilter subsystem in the way a user provides incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2022-2586: It was discovered that a nft object or expression could reference a nft set on a diff
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.318-240.529 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.318-240.529.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.318-240.529.amzn2 |
Vulnerabilities 35
-
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
High 8.2
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on be…
-
High 7.8
netfilter: nf_tables: do not allow SET_ID to refer to another table
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow SET_ID to refer to another table When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the tab…
-
High 7.8
Out-of-bounds write in Linux kernel's ipvlan network driver
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is r…
-
High 7.8
A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. …
-
High 7.8
serial: 8250: Reinit port->pm on port specific driver unbind
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Reinit port->pm on port specific driver unbind When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see a…
-
High 7.8
lib: cpu_rmap: Avoid use after free on rmap->obj array entries
In the Linux kernel, the following vulnerability has been resolved: lib: cpu_rmap: Avoid use after free on rmap->obj array entries When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corr…
-
High 7.8
ring-buffer: Sync IRQ works before buffer destruction
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH…
-
High 7.8
fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
In the Linux kernel, the following vulnerability has been resolved: fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() syzbot is hitting WARN_ON() in hfsplus_cat_{read,write}_inode(), for crafted filesystem image can contain bogus length. The…
-
High 7.8
nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_w…
-
High 7.8
ext4: fix invalid free tracking in ext4_xattr_move_to_block()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix invalid free tracking in ext4_xattr_move_to_block() In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by…
-
High 7.1
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…
-
High 7.1
ext4: add bounds checking in get_max_inline_xattr_value_size()
In the Linux kernel, the following vulnerability has been resolved: ext4: add bounds checking in get_max_inline_xattr_value_size() Normally the extended attributes in the inode body would have been checked when the inode is first opened, but if someone is wri…
-
High 7.0
do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race con…
-
Medium 6.7
Kernel: use-after-free while changing the mount option in __ext4_remount leading
A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-…
-
Medium 5.5
An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when c…
-
Medium 5.5
md/raid10: fix leak of 'r10bio->remaining' for recovery
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio->remaining' for recovery raid10_sync_request() will add 'r10bio->remaining' for both rdev and replacement rdev. However, if the read io fails, recovery_request_…
-
Medium 5.5
nilfs2: do not write dirty data after degenerating to read-only
In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not write dirty data after degenerating to read-only According to syzbot's report, mark_buffer_dirty() called from nilfs_segctor_do_construct() outputs a warning with some patterns…
-
Unscored —CVE-2022-34918 Public exploit
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buf…
-
Unscored —
btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_gr…
-
Unscored —
A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_c…
-
Unscored —
ACPICA: Avoid undefined behavior: applying zero offset to null pointer
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e Before this change we see the following UBSAN stack trace in Fuch…
-
Unscored —
ext4: remove a BUG_ON in ext4_mb_release_group_pa()
In the Linux kernel, the following vulnerability has been resolved: ext4: remove a BUG_ON in ext4_mb_release_group_pa() If a malicious fuzzer overwrites the ext4 superblock while it is mounted such that the s_first_data_block is set to a very large number, th…
-
Unscored —
tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
In the Linux kernel, the following vulnerability has been resolved: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY skbs. We can reproduce the problem with these sequences: sk …
-
Unscored —
ext2: Check block size validity during mount
In the Linux kernel, the following vulnerability has been resolved: ext2: Check block size validity during mount Check that log of block size stored in the superblock has sensible value. Otherwise the shift computing the block size can overflow leading to und…
-
Unscored —
dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
In the Linux kernel, the following vulnerability has been resolved: dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path Otherwise the journal_io_cache will leak if dm_register_target() fails.
-
Unscored —
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
In the Linux kernel, the following vulnerability has been resolved: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than the calculated "min" value, but greater than zero, the logic se…
-
Unscored —
dm flakey: fix a crash with invalid table line
In the Linux kernel, the following vulnerability has been resolved: dm flakey: fix a crash with invalid table line This command will crash with NULL pointer dereference: dmsetup create flakey --table \ "0 `blockdev --getsize /dev/ram0` flakey /dev/ram0 0 0 1 …
-
Unscored —
nilfs2: fix infinite loop in nilfs_mdt_get_block()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfs_mdt_get_block() If the disk image that nilfs2 mounts is corrupted and a virtual block address obtained by block lookup for a metadata file is invalid, nilfs…
-
Unscored —
netlink: annotate accesses to nlk->cb_running
In the Linux kernel, the following vulnerability has been resolved: netlink: annotate accesses to nlk->cb_running Both netlink_recvmsg() and netlink_native_seq_show() read nlk->cb_running locklessly. Use READ_ONCE() there. Add corresponding WRITE_ONCE() to ne…
-
Unscored —
ext4: set goal start correctly in ext4_mb_normalize_request
In the Linux kernel, the following vulnerability has been resolved: ext4: set goal start correctly in ext4_mb_normalize_request We need to set ac_g_ex to notify the goal start used in ext4_mb_find_by_goal. Set ac_g_ex instead of ac_f_ex in ext4_mb_normalize_r…
-
Unscored —
spmi: Add a check for remove callback when removing a SPMI driver
In the Linux kernel, the following vulnerability has been resolved: spmi: Add a check for remove callback when removing a SPMI driver When removing a SPMI driver, there can be a crash due to NULL pointer dereference if it does not have a remove callback defin…
-
Unscored —
USB: sisusbvga: Add endpoint checks
In the Linux kernel, the following vulnerability has been resolved: USB: sisusbvga: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 W…
-
Unscored —
net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
In the Linux kernel, the following vulnerability has been resolved: net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). KCSAN found a data race in sock_recv_cmsgs() where the read access to sk->sk_stamp needs READ_ONCE(). BUG: KCSAN: data-race in pack…
-
Unscored —
ACPI: EC: Fix oops when removing custom query handlers
In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: Fix oops when removing custom query handlers When removing custom query handlers, the handler might still be used inside the EC query workqueue, causing a kernel oops if the module …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2586.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-34918.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50067.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50213.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2269.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-28466.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3090.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3111.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3141.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-34256.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53176.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53182.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53285.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53299.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53337.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53450.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53484.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53489.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53569.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53587.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53604.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53667.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53683.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53705.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53786.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53804.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53845.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53853.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54021.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54044.html