Skip to content
OpenAdvisories
Medium ALAS2-2023-2206 2 CVEs

Moderate: kernel security update (Amazon Linux 2)

Published Aug 17, 2023 · Updated Aug 23, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4128: A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. CVE-2023-34319: A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.322-244.536.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.322-244.536.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.322-244.536.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.322-244.536.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.322-244.536.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.322-244.536.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.322-244.536 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.322-244.536.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.322-244.536.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.322-244.536.amzn2
Amazon Linux · 2 perf 0:4.14.322-244.536.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.322-244.536.amzn2
Amazon Linux · 2 python-perf 0:4.14.322-244.536.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.322-244.536.amzn2

Vulnerabilities 2

  • High 7.8
    CVE-2023-34319

    Linux: buffer overrun in netback due to unusual packet

    The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-4128 Public exploit Rejected

    ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-34319.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-4128.html