Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-0639: A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. CVE-2023-54283: In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpf_lru_list CVE-2023-54211: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in trace_buffered_event_disable() CVE-2023-54091: In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_target_cloned CVE-2023-54032: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when deleting quota root from the dirty cow roots list CVE-2023-54014: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() CVE-2023-53863: In the Linux kernel, the following vulnerability has been resolved: netlink: do not hard code device address lenth in fdb dumps CVE-2023-53731: In the Linux kernel, the following vulnerability has been resolved: netlink: fix potential deadlock in netlink_set_err() CVE-2023-53728: In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid CVE-2023-53668: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix deadloop issue on reading trace_pipe CVE-2023-53619: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free CVE-2023-53548: In the Linux kernel, the following vulnerability has been resolved: net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb CVE-2023-53451: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix potential NULL pointer dereference CVE-2023-53365: In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skb_under_panic in ip6mr_cache_report() CVE-2023-53322: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on terminate rport CVE-2023-53313: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix wrong setting of max_corr_read_errors CVE-2023-53222: In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting CVE-2023-53215: In the Linux kernel, the following vulnerability has been resolved: sched/fair: Don't balance task to its current running CPU CVE-2023-53189: In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev CVE-2023-53151: In the Linux kernel, the following vulnerability has been resolved: md/raid10: prevent soft lockup while flush writes CVE-2023-53150: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Pointer may be dereferenced CVE-2023-53148: In the Linux kernel, the following vulnerability has been resolved: igb: Fix igb_down hung on surprise removal CVE-2023-52885: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() CVE-2023-4208: A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. CVE-2023-4206: A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. CVE-2023-4128: A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. CVE-2023-34319: The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver. CVE-2023-3390: A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. CVE-2023-3212: A flaw in the Linux Kernel found in the GFS2 fi
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.322-244.536 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.322-244.536.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.322-244.536.amzn2 |
Vulnerabilities 29
-
High 8.8
scsi: qla2xxx: Wait for io return on terminate rport
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on terminate rport System crash due to use after free. Current code allows terminate_rport_io to exit before making sure all IOs has returned. For FCP-2 devi…
-
High 8.1
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock re…
-
High 7.8CVE-2023-3390 Public exploit
Use-after-free in Linux kernel's netfilter subsystem
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vu…
-
High 7.8
Linux: buffer overrun in netback due to unusual packet
The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_route component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instanc…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of …
-
High 7.8
ipv6/addrconf: fix a potential refcount underflow for idev
In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a …
-
High 7.8
sched/fair: Don't balance task to its current running CPU
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Don't balance task to its current running CPU We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like b…
-
High 7.8
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of b…
-
High 7.8
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free If nf_conntrack_init_start() fails (for example due to a register_nf_conntrack_bpf() failure), the nf_conntrack_helper_fini() cle…
-
Medium 5.5
md/raid10: fix wrong setting of max_corr_read_errors
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix wrong setting of max_corr_read_errors There is no input check when echo md/max_read_errors and overflow might occur. Add check of input number.
-
Medium 5.5
ip6mr: Fix skb_under_panic in ip6mr_cache_report()
In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skb_under_panic in ip6mr_cache_report() skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ---…
-
Medium 5.5
Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
-
Unscored —
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file …
-
Unscored —
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…
-
Unscored —
igb: Fix igb_down hung on surprise removal
In the Linux kernel, the following vulnerability has been resolved: igb: Fix igb_down hung on surprise removal In a setup where a Thunderbolt hub connects to Ethernet and a display through USB Type-C, users may experience a hung task timeout when they remove …
-
Unscored —
scsi: qla2xxx: Pointer may be dereferenced
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Pointer may be dereferenced Klocwork tool reported pointer 'rport' returned from call to function fc_bsg_to_rport() may be NULL and will be dereferenced. Add a fix to validate …
-
Unscored —
md/raid10: prevent soft lockup while flush writes
In the Linux kernel, the following vulnerability has been resolved: md/raid10: prevent soft lockup while flush writes Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't, and too many…
-
Unscored —
scsi: qla2xxx: Fix potential NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix potential NULL pointer dereference Klocwork tool reported 'cur_dsd' may be dereferenced. Add fix to validate pointer before dereferencing the pointer.
-
Unscored —
net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
In the Linux kernel, the following vulnerability has been resolved: net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb The syzbot fuzzer identified a problem in the usbnet driver: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at…
-
Unscored —
ring-buffer: Fix deadloop issue on reading trace_pipe
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix deadloop issue on reading trace_pipe Soft lockup occurs when reading file 'trace_pipe': watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488] [...] RIP: 0010:ring_buff…
-
Unscored —
posix-timers: Ensure timer ID search-loop limit is valid
In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation…
-
Unscored —
netlink: fix potential deadlock in netlink_set_err()
In the Linux kernel, the following vulnerability has been resolved: netlink: fix potential deadlock in netlink_set_err() syzbot reported a possible deadlock in netlink_set_err() [1] A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs for …
-
Unscored —
netlink: do not hard code device address lenth in fdb dumps
In the Linux kernel, the following vulnerability has been resolved: netlink: do not hard code device address lenth in fdb dumps syzbot reports that some netdev devices do not have a six bytes address [1] Replace ETH_ALEN by dev->addr_len. [1] (Case of a devic…
-
Unscored —
scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() Klocwork reported warning of rport maybe NULL and will be dereferenced. rport returned by call to fc_bsg_to_rport() could be NUL…
-
Unscored —
btrfs: fix race when deleting quota root from the dirty cow roots list
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when deleting quota root from the dirty cow roots list When disabling quotas we are deleting the quota root from the list fs_info->dirty_cowonly_roots without taking the lock …
-
Unscored —
drm/client: Fix memory leak in drm_client_target_cloned
In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_target_cloned dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup ar…
-
Unscored —
tracing: Fix warning in trace_buffered_event_disable()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in trace_buffered_event_disable() Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_bu…
-
Unscored —
bpf: Address KCSAN report on bpf_lru_list
In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpf_lru_list KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate, take this chance to use a more common READ_ONCE…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3212.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3390.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-34319.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4128.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4206.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4208.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52885.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53148.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53150.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53151.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53189.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53215.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53222.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53313.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53322.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53365.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53451.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53548.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53619.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53668.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53728.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53731.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53863.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54014.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54032.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54091.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54211.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54283.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-0639.html