Skip to content
OpenAdvisories
High ALAS2-2024-2475 4 CVEs

Important: kernel security update (Amazon Linux 2)

Published Feb 29, 2024 · Updated Jul 3, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23851: copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl. CVE-2024-23849: In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. CVE-2023-6270: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. CVE-2023-52429: dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.336-257.562.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.336-257.562.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.336-257.562.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.336-257.562.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.336-257.562.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.336-257.562.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.336-257.562 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.336-257.562.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.336-257.562.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.336-257.562.amzn2
Amazon Linux · 2 perf 0:4.14.336-257.562.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.336-257.562.amzn2
Amazon Linux · 2 python-perf 0:4.14.336-257.562.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.336-257.562.amzn2

Vulnerabilities 4

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-52429.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-6270.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23849.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23851.html