Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1637: A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks. CVE-2022-49287: In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip CVE-2022-49280: In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent underflow in nfssvc_decode_writeargs() CVE-2022-49224: In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init CVE-2022-49197: In the Linux kernel, the following vulnerability has been resolved: af_netlink: Fix shift out of bounds in group mask calculation CVE-2022-49175: In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in device_pm_check_callbacks() CVE-2022-49171: In the Linux kernel, the following vulnerability has been resolved: ext4: don't BUG if someone dirty pages without asking ext4 first CVE-2022-49166: In the Linux kernel, the following vulnerability has been resolved: ntfs: add sanity check on allocation size CVE-2022-49155: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() CVE-2022-49145: In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data CVE-2022-49122: In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevent potential spectre v1 gadget CVE-2022-49114: In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() CVE-2022-49111: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl CVE-2022-49100: In the Linux kernel, the following vulnerability has been resolved: virtio_console: eliminate anonymous module_init & module_exit CVE-2022-49085: In the Linux kernel, the following vulnerability has been resolved: drbd: Fix five use after free bugs in get_initial_state CVE-2022-49080: In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix mpol_new leak in shared_policy_replace CVE-2022-49077: In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) CVE-2022-49075: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve overflow the qgroup limit CVE-2022-49066: In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part CVE-2022-49058: In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks CVE-2022-49053: In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF CVE-2022-41858: A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information. CVE-2022-2977: A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system. CVE-2022-1353: A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information. CVE-2022-1011: A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. CVE-2021-47634: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.276-211.499 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.276-211.499.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.276-211.499.amzn2 |
Vulnerabilities 26
-
Critical 9.8
NFSD: prevent underflow in nfssvc_decode_writeargs()
In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent underflow in nfssvc_decode_writeargs() Smatch complains: fs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs() warn: no lower bound on 'args->len' Change the type to unsigned to preven…
-
Critical 9.1
cifs: potential buffer overflow in handling symlinks
In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max…
-
High 8.8
Bluetooth: Fix use after free in hci_send_acl
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->…
-
High 8.8
scsi: libfc: Fix use after free in fc_exch_abts_resp()
In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in …
-
High 8.1
btrfs: fix qgroup reserve overflow the qgroup limit
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve overflow the qgroup limit We use extent_changeset->bytes_changed in qgroup_reserve_data() to record how many bytes we set for EXTENT_QGROUP_RESERVED state. Currently…
-
High 7.8
ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a KASAN report about use-after-free: ================================================================== …
-
High 7.8
scsi: target: tcmu: Fix possible page UAF
In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data…
-
High 7.8
drbd: Fix five use after free bugs in get_initial_state
In the Linux kernel, the following vulnerability has been resolved: drbd: Fix five use after free bugs in get_initial_state In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_don…
-
High 7.1
A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…
-
High 7.0
tpm: fix reference counting for struct tpm_chip
In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM com…
-
Medium 5.5
scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() [ 12.323788] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-udevd/1020 [ 12.332297] caller is qla2xxx_c…
-
Medium 5.5
power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add()： If this function retu…
-
Medium 5.5
A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86…
-
Unscored —CVE-2022-1011 Public exploit
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…
-
Unscored —
A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a lo…
-
Unscored —
A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized T…
-
Unscored —
veth: Ensure eth header is in skb's linear part
In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which …
-
Unscored —
mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invali…
-
Unscored —
mm/mempolicy: fix mpol_new leak in shared_policy_replace
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix mpol_new leak in shared_policy_replace If mpol_new is allocated but not used in restart loop, mpol_new will be freed via mpol_put before returning to the caller. But refcnt …
-
Unscored —
virtio_console: eliminate anonymous module_init & module_exit
In the Linux kernel, the following vulnerability has been resolved: virtio_console: eliminate anonymous module_init & module_exit Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oo…
-
Unscored —
dm ioctl: prevent potential spectre v1 gadget
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevent potential spectre v1 gadget It appears like cmd could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory fro…
-
Unscored —
ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data If the NumEntries field in the _CPC return package is less than 2, do not attempt to access the "Revision" element of that packag…
-
Unscored —
ntfs: add sanity check on allocation size
In the Linux kernel, the following vulnerability has been resolved: ntfs: add sanity check on allocation size ntfs_read_inode_mount invokes ntfs_malloc_nofs with zero allocation size. It triggers one BUG in the __ntfs_malloc function. Fix this by adding sanit…
-
Unscored —
ext4: don't BUG if someone dirty pages without asking ext4 first
In the Linux kernel, the following vulnerability has been resolved: ext4: don't BUG if someone dirty pages without asking ext4 first [un]pin_user_pages_remote is dirtying pages without properly warning the file system in advance. A related race was noted by J…
-
Unscored —
PM: core: keep irq flags in device_pm_check_callbacks()
In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in device_pm_check_callbacks() The function device_pm_check_callbacks() can be called under the spin lock (in the reported case it happens from genpd_add_device() -> …
-
Unscored —
af_netlink: Fix shift out of bounds in group mask calculation
In the Linux kernel, the following vulnerability has been resolved: af_netlink: Fix shift out of bounds in group mask calculation When a netlink message is received, netlink_recvmsg() fills in the address of the sender. One of the fields is the 32-bit bitfiel…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47634.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-1011.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-1353.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2977.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-41858.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49053.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49058.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49066.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49075.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49077.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49080.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49085.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49100.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49111.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49114.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49122.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49145.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49155.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49166.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49171.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49175.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49197.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49224.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49280.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49287.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1637.html