Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-36959: In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() CVE-2024-36954: In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append CVE-2024-36940: In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() CVE-2024-36905: In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets CVE-2024-36902: In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() CVE-2024-36886: In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path CVE-2024-36883: In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init CVE-2024-36017: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation CVE-2024-36004: In the Linux kernel, the following vulnerability has been resolved: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue CVE-2024-35997: In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up CVE-2024-35973: In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb CVE-2024-35969: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr CVE-2024-35960: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree CVE-2024-35955: In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration CVE-2024-35947: In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser CVE-2024-35849: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() CVE-2024-35847: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error CVE-2024-27020: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() CVE-2024-27013: In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev CVE-2024-27000: In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state CVE-2024-26993: In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() CVE-2024-26981: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfs_set_de_type CVE-2024-26923: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() CVE-2024-26922: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly CVE-2023-52578: In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() CVE-2023-30456: An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.348-265.562 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.348-265.562.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.348-265.562.amzn2 |
Vulnerabilities 26
-
Critical 9.8CVE-2024-36886 Public exploit
tipc: fix UAF in error path
In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list…
-
Critical 9.1
net/mlx5: Properly link new fs rules into the tree
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, c…
-
High 8.8
kprobes: Fix possible use-after-free issue on kprobe registration
In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change …
-
High 8.8
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item…
-
High 7.8
drm/amdgpu: validate the parameters of bo mapping operations more clearly
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the parameters of amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.
-
High 7.8
af_unix: Fix garbage collector racing against connect()
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a pe…
-
High 7.8
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_ta…
-
High 7.8
irqchip/gic-v3-its: Prevent double free on error
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least on…
-
High 7.8
net: fix out-of-bounds access in ops_init
In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is …
-
High 7.8
pinctrl: core: delete incorrect free in pinctrl_enable()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_…
-
Medium 6.5
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency…
-
Medium 5.5
dyndbg: fix old BUG_ON in >control parser
In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't really look), lets make sure by removing it, doing pr_err and return -EINVAL instead.
-
Medium 5.5
geneve: fix header validation in geneve[6]_xmit_skb
In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb syzbot is able to trigger an uninit-value in geneve_xmit() [1] Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses s…
-
Unscored —
net: bridge: use DEV_STATS_INC()
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_I…
-
Unscored —
nilfs2: fix OOB in nilfs_set_de_type
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfs_set_de_type The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses t…
-
Unscored —
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_ge…
-
Unscored —
serial: mxs-auart: add spinlock around changing cts state
In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kerne…
-
Unscored —
tun: limit printing rate when illegal packet received by tun dev
In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping p…
-
Unscored —
btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_…
-
Unscored —
HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already h…
-
Unscored —
i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
In the Linux kernel, the following vulnerability has been resolved: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue Issue reported by customer during SRIOV testing, call trace: When both i40e and the i40iw driver are loaded, a warning in check_flush_depend…
-
Unscored —
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute nee…
-
Unscored —
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() syzbot is able to trigger the following crash [1], caused by unsafe ip6_dst_idev() use. Indeed ip6_dst_idev() can retur…
-
Unscored —
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1],…
-
Unscored —
tipc: fix a possible memleak in tipc_buf_append
In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err pa…
-
Unscored —
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() incl…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-30456.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52578.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26922.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26923.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26981.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26993.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27000.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27013.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27020.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35847.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35849.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35947.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35955.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35960.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35969.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35973.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35997.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36004.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36017.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36883.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36886.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36902.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36905.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36940.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36954.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36959.html