Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-35944: In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() CVE-2024-35936: In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() CVE-2024-35935: In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() CVE-2024-35930: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() CVE-2024-35925: In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in blk_rq_stat_sum() CVE-2024-35910: In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets CVE-2024-35815: In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion CVE-2024-35809: In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal CVE-2024-27059: In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command CVE-2024-26976: In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed CVE-2024-26973: In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles CVE-2024-26956: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings CVE-2024-26955: In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent kernel bug at submit_bh_wbc() CVE-2024-26934: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() CVE-2024-26931: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull CVE-2024-26642: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag CVE-2024-25739: create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size. CVE-2023-53820: In the Linux kernel, the following vulnerability has been resolved: loop: loop_set_status_from_info() check before assignment CVE-2023-52620: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets CVE-2022-48627: In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.345-262.561 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.345-262.561.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.345-262.561.amzn2 |
Vulnerabilities 20
-
High 8.8
scsi: qla2xxx: Fix command flush on cable pull
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 …
-
High 7.8
netfilter: nf_tables: disallow timeout for anonymous sets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.
-
High 7.8
netfilter: nf_tables: disallow anonymous set with timeout flag
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy …
-
High 7.8
KVM: Always flush async #PF workqueue when vCPU is being destroyed
In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs…
-
High 7.8
tcp: properly terminate timers for kernel sockets
In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigge…
-
Medium 5.5
vt: fix memory overlapping when deleting chars in the buffer
In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpy…
-
Medium 5.5
create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and c…
-
Medium 5.5
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". This resolves a kernel BUG reported by syzbot. Since there …
-
Medium 5.5
PCI/PM: Drain runtime-idle callbacks before driver removal
In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash …
-
Unscored —
loop: loop_set_status_from_info() check before assignment
In the Linux kernel, the following vulnerability has been resolved: loop: loop_set_status_from_info() check before assignment In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow erro…
-
Unscored —
USB: core: Fix deadlock in usb_deauthorize_interface()
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which …
-
Unscored —
nilfs2: prevent kernel bug at submit_bh_wbc()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent kernel bug at submit_bh_wbc() Fix a bug where nilfs_get_block() returns a successful status when searching and inserting the specified block both fail inconsistently. If this …
-
Unscored —
fat: fix uninitialized field in nostale filehandles
In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of t…
-
Unscored —
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and he…
-
Unscored —
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion The first kiocb_set_cancel_fn() argument may point at a struct kiocb that is not embedded inside struct aio_kiocb. With the cu…
-
Unscored —
block: prevent division by zero in blk_rq_stat_sum()
In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in blk_rq_stat_sum() The expression dst->nr_samples + src->nr_samples may have zero value on overflow. It is necessary to add a check to avoid division by zero…
-
Unscored —
scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an unsuccessful status. In such cases, the elsiocb is not issued, …
-
Unscored —
btrfs: send: handle path ref underflow in header iterate_inode_ref()
In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't acciden…
-
Unscored —
btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible condi…
-
Unscored —
VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-48627.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52620.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53820.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-25739.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26642.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26931.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26934.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26955.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26956.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26973.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26976.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27059.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35809.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35815.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35910.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35925.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35930.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35935.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35936.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35944.html