Skip to content
OpenAdvisories
Medium 1 exploited CVE ALAS2-2024-2622 13 CVEs

Moderate: kernel security update (Amazon Linux 2)

Published Aug 14, 2024 · Updated Oct 2, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-42090: In the Linux kernel, the following vulnerability has been resolved: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER CVE-2024-42070: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers CVE-2024-40959: In the Linux kernel, the following vulnerability has been resolved: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() CVE-2024-40904: In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages CVE-2024-39509: In the Linux kernel, the following vulnerability has been resolved: HID: core: remove unnecessary WARN_ON() in implement() CVE-2024-39499: In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() CVE-2024-39469: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors CVE-2024-38619: In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized CVE-2024-37078: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting CVE-2024-36971: In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race CVE-2022-49344: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). CVE-2022-3567: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier assigned to this vulnerability. CVE-2022-3566: A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this vulnerability.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.350-266.564.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.350-266.564.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.350-266.564.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.350-266.564.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.350-266.564.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.350-266.564.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.350-266.564 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.350-266.564.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.350-266.564.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.350-266.564.amzn2
Amazon Linux · 2 perf 0:4.14.350-266.564.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.350-266.564.amzn2
Amazon Linux · 2 python-perf 0:4.14.350-266.564.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.350-266.564.amzn2

Vulnerabilities 13

  • High 7.8
    CVE-2024-36971 Exploited Public exploit

    net: fix __dst_negative_advice() race

    In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Aug 7, 2024
  • High 7.8
    CVE-2024-37078

    nilfs2: fix potential kernel bug due to lack of writeback flag waiting

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2024-39469

    nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implement…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 4.7
    CVE-2022-49344

    af_unix: Fix a data-race in unix_dgram_peer_wake_me().

    In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). unix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s lock held and check if its receive queue is full. Here we need to us…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 4.6
    CVE-2022-3566

    Linux Kernel TCP tcp_setsockopt race condition

    A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated wit…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 4.6
    CVE-2022-3567

    Linux Kernel IPv6 inet6_dgram_ops race condition

    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch …

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-38619

    usb-storage: alauda: Check whether the media is initialized

    In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alaud…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-39499

    vmci: prevent speculation leaks by sanitizing event in event_deliver()

    In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-39509

    HID: core: remove unnecessary WARN_ON() in implement()

    In the Linux kernel, the following vulnerability has been resolved: HID: core: remove unnecessary WARN_ON() in implement() Syzkaller hit a warning [1] in a call to implement() when trying to write a value into a field of smaller size in an output report. Sinc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-40904

    USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages

    In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-40959

    xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()

    In the Linux kernel, the following vulnerability has been resolved: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() ip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly. syzbot reported: Oops: general protection fault, probably…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-42070

    netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VAL…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-42090

    pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-3566.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-3567.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-49344.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-36971.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-37078.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-38619.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39469.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39499.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39509.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-40904.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-40959.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-42070.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-42090.html