Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-47669: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix state management in error path of log writing function CVE-2024-46840: In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete CVE-2024-46829: In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling CVE-2024-46800: In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue CVE-2024-46781: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix missing cleanup on rollforward recovery error CVE-2024-46780: In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect references to superblock parameters exposed in sysfs CVE-2024-46759: In the Linux kernel, the following vulnerability has been resolved: hwmon: (adc128d818) Fix underflows seen when writing limit attributes CVE-2024-46750: In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock() CVE-2024-46745: In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots CVE-2024-46744: In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size CVE-2024-46743: In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk CVE-2024-46738: In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() CVE-2024-45021: In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops CVE-2024-45008: In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots CVE-2024-44987: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() CVE-2024-44947: In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate CVE-2024-43854: In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media CVE-2024-43853: In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Prevent UAF in proc_cpuset_show()
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.355-271.569 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.355-271.569.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.355-271.569.amzn2 |
Vulnerabilities 18
-
High 7.8
ipv6: prevent UAF in ip6_send_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A …
-
High 7.8
VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resour…
-
High 7.8
PCI: Add missing bridge lock to pci_bus_lock()
In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock() One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886…
-
High 7.8
nilfs2: protect references to superblock parameters exposed in sysfs
In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect references to superblock parameters exposed in sysfs The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regul…
-
High 7.8
nilfs2: fix missing cleanup on rollforward recovery error
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix missing cleanup on rollforward recovery error In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recover…
-
High 7.8
sch/netem: fix use after free in netem_dequeue
In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog(…
-
High 7.3
of/irq: Prevent device address out-of-bounds read in interrupt map walk
In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells pr…
-
High 7.3
nilfs2: fix state management in error path of log writing function
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix state management in error path of log writing function After commit a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") was applied, the log writing function …
-
High 7.1
memcg_write_event_control(): fix a user-triggerable oops
In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).
-
High 7.0
cgroup/cpuset: Prevent UAF in proc_cpuset_show()
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Prevent UAF in proc_cpuset_show() An UAF can happen when /proc/cpuset is read as reported in [1]. This can be reproduced by the following methods: 1.add an mdelay(1000) before …
-
Unscored —
block: initialize integrity buffer to zero before writing it to media
In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For…
-
Unscored —CVE-2024-44947 Public exploit
fuse: Initialize beyond-EOF page contents before setting uptodate
In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page c…
-
Unscored —
Input: MT - limit max slots
In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible…
-
Unscored —
Squashfs: sanity check symbolic link size
In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbol…
-
Unscored —
Input: uinput - reject requests with unreasonable number of slots
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory…
-
Unscored —
hwmon: (adc128d818) Fix underflows seen when writing limit attributes
In the Linux kernel, the following vulnerability has been resolved: hwmon: (adc128d818) Fix underflows seen when writing limit attributes DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is pr…
-
Unscored —
rtmutex: Drop rt_mutex::wait_lock before scheduling
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case…
-
Unscored —
btrfs: clean up our handling of refs == 0 in snapshot delete
In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transi…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-43853.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-43854.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44947.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44987.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45008.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45021.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46738.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46743.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46744.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46745.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46750.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46759.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46780.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46781.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46800.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46829.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46840.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-47669.html