Skip to content
OpenAdvisories
Medium ALAS2-2024-2698 8 CVEs

Moderate: kernel security update (Amazon Linux 2)

Published Nov 8, 2024 · Updated Dec 5, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-41097: In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() CVE-2024-41059: In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name CVE-2024-41035: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor CVE-2024-41034: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory CVE-2024-41020: In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path CVE-2024-40988: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c CVE-2024-40984: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." CVE-2024-36484: In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.352-267.564.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.352-267.564.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.352-267.564.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.352-267.564.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.352-267.564.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.352-267.564.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.352-267.564 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.352-267.564.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.352-267.564.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.352-267.564.amzn2
Amazon Linux · 2 perf 0:4.14.352-267.564.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.352-267.564.amzn2
Amazon Linux · 2 python-perf 0:4.14.352-267.564.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.352-267.564.amzn2

Vulnerabilities 8

  • High 7.8
    CVE-2024-40984

    ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."

    In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-41020

    filelock: Fix fcntl/close race recovery compat path

    In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-41034

    nilfs2: fix kernel bug on rename operation of broken directory

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare bl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-41059

    hfsplus: fix uninit-value in copy_name

    In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 hfsplus_lis…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-36484

    net: relax socket state check at accept time.

    In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. Christoph reported the following splat: WARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0 Modules linked in: CPU: 1 PI…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-40988

    drm/radeon: fix UBSAN warning in kv_dpm.c

    In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-41035

    USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor

    In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-41097

    usb: atm: cxacru: fix endpoint checking in cxacru_bind()

    In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-36484.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-40984.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-40988.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-41020.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-41034.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-41035.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-41059.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-41097.html