Skip to content
OpenAdvisories
High ALAS2-2025-2745 7 CVEs

Important: kernel security update (Amazon Linux 2)

Published Jan 30, 2025 · Updated Feb 4, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-50230: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag CVE-2024-50067: In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args CVE-2024-49936: In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvif_flush_hash() CVE-2024-49884: In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4_split_extent_at() CVE-2024-47742: In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal CVE-2024-47701: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem CVE-2024-26852: In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify()

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.355-275.582.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.355-275.582.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.355-275.582.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.355-275.582.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.355-275.582.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.355-275.582.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.355-275.582 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.355-275.582.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.355-275.582.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.355-275.582.amzn2
Amazon Linux · 2 perf 0:4.14.355-275.582.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.355-275.582.amzn2
Amazon Linux · 2 python-perf 0:4.14.355-275.582.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.355-275.582.amzn2

Vulnerabilities 7

  • High 8.8
    CVE-2024-49936

    net/xen-netback: prevent UAF in xenvif_flush_hash()

    In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvif_flush_hash() During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-26852

    net/ipv6: avoid possible UAF in ip6_route_mpath_notify()

    In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_rout…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-47701

    ext4: avoid OOB when system.data xattr changes underneath the filesystem

    In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem When looking up for an entry in an inlined directory, if e_value_offs is changed underneath the filesystem by some cha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-47742

    firmware_loader: Block path traversal

    In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-49884

    ext4: fix slab-use-after-free in ext4_split_extent_at()

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4_split_extent_at() We hit the following use-after-free: ================================================================== BUG: KASAN: slab-use-after-free…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-50067

    uprobe: avoid out-of-bounds memory access of fetching args

    In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-sp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-50230

    nilfs2: fix kernel bug due to missing clearing of checked flag

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-26852.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47701.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47742.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-49884.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-49936.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-50067.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-50230.html