Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-47495: In the Linux kernel, the following vulnerability has been resolved: usbnet: sanity check for maxpacket CVE-2021-47483: In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() CVE-2021-47480: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Put LLD module refcnt after SCSI device is released CVE-2021-47478: In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image CVE-2021-47460: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after conversion from inline format CVE-2021-47203: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() CVE-2021-47189: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory ordering between normal and ordered work functions CVE-2021-47185: In the Linux kernel, the following vulnerability has been resolved: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc CVE-2021-47184: In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr dereference on VSI filter sync CVE-2021-4002: A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data. CVE-2021-3772: A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. CVE-2021-3640: A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.256-197.484 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.256-197.484.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.256-197.484.amzn2 |
Vulnerabilities 12
-
Critical 9.1
isofs: Fix out of bound access for corrupted isofs image
In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer. Sanity-check the directory entry len…
-
High 8.8
i40e: Fix NULL ptr dereference on VSI filter sync
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr dereference on VSI filter sync Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of V…
-
High 8.8
scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a l…
-
High 7.8
btrfs: fix memory ordering between normal and ordered work functions
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory ordering between normal and ordered work functions Ordered work functions aren't guaranteed to be handled by the same thread which executed the normal work functions. The on…
-
High 7.8
regmap: Fix possible double-free in regcache_rbtree_exit()
In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will b…
-
Medium 4.4
tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
In the Linux kernel, the following vulnerability has been resolved: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, which look like this one: Workqueue…
-
Unscored —
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls …
-
Unscored —
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through inv…
-
Unscored —
A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…
-
Unscored —
ocfs2: fix data corruption after conversion from inline format
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after conversion from inline format Commit 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") uncovered a latent bug in ocfs2 conversion …
-
Unscored —
scsi: core: Put LLD module refcnt after SCSI device is released
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Put LLD module refcnt after SCSI device is released SCSI host release is triggered when SCSI device is freed. We have to make sure that the low-level device driver module won't be…
-
Unscored —
usbnet: sanity check for maxpacket
In the Linux kernel, the following vulnerability has been resolved: usbnet: sanity check for maxpacket maxpacket of 0 makes no sense and oopses as we need to divide by it. Give up. V2: fixed typo in log and stylistic issues
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-3640.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-3772.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-4002.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47184.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47185.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47189.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47203.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47460.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47478.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47480.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47483.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47495.html