Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-42232: In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() CVE-2024-42148: In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds CVE-2024-42145: In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List CVE-2024-42106: In the Linux kernel, the following vulnerability has been resolved: inet_diag: Initialize pad field in struct inet_diag_req_v2 CVE-2024-42105: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix inode number range checks CVE-2024-42104: In the Linux kernel, the following vulnerability has been resolved: nilfs2: add missing check for inode numbers on directory entries CVE-2024-42102: In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" CVE-2024-42101: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes CVE-2024-42084: In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset CVE-2024-41097: In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() CVE-2024-41081: In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() CVE-2024-41059: In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name CVE-2024-41044: In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets CVE-2024-41035: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor CVE-2024-41034: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory CVE-2024-41020: In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path CVE-2024-41012: In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected CVE-2024-40988: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c CVE-2024-40984: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." CVE-2024-40901: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory CVE-2024-39487: In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() CVE-2024-36484: In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.352-267.564 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.352-267.564.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.352-267.564.amzn2 |
Vulnerabilities 22
-
Critical 9.8
ila: block BH in ila_output()
In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is c…
-
Critical 9.8
libceph: fix race between delayed_work() and ceph_monc_stop()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Bo…
-
High 7.8
ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel i…
-
High 7.8
filelock: Remove locks reliably when fcntl/close race is detected
In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the firs…
-
High 7.8
filelock: Fix fcntl/close race recovery compat path
In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies …
-
High 7.8
nilfs2: fix kernel bug on rename operation of broken directory
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare bl…
-
High 7.8
hfsplus: fix uninit-value in copy_name
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 hfsplus_lis…
-
High 7.8
nilfs2: add missing check for inode numbers on directory entries
In the Linux kernel, the following vulnerability has been resolved: nilfs2: add missing check for inode numbers on directory entries Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free …
-
High 7.8
nilfs2: fix inode number range checks
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix inode number range checks Patch series "nilfs2: fix potential issues related to reserved inodes". This series fixes one use-after-free issue reported by syzbot, caused by nilfs2's…
-
High 7.5
IB/core: Implement a limit on UMAD receive List
In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List The existing behavior of ib_umad, which maintains received MAD packets in an unbounded list, poses a risk of uncontrolled growth. As user-space…
-
High 7.3
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions …
-
High 7.1
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte…
-
Unscored —
net: relax socket state check at accept time.
In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. Christoph reported the following splat: WARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0 Modules linked in: CPU: 1 PI…
-
Unscored —
drm/radeon: fix UBSAN warning in kv_dpm.c
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry.
-
Unscored —
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved…
-
Unscored —
ppp: reject claimed-as-LCP but actually malformed packets
In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP p…
-
Unscored —
usb: atm: cxacru: fix endpoint checking in cxacru_bind()
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpo…
-
Unscored —
ftruncate: pass a signed offset
In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative…
-
Unscored —
drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes In nouveau_connector_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a p…
-
Unscored —
Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in …
-
Unscored —
inet_diag: Initialize pad field in struct inet_diag_req_v2
In the Linux kernel, the following vulnerability has been resolved: inet_diag: Initialize pad field in struct inet_diag_req_v2 KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw sockets uses the pad field in struct inet_diag_req_v2 for the u…
-
Unscored —
bnx2x: Fix multiple UBSAN array-index-out-of-bounds
In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36484.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39487.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40901.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40984.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40988.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41012.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41020.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41034.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41035.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41044.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41059.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41081.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41097.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42084.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42101.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42102.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42104.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42105.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42106.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42145.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42148.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42232.html