Skip to content
OpenAdvisories
High ALAS2-2025-2909 11 CVEs

Important: kernel security update (Amazon Linux 2)

Published Jun 27, 2025 · Updated Jul 29, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-53143: In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems CVE-2023-53141: In the Linux kernel, the following vulnerability has been resolved: ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() CVE-2023-53125: In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len CVE-2023-53121: In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_make_synack() can be called from process context CVE-2023-53117: In the Linux kernel, the following vulnerability has been resolved: fs: prevent out-of-bounds array speculation when closing a file descriptor CVE-2023-53116: In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() CVE-2023-53109: In the Linux kernel, the following vulnerability has been resolved: net: tunnels: annotate lockless accesses to dev->needed_headroom CVE-2023-53101: In the Linux kernel, the following vulnerability has been resolved: ext4: zero i_disksize when initializing the bootloader inode CVE-2023-53100: In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in ext4_update_inline_data CVE-2023-53089: In the Linux kernel, the following vulnerability has been resolved: ext4: fix task hung in ext4_xattr_delete_inode CVE-2023-53075: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix invalid address access in lookup_rec() when index is 0

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.311-233.529.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.311-233.529.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.311-233.529.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.311-233.529.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.311-233.529.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.311-233.529.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.311-233.529 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.311-233.529.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.311-233.529.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.311-233.529.amzn2
Amazon Linux · 2 perf 0:4.14.311-233.529.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.311-233.529.amzn2
Amazon Linux · 2 python-perf 0:4.14.311-233.529.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.311-233.529.amzn2

Vulnerabilities 11

  • Critical 9.8
    CVE-2023-53116

    nvmet: avoid potential UAF in nvmet_req_complete()

    In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53100

    ext4: fix WARNING in ext4_update_inline_data

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in ext4_update_inline_data Syzbot found the following issue: EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. fscr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53075

    ftrace: Fix invalid address access in lookup_rec() when index is 0

    In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix invalid address access in lookup_rec() when index is 0 KASAN reported follow problem: BUG: KASAN: use-after-free in lookup_rec Read of size 8 at addr ffff000199270ff0 by task modp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53089

    ext4: fix task hung in ext4_xattr_delete_inode

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix task hung in ext4_xattr_delete_inode Syzbot reported a hung task problem: ================================================================== INFO: task syz-executor232:5073 blocked …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53101

    ext4: zero i_disksize when initializing the bootloader inode

    In the Linux kernel, the following vulnerability has been resolved: ext4: zero i_disksize when initializing the bootloader inode If the boot loader inode has never been used before, the EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the i_size…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53109

    net: tunnels: annotate lockless accesses to dev->needed_headroom

    In the Linux kernel, the following vulnerability has been resolved: net: tunnels: annotate lockless accesses to dev->needed_headroom IP tunnels can apparently update dev->needed_headroom in their xmit path. This patch takes care of three tunnels xmit, and als…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53117

    fs: prevent out-of-bounds array speculation when closing a file descriptor

    In the Linux kernel, the following vulnerability has been resolved: fs: prevent out-of-bounds array speculation when closing a file descriptor Google-Bug-Id: 114199369

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53121

    tcp: tcp_make_synack() can be called from process context

    In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_make_synack() can be called from process context tcp_rtx_synack() now could be called in process context as explained in 0a375c822497 ("tcp: tcp_rtx_synack() can be called from proce…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53125

    net: usb: smsc75xx: Limit packet length to skb->len

    In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53141

    ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()

    In the Linux kernel, the following vulnerability has been resolved: ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() ila_xlat_nl_cmd_get_mapping() generates an empty skb, triggerring a recent sanity check [1]. Instead, return an error code…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53143

    ext4: fix another off-by-one fsmap error on 1k block filesystems

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53075.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53089.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53100.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53101.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53109.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53116.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53117.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53121.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53125.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53141.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53143.html