Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-53224: In the Linux kernel, the following vulnerability has been resolved: ext4: Fix function prototype mismatch for ext4_feat_ktype CVE-2023-52737: In the Linux kernel, the following vulnerability has been resolved: btrfs: lock the inode in shared mode before starting fiemap CVE-2023-52735: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself CVE-2023-52732: In the Linux kernel, the following vulnerability has been resolved: ceph: blocklist the kclient when receiving corrupted snap trace CVE-2023-52731: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix invalid page access after closing deferred I/O devices CVE-2023-52707: In the Linux kernel, the following vulnerability has been resolved: sched/psi: Fix use-after-free in ep_remove_wait_queue() CVE-2023-52704: In the Linux kernel, the following vulnerability has been resolved: freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL CVE-2023-52702: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() CVE-2023-52701: In the Linux kernel, the following vulnerability has been resolved: net: use a bounce buffer for copying skb->mark CVE-2023-52646: In the Linux kernel, the following vulnerability has been resolved: aio: fix mremap after fork null-deref CVE-2023-26545: In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. CVE-2023-1281: Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. CVE-2023-0458: Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as well as insufficient hardening of the usercopy functions against spectre-v1. CVE-2022-2196: A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.15-28.43 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.15-28.43.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.15-28.43.amzn2023 |
Vulnerabilities 14
-
Critical 9.8
ceph: blocklist the kclient when receiving corrupted snap trace
In the Linux kernel, the following vulnerability has been resolved: ceph: blocklist the kclient when receiving corrupted snap trace When received corrupted snap trace we don't know what exactly has happened in MDS side. And we shouldn't continue IOs and metad…
-
Critical 9.1
bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself sock_map proto callbacks should never call themselves by design. Protect against bugs like [1] and break out of the recursi…
-
High 7.8CVE-2023-1281 Public exploit
UAF in Linux kernel's tcindex (traffic control index filter) implementation
Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the d…
-
High 7.8
freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL
In the Linux kernel, the following vulnerability has been resolved: freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL Tetsuo-San noted that commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic") broke call_usermodehelper_exec() for the KILLAB…
-
High 7.8
sched/psi: Fix use-after-free in ep_remove_wait_queue()
In the Linux kernel, the following vulnerability has been resolved: sched/psi: Fix use-after-free in ep_remove_wait_queue() If a non-root cgroup gets removed when there is a thread that registered trigger and is polling on a pressure file within the cgroup, t…
-
High 7.8
fbdev: Fix invalid page access after closing deferred I/O devices
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix invalid page access after closing deferred I/O devices When a fbdev with deferred I/O is once opened and closed, the dirty pages still remain queued in the pageref list, and eventu…
-
Medium 5.8
Speculative execution attacks in KVM VMX
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support…
-
Medium 5.5
ext4: Fix function prototype mismatch for ext4_feat_ktype
In the Linux kernel, the following vulnerability has been resolved: ext4: Fix function prototype mismatch for ext4_feat_ktype With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected functio…
-
Medium 5.3
Spectre V1 Gadget in do_prlimit in the Linux Kernel
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
-
Unscored —
aio: fix mremap after fork null-deref
In the Linux kernel, the following vulnerability has been resolved: aio: fix mremap after fork null-deref Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced a null-deref if mremap is called on an old aio mapping after fork as mm->ioctx…
-
Unscored —
net: use a bounce buffer for copying skb->mark
In the Linux kernel, the following vulnerability has been resolved: net: use a bounce buffer for copying skb->mark syzbot found arm64 builds would crash in sock_recv_mark() when CONFIG_HARDENED_USERCOPY=y x86 and powerpc are not detecting the issue because th…
-
Unscored —
net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() old_meter needs to be free after it is detached regardless of whether the new meter is successfully attached.
-
Unscored —
btrfs: lock the inode in shared mode before starting fiemap
In the Linux kernel, the following vulnerability has been resolved: btrfs: lock the inode in shared mode before starting fiemap Currently fiemap does not take the inode's lock (VFS lock), it only locks a file range in the inode's io tree. This however can lea…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2196.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0458.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1281.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-26545.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52646.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52701.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52702.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52704.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52707.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52731.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52732.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52735.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52737.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53224.html