Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-52986: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener CVE-2023-52983: In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bic_set_bfqq() CVE-2023-52982: In the Linux kernel, the following vulnerability has been resolved: fscache: Use wait_on_bit() to wait for the freeing of relinquished volume CVE-2023-52981: In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix request ref counting during error capture & debugfs dump CVE-2023-52979: In the Linux kernel, the following vulnerability has been resolved: squashfs: harden sanity check in squashfs_read_xattr_id_table CVE-2023-52977: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new CVE-2023-52976: In the Linux kernel, the following vulnerability has been resolved: efi: fix potential NULL deref in efi_mem_reserve_persistent CVE-2023-52973: In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF CVE-2023-52942: In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() CVE-2023-52940: In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration CVE-2023-52939: In the Linux kernel, the following vulnerability has been resolved: mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() CVE-2023-52937: In the Linux kernel, the following vulnerability has been resolved: HV: hv_balloon: fix memory leak with using debugfs_lookup() CVE-2023-52936: In the Linux kernel, the following vulnerability has been resolved: kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() CVE-2023-52935: In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma race CVE-2023-52934: In the Linux kernel, the following vulnerability has been resolved: mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups CVE-2023-52933: In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count CVE-2023-52932: In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: add cond_resched() in get_swap_pages() CVE-2023-52931: In the Linux kernel, the following vulnerability has been resolved: drm/i915: Avoid potential vm use-after-free CVE-2023-52930: In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential bit_17 double-free CVE-2023-52928: In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrack_insn CVE-2023-52746: In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() CVE-2023-52741: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() CVE-2023-52739: In the Linux kernel, the following vulnerability has been resolved: Fix page corruption caused by racy check in __free_pages CVE-2023-3567: A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal kernel information. CVE-2023-3359: brcm_nvram_parse in drivers/nvmem/brcm_nvram.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference CVE-2023-3161: A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing a font->width and font->height greater than 32 to the fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs, leading to undefined behavior and possible denial of service. CVE-2023-1078: The upstream bug report describes this issue as follows: A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an OOB access, and a lock corruption. CVE-2022-49744: In the Linux kernel, the following vulnerability has been resolved: mm/uffd: fix pte marker when fork() without fork event CVE-2022-49743: In the Linux kernel, the following vulnerability has been resolved: ovl: Use "buf" flexible array for memcpy() destination CVE-2022-27672: It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is dynamically partitioned between non-idle threads. This allows an attacker to control speculative execution on the adjacent thread.
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.12-17.42 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.12-17.42.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.12-17.42.amzn2023 |
Vulnerabilities 30
-
Critical 9.8
cifs: Fix use-after-free in rdata->read_into_pages()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill…
-
High 7.8
A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses l…
-
High 7.8
Fix page corruption caused by racy check in __free_pages
In the Linux kernel, the following vulnerability has been resolved: Fix page corruption caused by racy check in __free_pages When we upgraded our kernel, we started seeing some page corruption like the following consistently: BUG: Bad page state in process ga…
-
High 7.8
drm/i915: Fix potential bit_17 double-free
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential bit_17 double-free A userspace with multiple threads racing I915_GEM_SET_TILING to set the tiling to I915_TILING_NONE could trigger a double free of the bit_17 bitmask…
-
High 7.8
drm/i915: Avoid potential vm use-after-free
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Avoid potential vm use-after-free Adding the vm to the vm_xa table makes it visible to userspace, which could try to race with us to close the vm. So we need to take our extra refer…
-
High 7.8
mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups
In the Linux kernel, the following vulnerability has been resolved: mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups In commit 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE") we make the following change to find_pmd_or_thp_or_none…
-
High 7.8
mm/khugepaged: fix ->anon_vma race
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma race If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, t…
-
High 7.8
vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, t…
-
High 7.8
drm/i915: Fix request ref counting during error capture & debugfs dump
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix request ref counting during error capture & debugfs dump When GuC support was added to error capture, the reference counting around the request object was broken. Fix it up. The…
-
High 7.8
block, bfq: fix uaf for bfqq in bic_set_bfqq()
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bic_set_bfqq() After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"), bic->bfqq will be accessed in bic_set_bfqq(), however, in some conte…
-
High 7.5
ovl: Use "buf" flexible array for memcpy() destination
In the Linux kernel, the following vulnerability has been resolved: ovl: Use "buf" flexible array for memcpy() destination The "buf" flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE ha…
-
High 7.1
Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
-
Medium 5.5
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height gr…
-
Medium 5.5
An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the …
-
Medium 5.5
mm/swapfile: add cond_resched() in get_swap_pages()
In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: add cond_resched() in get_swap_pages() The softlockup still occurs in get_swap_pages() under memory pressure. 64 CPU cores, 64GB memory, and 28 zram devices, the disksize of each…
-
Medium 5.5
kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make t…
-
Medium 5.5
HV: hv_balloon: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: HV: hv_balloon: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things si…
-
Medium 5.5
mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
In the Linux kernel, the following vulnerability has been resolved: mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() As commit 18365225f044 ("hwpoison, memcg: forcibly uncharge LRU pages"), hwpoison will forcibly uncharg a LRU hwpoison…
-
Medium 5.5
efi: fix potential NULL deref in efi_mem_reserve_persistent
In the Linux kernel, the following vulnerability has been resolved: efi: fix potential NULL deref in efi_mem_reserve_persistent When iterating on a linked list, a result of memremap is dereferenced without checking it for NULL. This patch adds a check that fa…
-
Medium 5.5
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is not freed when an allocation of a key fails. BUG: memory …
-
Low 2.5
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type = nla_type(nla); if (type > XFRMA_MAX) { return -EOPNOTSUPP; } @type is then used as an array index and can be…
-
Unscored —
When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thre…
-
Unscored —
mm/uffd: fix pte marker when fork() without fork event
In the Linux kernel, the following vulnerability has been resolved: mm/uffd: fix pte marker when fork() without fork event Patch series "mm: Fixes on pte markers". Patch 1 resolves the syzkiller report from Pengfei. Patch 2 further harden pte markers when use…
-
Unscored —
bpf: Skip invalid kfunc call in backtrack_insn
In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrack_insn The verifier skips invalid kfunc call in check_kfunc_call(), which would be captured in fixup_kfunc_call() if such insn is not eliminated by dea…
-
Unscored —
Squashfs: fix handling and sanity checking of xattr_ids count
In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem.…
-
Unscored —
mm: multi-gen LRU: fix crash during cgroup migration
In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself. This isn't true for the following scenario: CPU 1 CPU 2 clone() cgroup…
-
Unscored —
cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() It was found that the check to see if a partition could use up all the cpus from the parent cpuset in update_parent_subparts…
-
Unscored —CVE-2023-52979 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
fscache: Use wait_on_bit() to wait for the freeing of relinquished volume
In the Linux kernel, the following vulnerability has been resolved: fscache: Use wait_on_bit() to wait for the freeing of relinquished volume The freeing of relinquished volume will wake up the pending volume acquisition by using wake_up_bit(), however it is …
-
Unscored —
bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener A listening socket linked to a sockmap has its sk_prot overridden. It points to one of the struct proto variants in tcp_bp…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-27672.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49743.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49744.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1078.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3161.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3359.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3567.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52739.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52741.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52746.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52928.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52930.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52931.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52932.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52933.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52934.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52935.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52936.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52937.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52939.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52940.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52942.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52973.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52976.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52977.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52979.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52981.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52982.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52983.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52986.html