Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-53169: In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Clear staged_config[] before and after it is used CVE-2023-53143: In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems CVE-2023-53141: In the Linux kernel, the following vulnerability has been resolved: ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() CVE-2023-53140: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier CVE-2023-53137: In the Linux kernel, the following vulnerability has been resolved: ext4: Fix possible corruption when moving a directory CVE-2023-53136: In the Linux kernel, the following vulnerability has been resolved: af_unix: fix struct pid leaks in OOB support CVE-2023-53133: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() CVE-2023-53131: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a server shutdown leak CVE-2023-53123: In the Linux kernel, the following vulnerability has been resolved: PCI: s390: Fix use-after-free of PCI resources with per-function hotplug CVE-2023-53121: In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_make_synack() can be called from process context CVE-2023-53117: In the Linux kernel, the following vulnerability has been resolved: fs: prevent out-of-bounds array speculation when closing a file descriptor CVE-2023-53112: In the Linux kernel, the following vulnerability has been resolved: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access CVE-2023-53111: In the Linux kernel, the following vulnerability has been resolved: loop: Fix use-after-free issues CVE-2023-53109: In the Linux kernel, the following vulnerability has been resolved: net: tunnels: annotate lockless accesses to dev->needed_headroom CVE-2023-53107: In the Linux kernel, the following vulnerability has been resolved: veth: Fix use after free in XDP_REDIRECT CVE-2023-53103: In the Linux kernel, the following vulnerability has been resolved: bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails CVE-2023-53101: In the Linux kernel, the following vulnerability has been resolved: ext4: zero i_disksize when initializing the bootloader inode CVE-2023-53100: In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in ext4_update_inline_data CVE-2023-53096: In the Linux kernel, the following vulnerability has been resolved: interconnect: fix mem leak when freeing nodes CVE-2023-53095: In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix a NULL pointer dereference CVE-2023-53091: In the Linux kernel, the following vulnerability has been resolved: ext4: update s_journal_inum if it changes after journal replay CVE-2023-53089: In the Linux kernel, the following vulnerability has been resolved: ext4: fix task hung in ext4_xattr_delete_inode CVE-2023-53087: In the Linux kernel, the following vulnerability has been resolved: drm/i915/active: Fix misuse of non-idle barriers as fence trackers CVE-2023-53084: In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path CVE-2023-53081: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write CVE-2023-53075: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix invalid address access in lookup_rec() when index is 0 CVE-2023-53070: In the Linux kernel, the following vulnerability has been resolved: ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent CVE-2023-30456: An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4. CVE-2023-28466: do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). CVE-2023-2235: A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2. CVE-2022-49932: In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.21-1.45 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.21-1.45.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.21-1.45.amzn2023 |
Vulnerabilities 31
-
High 7.8
Use-after-free in Linux kernel's Performance Events subsystem
A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remo…
-
High 7.8
drm/shmem-helper: Remove another errant put in error path
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed le…
-
High 7.8
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
In the Linux kernel, the following vulnerability has been resolved: drm/i915/active: Fix misuse of non-idle barriers as fence trackers Users reported oopses on list corruptions when using i915 perf with a number of concurrently running graphics applications. …
-
High 7.8
ext4: fix WARNING in ext4_update_inline_data
In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in ext4_update_inline_data Syzbot found the following issue: EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. fscr…
-
High 7.8
veth: Fix use after free in XDP_REDIRECT
In the Linux kernel, the following vulnerability has been resolved: veth: Fix use after free in XDP_REDIRECT Commit 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb") introduced a bug where it tried to use pskb_expand_head() if t…
-
High 7.8
loop: Fix use-after-free issues
In the Linux kernel, the following vulnerability has been resolved: loop: Fix use-after-free issues do_req_filebacked() calls blk_mq_complete_request() synchronously or asynchronously when using asynchronous I/O unless memory allocation fails. Hence, modify l…
-
High 7.0
do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race con…
-
Medium 6.5
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency…
-
Unscored —
KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace Call kvm_init() only after _all_ setup is complete, as kvm_init() exposes /dev/kvm to userspace and thus allows userspa…
-
Unscored —
ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent
In the Linux kernel, the following vulnerability has been resolved: ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") enabled to map PPTT once on the first…
-
Unscored —
ftrace: Fix invalid address access in lookup_rec() when index is 0
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix invalid address access in lookup_rec() when index is 0 KASAN reported follow problem: BUG: KASAN: use-after-free in lookup_rec Read of size 8 at addr ffff000199270ff0 by task modp…
-
Unscored —
ocfs2: fix data corruption after failed write
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write When buffered write fails to copy data into underlying page cache page, ocfs2_write_end_nolock() just zeroes out and dirties the page. This can l…
-
Unscored —
ext4: fix task hung in ext4_xattr_delete_inode
In the Linux kernel, the following vulnerability has been resolved: ext4: fix task hung in ext4_xattr_delete_inode Syzbot reported a hung task problem: ================================================================== INFO: task syz-executor232:5073 blocked …
-
Unscored —
ext4: update s_journal_inum if it changes after journal replay
In the Linux kernel, the following vulnerability has been resolved: ext4: update s_journal_inum if it changes after journal replay When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we h…
-
Unscored —
drm/ttm: Fix a NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix a NULL pointer dereference The LRU mechanism may look up a resource in the process of being removed from an object. The locking rules here are a bit unclear but it looks currentl…
-
Unscored —
interconnect: fix mem leak when freeing nodes
In the Linux kernel, the following vulnerability has been resolved: interconnect: fix mem leak when freeing nodes The node link array is allocated when adding links to a node but is not deallocated when nodes are destroyed.
-
Unscored —
ext4: zero i_disksize when initializing the bootloader inode
In the Linux kernel, the following vulnerability has been resolved: ext4: zero i_disksize when initializing the bootloader inode If the boot loader inode has never been used before, the EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the i_size…
-
Unscored —
bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
In the Linux kernel, the following vulnerability has been resolved: bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails syzbot reported a warning[1] where the bond device itself is a slave and we try to enslave a non-ethernet device as the f…
-
Unscored —
net: tunnels: annotate lockless accesses to dev->needed_headroom
In the Linux kernel, the following vulnerability has been resolved: net: tunnels: annotate lockless accesses to dev->needed_headroom IP tunnels can apparently update dev->needed_headroom in their xmit path. This patch takes care of three tunnels xmit, and als…
-
Unscored —
drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access It seems that commit bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internally in UAPI format") exposed a potential…
-
Unscored —
fs: prevent out-of-bounds array speculation when closing a file descriptor
In the Linux kernel, the following vulnerability has been resolved: fs: prevent out-of-bounds array speculation when closing a file descriptor Google-Bug-Id: 114199369
-
Unscored —
tcp: tcp_make_synack() can be called from process context
In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_make_synack() can be called from process context tcp_rtx_synack() now could be called in process context as explained in 0a375c822497 ("tcp: tcp_rtx_synack() can be called from proce…
-
Unscored —
PCI: s390: Fix use-after-free of PCI resources with per-function hotplug
In the Linux kernel, the following vulnerability has been resolved: PCI: s390: Fix use-after-free of PCI resources with per-function hotplug On s390 PCI functions may be hotplugged individually even when they belong to a multi-function device. In particular o…
-
Unscored —
SUNRPC: Fix a server shutdown leak
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a server shutdown leak Fix a race where kthread_stop() may prevent the threadfn from ever getting called. If that happens the svc_rqst will not be cleaned up.
-
Unscored —
bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem: watchdog:…
-
Unscored —
af_unix: fix struct pid leaks in OOB support
In the Linux kernel, the following vulnerability has been resolved: af_unix: fix struct pid leaks in OOB support syzbot reported struct pid leak [1]. Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid. But skb->dest…
-
Unscored —CVE-2023-53137 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. T…
-
Unscored —
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
In the Linux kernel, the following vulnerability has been resolved: ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() ila_xlat_nl_cmd_get_mapping() generates an empty skb, triggerring a recent sanity check [1]. Instead, return an error code…
-
Unscored —
ext4: fix another off-by-one fsmap error on 1k block filesystems
In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_d…
-
Unscored —
x86/resctrl: Clear staged_config[] before and after it is used
In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Clear staged_config[] before and after it is used As a temporary storage, staged_config[] in rdt_domain should be cleared before and after it is used. The stale value in staged_c…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-49932.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2235.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-28466.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-30456.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53070.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53075.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53081.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53084.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53087.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53089.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53091.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53095.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53096.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53100.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53101.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53103.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53107.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53109.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53111.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53112.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53117.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53121.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53123.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53131.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53133.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53136.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53137.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53140.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53141.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53143.html