Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-54265: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix an uninit variable access bug in __ip6_make_skb() CVE-2023-54202: In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl CVE-2023-54176: In the Linux kernel, the following vulnerability has been resolved: mptcp: stricter state check in mptcp_worker CVE-2023-54128: In the Linux kernel, the following vulnerability has been resolved: fs: drop peer group ids under namespace lock CVE-2023-54041: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix memory leak when removing provided buffers CVE-2023-54003: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix GID entry ref leak when create_ah fails CVE-2023-53987: In the Linux kernel, the following vulnerability has been resolved: ping: Fix potentail NULL deref for /proc/net/icmp. CVE-2023-53824: In the Linux kernel, the following vulnerability has been resolved: netlink: annotate lockless accesses to nlk->max_recvmsg_len CVE-2023-53680: In the Linux kernel, the following vulnerability has been resolved: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL CVE-2023-53634: In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fixed a BTI error on returning to patched function CVE-2023-53623: In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() CVE-2023-53525: In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Allow UD qp_type to join multicast only CVE-2023-53522: In the Linux kernel, the following vulnerability has been resolved: cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex CVE-2023-53375: In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances CVE-2023-53372: In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip CVE-2023-53296: In the Linux kernel, the following vulnerability has been resolved: sctp: check send stream number after wait_for_sndbuf CVE-2023-53273: In the Linux kernel, the following vulnerability has been resolved: Drivers: vmbus: Check for channel allocation before looking up relids CVE-2023-53241: In the Linux kernel, the following vulnerability has been resolved: nfsd: call op_release, even when op_func returns an error CVE-2023-53198: In the Linux kernel, the following vulnerability has been resolved: raw: Fix NULL deref in raw_get_next(). CVE-2023-53188: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix race on port output CVE-2023-53186: In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releasing SKBs CVE-2023-2124: An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.25-37.47 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.25-37.47.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.25-37.47.amzn2023 |
Vulnerabilities 22
-
High 8.2
sctp: fix a potential overflow in sctp_ifwdtsn_skip
In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data le…
-
High 8.1
skbuff: Fix a race between coalescing and releasing SKBs
In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releasing SKBs Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment recycling") allowed coalescing to proceed with non page pool page …
-
High 7.8
netlink: annotate lockless accesses to nlk->max_recvmsg_len
In the Linux kernel, the following vulnerability has been resolved: netlink: annotate lockless accesses to nlk->max_recvmsg_len syzbot reported a data-race in data-race in netlink_recvmsg() [1] Indeed, netlink_recvmsg() can be run concurrently, and netlink_du…
-
High 7.8
fs: drop peer group ids under namespace lock
In the Linux kernel, the following vulnerability has been resolved: fs: drop peer group ids under namespace lock When cleaning up peer group ids in the failure path we need to make sure to hold on to the namespace lock. Otherwise another thread might just tur…
-
High 7.8
drm/i915: fix race condition UAF in i915_perf_add_config_ioctl
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if …
-
High 7.5
NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
In the Linux kernel, the following vulnerability has been resolved: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are car…
-
Medium 5.5
nfsd: call op_release, even when op_func returns an error
In the Linux kernel, the following vulnerability has been resolved: nfsd: call op_release, even when op_func returns an error For ops with "trivial" replies, nfsd4_encode_operation will shortcut most of the encoding work and skip to just marshalling up the st…
-
Medium 5.5
Drivers: vmbus: Check for channel allocation before looking up relids
In the Linux kernel, the following vulnerability has been resolved: Drivers: vmbus: Check for channel allocation before looking up relids relid2channel() assumes vmbus channel array to be allocated when called. However, in cases such as kdump/kexec, not all r…
-
Medium 5.5
sctp: check send stream number after wait_for_sndbuf
In the Linux kernel, the following vulnerability has been resolved: sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the client starts…
-
Medium 5.5
tracing: Free error logs of tracing instances
In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a …
-
Unscored —
An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image…
-
Unscored —
net: openvswitch: fix race on port output
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix race on port output assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows 2. two network namespaces "server" and "…
-
Unscored —
raw: Fix NULL deref in raw_get_next().
In the Linux kernel, the following vulnerability has been resolved: raw: Fix NULL deref in raw_get_next(). Dae R. Jeong reported a NULL deref in raw_get_next() [0]. It seems that the repro was running these sequences in parallel so that one thread was iterati…
-
Unscored —
cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex
In the Linux kernel, the following vulnerability has been resolved: cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex syzbot is reporting circular locking dependency between cpu_hotplug_lock and freezer_mutex, for commit f5d39b020809 ("freezer,sched:…
-
Unscored —
RDMA/cma: Allow UD qp_type to join multicast only
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Allow UD qp_type to join multicast only As for multicast: - The SIDR is the only mode that makes sense; - Besides PS_UDP, other port spaces like PS_IB is also allowed, as it is UD c…
-
Unscored —
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lock must be held when deleting the si from the available list. Otherwise, another thread can re-add the si to …
-
Unscored —
bpf, arm64: Fixed a BTI error on returning to patched function
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fixed a BTI error on returning to patched function When BPF_TRAMP_F_CALL_ORIG is set, BPF trampoline uses BLR to jump back to the instruction next to call site to call the patched…
-
Unscored —
ping: Fix potentail NULL deref for /proc/net/icmp.
In the Linux kernel, the following vulnerability has been resolved: ping: Fix potentail NULL deref for /proc/net/icmp. After commit dbca1596bbb0 ("ping: convert to RCU lookups, get rid of rwlock"), we use RCU for ping sockets, but we should use spinlock for /…
-
Unscored —
RDMA/core: Fix GID entry ref leak when create_ah fails
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix GID entry ref leak when create_ah fails If AH create request fails, release sgid_attr to avoid GID entry referrence leak reported while releasing GID table
-
Unscored —
io_uring: fix memory leak when removing provided buffers
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix memory leak when removing provided buffers When removing provided buffers, io_buffer structs are not being disposed of, leading to a memory leak. They can't be freed individuall…
-
Unscored —
mptcp: stricter state check in mptcp_worker
In the Linux kernel, the following vulnerability has been resolved: mptcp: stricter state check in mptcp_worker As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state: connect() // incoming reset…
-
Unscored —
ipv6: Fix an uninit variable access bug in __ip6_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix an uninit variable access bug in __ip6_make_skb() Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in arch_atomic64…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2124.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53186.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53188.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53198.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53241.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53273.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53296.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53372.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53375.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53522.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53525.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53623.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53634.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53680.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53824.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53987.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54003.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54041.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54128.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54176.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54202.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54265.html