Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-54269: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use CVE-2023-54268: In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fill_pool() CVE-2023-54244: In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: Fix oops when removing custom query handlers CVE-2023-54242: In the Linux kernel, the following vulnerability has been resolved: block, bfq: Fix division by zero error on zero wsum CVE-2023-54226: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data races around sk->sk_shutdown. CVE-2023-54218: In the Linux kernel, the following vulnerability has been resolved: net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). CVE-2023-54200: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always release netdev hooks from notifier CVE-2023-54184: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free CVE-2023-54160: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_sdei: Fix sleep from invalid context BUG CVE-2023-54157: In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of alloc->vma in race with munmap() CVE-2023-54116: In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-generic: prohibit potential out-of-bounds access CVE-2023-54114: In the Linux kernel, the following vulnerability has been resolved: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() CVE-2023-54086: In the Linux kernel, the following vulnerability has been resolved: bpf: Add preempt_count_{sub,add} into btf id deny list CVE-2023-54033: In the Linux kernel, the following vulnerability has been resolved: bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps CVE-2023-54021: In the Linux kernel, the following vulnerability has been resolved: ext4: set goal start correctly in ext4_mb_normalize_request CVE-2023-54012: In the Linux kernel, the following vulnerability has been resolved: net: fix stack overflow when LRO is disabled for virtual interfaces CVE-2023-54004: In the Linux kernel, the following vulnerability has been resolved: udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). CVE-2023-53853: In the Linux kernel, the following vulnerability has been resolved: netlink: annotate accesses to nlk->cb_running CVE-2023-53833: In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state CVE-2023-53747: In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF CVE-2023-53716: In the Linux kernel, the following vulnerability has been resolved: net: fix skb leak in __skb_tstamp_tx() CVE-2023-53705: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() CVE-2023-53685: In the Linux kernel, the following vulnerability has been resolved: tun: Fix memory leak for detached NAPI queue. CVE-2023-53620: In the Linux kernel, the following vulnerability has been resolved: md: fix soft lockup in status_resync CVE-2023-53576: In the Linux kernel, the following vulnerability has been resolved: null_blk: Always check queue mode setting from configfs CVE-2023-53566: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix null deref on element insertion CVE-2023-53513: In the Linux kernel, the following vulnerability has been resolved: nbd: fix incomplete validation of ioctl arg CVE-2023-53503: In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4_get_group_info() to fail CVE-2023-53499: In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix error unwinding of XDP initialization CVE-2023-53484: In the Linux kernel, the following vulnerability has been resolved: lib: cpu_rmap: Avoid use after free on rmap->obj array entries CVE-2023-53483: In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() CVE-2023-53439: In the Linux kernel, the following vulnerability has been resolved: net: skb_partial_csum_set() fix against transport header magic value CVE-2023-53433: In the Linux kernel, the following vulnerability has been resolved: net: add vlan_get_protocol_and_depth() helper CVE-2023-53419: In the Linux kernel, the following vulnerability has been resolved: rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access CVE-2023-53383: In the Linux kernel, the following vulnerability has been resolved: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 CVE-2023-53182: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid undefined behavior: applying zero offset to null pointer CVE-2023-53178: In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition CVE-2023-53176: In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Reinit port->pm on port specific driver unbind CVE-2023-35788: An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. CVE-2023-3567: A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal kernel information. CVE-2023-3090: A heap out-of-bounds write vulnerabi
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.34-56.100 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.34-56.100.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.34-56.100.amzn2023 |
Vulnerabilities 44
-
Critical 9.8
scsi: target: iscsit: Free cmds before session free
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call …
-
Critical 9.8
SUNRPC: double free xprt_ctxt while still in use
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is…
-
High 8.2
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on be…
-
High 7.8
android: binder: stop saving a pointer to the VMA
In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of failure paths *after* the r…
-
High 7.8
Out-of-bounds write in Linux kernel's ipvlan network driver
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is r…
-
High 7.8CVE-2023-35788 Public exploit
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an o…
-
High 7.8
serial: 8250: Reinit port->pm on port specific driver unbind
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Reinit port->pm on port specific driver unbind When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see a…
-
High 7.8
mm: fix zswap writeback race condition
In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was wri…
-
High 7.8
lib: cpu_rmap: Avoid use after free on rmap->obj array entries
In the Linux kernel, the following vulnerability has been resolved: lib: cpu_rmap: Avoid use after free on rmap->obj array entries When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corr…
-
High 7.8
netfilter: nft_set_rbtree: fix null deref on element insertion
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix null deref on element insertion There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem(): general protection fault, probably for non-ca…
-
High 7.8
vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of …
-
High 7.8
net: fix stack overflow when LRO is disabled for virtual interfaces
In the Linux kernel, the following vulnerability has been resolved: net: fix stack overflow when LRO is disabled for virtual interfaces When the virtual interface's feature is updated, it synchronizes the updated feature for its own lower interface. This prop…
-
High 7.8
drm/fbdev-generic: prohibit potential out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-generic: prohibit potential out-of-bounds access The fbdev test of IGT may write after EOF, which lead to out-of-bound access for drm drivers with fbdev-generic. For example, run fb…
-
High 7.8
binder: fix UAF of alloc->vma in race with munmap()
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of alloc->vma in race with munmap() [ cmllamas: clean forward port from commit 015ac18be7de ("binder: fix UAF of alloc->vma in race with munmap()") in 5.10 stable. It is neede…
-
High 7.8
netfilter: nf_tables: always release netdev hooks from notifier
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always release netdev hooks from notifier This reverts "netfilter: nf_tables: skip netdev events generated on netns removal". The problem is that when a veth device is r…
-
High 7.5
udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
In the Linux kernel, the following vulnerability has been resolved: udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). syzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using IPPROTO_UDPLITE (0x88): 14:25:52 executing program 1: r…
-
High 7.1
Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
-
High 7.0
virtio_net: Fix error unwinding of XDP initialization
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rq…
-
Medium 5.5
irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4
In the Linux kernel, the following vulnerability has been resolved: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 The T241 platform suffers from the T241-FABRIC-4 erratum which causes unexpected behavior in the GIC when multiple transactions are …
-
Medium 5.5
rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
In the Linux kernel, the following vulnerability has been resolved: rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access For kernels built with CONFIG_PREEMPT_RCU=y, the following scenario can result in a NULL-pointer dereference: CPU1 CPU2 rcu_preempt_…
-
Medium 5.5
net: add vlan_get_protocol_and_depth() helper
In the Linux kernel, the following vulnerability has been resolved: net: add vlan_get_protocol_and_depth() helper Before blamed commit, pskb_may_pull() was used instead of skb_header_pointer() in __vlan_get_protocol() and friends. Few callers depended on skb-…
-
Medium 5.5
net: skb_partial_csum_set() fix against transport header magic value
In the Linux kernel, the following vulnerability has been resolved: net: skb_partial_csum_set() fix against transport header magic value skb->transport_header uses the special 0xFFFF value to mark if the transport header was set or not. We must prevent caller…
-
Unscored —CVE-2022-50338 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue re…
-
Unscored —
ACPICA: Avoid undefined behavior: applying zero offset to null pointer
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e Before this change we see the following UBSAN stack trace in Fuch…
-
Unscored —
ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup()
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() devm_kzalloc() may fail, clk_data->name might be NULL and will cause a NULL pointer dereference later. [ rjw: Subj…
-
Unscored —
ext4: allow ext4_get_group_info() to fail
In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4_get_group_info() to fail Previously, ext4_get_group_info() would treat an invalid group number as BUG(), since in theory it should never happen. However, if a malicious attak…
-
Unscored —
nbd: fix incomplete validation of ioctl arg
In the Linux kernel, the following vulnerability has been resolved: nbd: fix incomplete validation of ioctl arg We tested and found an alarm caused by nbd_ioctl arg without verification. The UBSAN warning calltrace like below: UBSAN: Undefined behaviour in fs…
-
Unscored —
null_blk: Always check queue mode setting from configfs
In the Linux kernel, the following vulnerability has been resolved: null_blk: Always check queue mode setting from configfs Make sure to check device queue mode in the null_validate_conf() and return error for NULL_Q_RQ as we don't allow legacy I/O path, with…
-
Unscored —
md: fix soft lockup in status_resync
In the Linux kernel, the following vulnerability has been resolved: md: fix soft lockup in status_resync status_resync() will calculate 'curr_resync - recovery_active' to show user a progress bar like following: [============>........] resync = 61.4% 'curr_re…
-
Unscored —
tun: Fix memory leak for detached NAPI queue.
In the Linux kernel, the following vulnerability has been resolved: tun: Fix memory leak for detached NAPI queue. syzkaller reported [0] memory leaks of sk and skb related to the TUN device with no repro, but we can reproduce it easily with: struct ifreq ifr …
-
Unscored —
net: fix skb leak in __skb_tstamp_tx()
In the Linux kernel, the following vulnerability has been resolved: net: fix skb leak in __skb_tstamp_tx() Commit 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with zerocop…
-
Unscored —
drm/i915: Fix NULL ptr deref by checking new_crtc_state
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we m…
-
Unscored —
netlink: annotate accesses to nlk->cb_running
In the Linux kernel, the following vulnerability has been resolved: netlink: annotate accesses to nlk->cb_running Both netlink_recvmsg() and netlink_native_seq_show() read nlk->cb_running locklessly. Use READ_ONCE() there. Add corresponding WRITE_ONCE() to ne…
-
Unscored —
ext4: set goal start correctly in ext4_mb_normalize_request
In the Linux kernel, the following vulnerability has been resolved: ext4: set goal start correctly in ext4_mb_normalize_request We need to set ac_g_ex to notify the goal start used in ext4_mb_find_by_goal. Set ac_g_ex instead of ac_f_ex in ext4_mb_normalize_r…
-
Unscored —
bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps
In the Linux kernel, the following vulnerability has been resolved: bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps The LRU and LRU_PERCPU maps allocate a new element on update before locking the target hash table bucket. Right after that the maps …
-
Unscored —
bpf: Add preempt_count_{sub,add} into btf id deny list
In the Linux kernel, the following vulnerability has been resolved: bpf: Add preempt_count_{sub,add} into btf id deny list The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave preempt_count_{sub,add} unprotected. When attaching trampoline to th…
-
Unscored —
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
In the Linux kernel, the following vulnerability has been resolved: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment(): invalid opcode: 0000 [#1] …
-
Unscored —
firmware: arm_sdei: Fix sleep from invalid context BUG
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_sdei: Fix sleep from invalid context BUG Running a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra triggers: BUG: sleeping function called from invalid context at kern…
-
Unscored —
net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
In the Linux kernel, the following vulnerability has been resolved: net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). KCSAN found a data race in sock_recv_cmsgs() where the read access to sk->sk_stamp needs READ_ONCE(). BUG: KCSAN: data-race in pack…
-
Unscored —
af_unix: Fix data races around sk->sk_shutdown.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data races around sk->sk_shutdown. KCSAN found a data race around sk->sk_shutdown where unix_release_sock() and unix_shutdown() update it under unix_state_lock(), OTOH unix_poll(…
-
Unscored —
block, bfq: Fix division by zero error on zero wsum
In the Linux kernel, the following vulnerability has been resolved: block, bfq: Fix division by zero error on zero wsum When the weighted sum is zero the calculation of limit causes a division by zero error. Fix this by continuing to the next level. This was …
-
Unscored —
ACPI: EC: Fix oops when removing custom query handlers
In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: Fix oops when removing custom query handlers When removing custom query handlers, the handler might still be used inside the EC query workqueue, causing a kernel oops if the module …
-
Unscored —
debugobjects: Don't wake up kswapd from fill_pool()
In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fill_pool() syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | _…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50240.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-50338.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2156.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3090.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3567.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-35788.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53176.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53178.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53182.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53383.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53419.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53433.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53439.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53483.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53484.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53499.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53503.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53513.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53566.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53576.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53620.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53685.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53705.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53716.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53747.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53833.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53853.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54004.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54012.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54021.html