Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-54303: In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_perf_event_output CVE-2023-54297: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix memory leak after finding block group with super blocks CVE-2023-54283: In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpf_lru_list CVE-2023-54258: In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break CVE-2023-54254: In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on eviction error CVE-2023-54251: In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. CVE-2023-54220: In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix oops for port->pm on uart_change_pm() CVE-2023-54211: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in trace_buffered_event_disable() CVE-2023-54194: In the Linux kernel, the following vulnerability has been resolved: exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree CVE-2023-54185: In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG_ON()'s in add_new_free_space() CVE-2023-54177: In the Linux kernel, the following vulnerability has been resolved: quota: fix warning in dqgrab() CVE-2023-54173: In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_event_output CVE-2023-54172: In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction CVE-2023-54170: In the Linux kernel, the following vulnerability has been resolved: keys: Fix linking a duplicate key to a keyring's assoc_array CVE-2023-54155: In the Linux kernel, the following vulnerability has been resolved: net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() CVE-2023-54121: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix incorrect splitting in btrfs_drop_extent_map_range CVE-2023-54099: In the Linux kernel, the following vulnerability has been resolved: fs: Protect reconfiguration of sb read-write from racing writes CVE-2023-54091: In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_target_cloned CVE-2023-54081: In the Linux kernel, the following vulnerability has been resolved: xen: speed up grant-table reclaim CVE-2023-54051: In the Linux kernel, the following vulnerability has been resolved: net: do not allow gso_size to be set to GSO_BY_FRAGS CVE-2023-54023: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between balance and cancel/pause CVE-2023-54019: In the Linux kernel, the following vulnerability has been resolved: sched/psi: use kernfs polling functions for PSI trigger polling CVE-2023-53865: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix warning when putting transaction with qgroups enabled after abort CVE-2023-53855: In the Linux kernel, the following vulnerability has been resolved: net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove CVE-2023-53847: In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alauda_check_media() CVE-2023-53843: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject negative ifindex CVE-2023-53841: In the Linux kernel, the following vulnerability has been resolved: devlink: report devlink_port_type_warn source device CVE-2023-53839: In the Linux kernel, the following vulnerability has been resolved: dccp: fix data-race around dp->dccps_mss_cache CVE-2023-53821: In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 CVE-2023-53794: In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid use-after-free issue CVE-2023-53733: In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode CVE-2023-53718: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not swap cpu_buffer during resize process CVE-2023-53698: In the Linux kernel, the following vulnerability has been resolved: xsk: fix refcount underflow in error path CVE-2023-53660: In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Handle skb as well when clean up ptr_ring CVE-2023-53618: In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump CVE-2023-53600: In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error CVE-2023-53597: In the Linux kernel, the following vulnerability has been resolved: cifs: fix mid leak during reconnection after timeout threshold CVE-2023-53593: In the Linux kernel, the following vulnerability has been resolved: cifs: Release folio lock on fscache read hit. CVE-2023-53577: In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Make sure kthread is running before map update returns CVE-2023-53559: In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 CVE-2023-53558: In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() CVE-2023-53515: In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.49-69.116 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.49-69.116.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.49-69.116.amzn2023 |
Vulnerabilities 84
-
Critical 9.8
vxlan: Fix nexthop hash size
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_has…
-
Critical 9.8
cifs: fix session state check in reconnect to avoid use-after-free issue
In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting sess…
-
Critical 9.8
cifs: fix potential oops in cifs_oplock_break
In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock…
-
Critical 9.1
tunnels: fix kasan splat when generating ipv4 pmtu error
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Re…
-
High 7.8
Linux: buffer overrun in netback due to unusual packet
The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner ru…
-
High 7.8
Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their pr…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead un…
-
High 7.8CVE-2023-4147 Public exploit
Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_route component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instanc…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of th…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of …
-
High 7.8CVE-2023-4622 Public exploit
Use-after-free in Linux kernel's af_unix component
A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…
-
High 7.8
sched/fair: Don't balance task to its current running CPU
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Don't balance task to its current running CPU We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like b…
-
High 7.8
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_…
-
High 7.8
mptcp: fix disconnect vs accept race
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix disconnect vs accept race Despite commit 0ad529d9fd2b ("mptcp: fix possible divide by zero in recvmsg()"), the mptcp protocol is still prone to a race between disconnect() (or shut…
-
High 7.8
ip_vti: fix potential slab-use-after-free in decode_session6
In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-…
-
High 7.8
bpf, cpumap: Make sure kthread is running before map update returns
In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Make sure kthread is running before map update returns The following warning was reported when running stress-mode enabled xdp_redirect_cpu with some RT threads: ------------[ cu…
-
High 7.8
bpf, cpumap: Handle skb as well when clean up ptr_ring
In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Handle skb as well when clean up ptr_ring The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled: ------------[ cut here ]---…
-
High 7.8
xsk: fix refcount underflow in error path
In the Linux kernel, the following vulnerability has been resolved: xsk: fix refcount underflow in error path Fix a refcount underflow problem reported by syzbot that can happen when a system is running out of memory. If xp_alloc_tx_descs() fails, and it can …
-
High 7.8
ring-buffer: Do not swap cpu_buffer during resize process
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not swap cpu_buffer during resize process When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. C…
-
High 7.8
net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When u32_replace_hw_knode fails, we need to undo the tcf_bind_filter operation done at u32_set_parms.
-
High 7.8
sched/psi: use kernfs polling functions for PSI trigger polling
In the Linux kernel, the following vulnerability has been resolved: sched/psi: use kernfs polling functions for PSI trigger polling Destroying psi trigger in cgroup_file_release causes UAF issues when a cgroup is removed from under a polling process. This is …
-
High 7.8
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix incorrect splitting in btrfs_drop_extent_map_range In production we were seeing a variety of WARN_ON()'s in the extent_map code, specifically in btrfs_drop_extent_map_range() when …
-
High 7.8
bpf: Disable preemption in bpf_event_output
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_event_output We received report [1] of kernel crash, which is caused by using nesting protection without disabled preemption. The bpf_event_output can be called…
-
High 7.8
serial: 8250: Fix oops for port->pm on uart_change_pm()
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix oops for port->pm on uart_change_pm() Unloading a hardware specific 8250 driver can produce error "Unable to handle kernel paging request at virtual address" about ten secon…
-
High 7.8
drm/ttm: Don't leak a resource on eviction error
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on eviction error On eviction errors other than -EMULTIHOP we were leaking a resource. Fix. v2: - Avoid yet another goto (Andi Shyti)
-
High 7.8
bpf: Disable preemption in bpf_perf_event_output
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_perf_event_output The nesting protection in bpf_perf_event_output relies on disabled preemption, which is guaranteed for kprobes and tracepoints. However bpf_pe…
-
High 7.5
cifs: fix mid leak during reconnection after timeout threshold
In the Linux kernel, the following vulnerability has been resolved: cifs: fix mid leak during reconnection after timeout threshold When the number of responses with status of STATUS_IO_TIMEOUT exceeds a specified threshold (NUM_STATUS_IO_TIMEOUT), we reconnec…
-
High 7.3
xfrm: fix slab-use-after-free in decode_session6
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix slab-use-after-free in decode_session6 When the xfrm device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-…
-
Medium 6.0
Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry
A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging …
-
Medium 5.5
Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …
-
Medium 5.5
Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, lea…
-
Medium 5.5
Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid
A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is t…
-
Medium 5.5
Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c
A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak.
-
Medium 5.5
smb: client: fix warning in cifs_smb3_do_mount()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning in cifs_smb3_do_mount() This fixes the following warning reported by kernel test robot fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible memory leak of '…
-
Medium 5.5
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them in a guest VM as a SCSI device. I/…
-
Medium 5.5
btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand
In the Linux kernel, the following vulnerability has been resolved: btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand While trying to get the subpage blocksize tests running, I hit the following panic on generic/476 assertion failed: PagePri…
-
Medium 5.5
ovl: fix null pointer dereference in ovl_permission()
In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovl_permission() Following process: P1 P2 path_lookupat link_path_walk inode_permission ovl_permission ovl_i_path_real(inode, &realpath) path->dentry = ov…
-
Medium 5.5
drm/client: Fix memory leak in drm_client_modeset_probe
In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_modeset_probe When a new mode is set to modeset->mode, the previous mode should be freed. This fixes the following kmemleak report: drm_mode_duplicat…
-
Medium 5.5
netfilter: nft_set_rbtree: fix overlap expiration walk
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix overlap expiration walk The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any. Can be reproduced wi…
-
Medium 5.5
fs/ntfs3: Enhance sanity check while generating attr_list
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Enhance sanity check while generating attr_list ni_create_attr_list uses WARN_ON to catch error cases while generating attribute list, which only prints out stack trace and may not …
-
Medium 5.5
ip6mr: Fix skb_under_panic in ip6mr_cache_report()
In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skb_under_panic in ip6mr_cache_report() skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ---…
-
Medium 5.5
net: dcb: choose correct policy to parse DCB_ATTR_BCN
In the Linux kernel, the following vulnerability has been resolved: net: dcb: choose correct policy to parse DCB_ATTR_BCN The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN], which is introduced in commit 859ee3c43812 ("DCB: Add support for D…
-
Medium 5.5
drm/ttm: fix bulk_move corruption when adding a entry
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulk_move corruption when adding a entry When the resource is the first in the bulk_move range, adding it again (thus moving it to the tail) will corrupt the list since the first…
-
Medium 4.7
mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
In the Linux kernel, the following vulnerability has been resolved: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: …
-
Low 3.2
Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigge…
-
Unscored —CVE-2023-20588 EPSS 11%
Speculative Leaks
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
-
Unscored —
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…
-
Unscored —
xfrm: add NULL check in xfrm_update_ae_params
In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrm_update_ae_params Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_u…
-
Unscored —
igb: Fix igb_down hung on surprise removal
In the Linux kernel, the following vulnerability has been resolved: igb: Fix igb_down hung on surprise removal In a setup where a Thunderbolt hub connects to Ethernet and a display through USB Type-C, users may experience a hung task timeout when they remove …
-
Unscored —
udf: Fix uninitialized array access for some pathnames
In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in …
-
Unscored —
scsi: core: Fix possible memory leak if device_add() fails
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix possible memory leak if device_add() fails If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device(…
-
Unscored —
dma-buf/dma-resv: Stop leaking on krealloc() failure
In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fai…
-
Unscored —CVE-2023-53183 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
btrfs: fix BUG_ON condition in btrfs_cancel_balance
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix BUG_ON condition in btrfs_cancel_balance Pausing and canceling balance can race to interrupt balance lead to BUG_ON panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_can…
-
Unscored —CVE-2023-53469 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
powerpc/rtas_flash: allow user copy to flash block cache objects
In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas_flash: allow user copy to flash block cache objects With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare…
-
Unscored —
virtio-mmio: don't break lifecycle of vm_dev
In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_de…
-
Unscored —
rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()
In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() pr_info() is called with rtp->cbs_gbl_lock spin lock locked. Because pr_info() calls printk() that might sleep, this will re…
-
Unscored —
cifs: Release folio lock on fscache read hit.
In the Linux kernel, the following vulnerability has been resolved: cifs: Release folio lock on fscache read hit. Under the current code, when cifs_readpage_worker is called, the call contract is that the callee should unlock the page. This is documented in t…
-
Unscored —
btrfs: reject invalid reloc tree root keys with stack dump
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge(). That ASSERT() makes sure the reloc tree is p…
-
Unscored —
ip6_vti: fix slab-use-after-free in decode_session6
In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-aft…
-
Unscored —
dccp: fix data-race around dp->dccps_mss_cache
In the Linux kernel, the following vulnerability has been resolved: dccp: fix data-race around dp->dccps_mss_cache dccp_sendmsg() reads dp->dccps_mss_cache before locking the socket. Same thing in do_dccp_getsockopt(). Add READ_ONCE()/WRITE_ONCE() annotations…
-
Unscored —
devlink: report devlink_port_type_warn source device
In the Linux kernel, the following vulnerability has been resolved: devlink: report devlink_port_type_warn source device devlink_port_type_warn is scheduled for port devlink and warning when the port type is not set. But from this warning it is not easy found…
-
Unscored —
net: openvswitch: reject negative ifindex
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject negative ifindex Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs in an xarray")) refactored the handling of pre-assigned ifindexes and let syzbot…
-
Unscored —
usb-storage: alauda: Fix uninit-value in alauda_check_media()
In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alauda_check_media() Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage: BUG: KMSAN: uninit-va…
-
Unscored —
net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove
In the Linux kernel, the following vulnerability has been resolved: net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove When the tagging protocol in current use is "ocelot-8021q" and we unbind the driver, we see this splat: $ …
-
Unscored —
btrfs: fix warning when putting transaction with qgroups enabled after abort
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix warning when putting transaction with qgroups enabled after abort If we have a transaction abort with qgroups enabled we get a warning triggered when doing the final put on the tra…
-
Unscored —
btrfs: fix race between balance and cancel/pause
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between balance and cancel/pause Syzbot reported a panic that looks like this: assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE_PAUSED, in fs/btrfs/ioctl…
-
Unscored —
net: do not allow gso_size to be set to GSO_BY_FRAGS
In the Linux kernel, the following vulnerability has been resolved: net: do not allow gso_size to be set to GSO_BY_FRAGS One missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again [1] Do not allow gso_size to be set to GSO_BY_FRAGS (0x…
-
Unscored —
xen: speed up grant-table reclaim
In the Linux kernel, the following vulnerability has been resolved: xen: speed up grant-table reclaim When a grant entry is still in use by the remote domain, Linux must put it on a deferred list. Normally, this list is very short, because the PV network and …
-
Unscored —
drm/client: Fix memory leak in drm_client_target_cloned
In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_target_cloned dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup ar…
-
Unscored —
fs: Protect reconfiguration of sb read-write from racing writes
In the Linux kernel, the following vulnerability has been resolved: fs: Protect reconfiguration of sb read-write from racing writes The reconfigure / remount code takes a lot of effort to protect filesystem's reconfiguration code from racing writes on remount…
-
Unscored —
net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
In the Linux kernel, the following vulnerability has been resolved: net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() Syzkaller reported the following issue: ======================================= Too BIG xdp->frame_sz = 131072 WARNING: C…
-
Unscored —
keys: Fix linking a duplicate key to a keyring's assoc_array
In the Linux kernel, the following vulnerability has been resolved: keys: Fix linking a duplicate key to a keyring's assoc_array When making a DNS query inside the kernel using dns_query(), the request code can in rare cases end up creating a duplicate index …
-
Unscored —
x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction On hardware that supports Indirect Branch Tracking (IBT), Hyper-V VMs with ConfigVersion 9.3 or later support IBT in the gu…
-
Unscored —
quota: fix warning in dqgrab()
In the Linux kernel, the following vulnerability has been resolved: quota: fix warning in dqgrab() There's issue as follows when do fault injection: WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 Modules linked in: CPU: …
-
Unscored —
btrfs: remove BUG_ON()'s in add_new_free_space()
In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG_ON()'s in add_new_free_space() At add_new_free_space() we have these BUG_ON()'s that are there to deal with any failure to add free space to the in memory free space cache. …
-
Unscored —
exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
In the Linux kernel, the following vulnerability has been resolved: exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree The call stack shown below is a scenario in the Linux 4.19 kernel. Allocating memory failed where exfat fs use kmalloc_array du…
-
Unscored —
tracing: Fix warning in trace_buffered_event_disable()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in trace_buffered_event_disable() Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_bu…
-
Unscored —
net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. syzkaller found zero division error [0] in div_s64_rem() called from get_cycle_time_elapsed(), where sched->cycle_time is…
-
Unscored —
bpf: Address KCSAN report on bpf_lru_list
In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpf_lru_list KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate, take this chance to use a more common READ_ONCE…
-
Unscored —
btrfs: zoned: fix memory leak after finding block group with super blocks
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix memory leak after finding block group with super blocks At exclude_super_stripes(), if we happen to find a block group that has super blocks mapped to it and we are on a zon…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-20588.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-34319.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3772.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3773.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3777.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-39194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4004.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4015.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4128.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4147.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4206.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4207.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4208.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4273.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4569.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4622.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53147.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53148.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53165.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53174.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53181.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53183.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53192.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53215.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53230.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53245.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53247.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53260.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53288.html