Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-6176: A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. CVE-2023-54299: In the Linux kernel, the following vulnerability has been resolved: usb: typec: bus: verify partner exists in typec_altmode_attention CVE-2023-54296: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration CVE-2023-54281: In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl CVE-2023-54253: In the Linux kernel, the following vulnerability has been resolved: btrfs: set page extent mapped after read_folio in relocate_one_page CVE-2023-54230: In the Linux kernel, the following vulnerability has been resolved: amba: bus: fix refcount leak CVE-2023-54224: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix lockdep splat and potential deadlock after failure running delayed items CVE-2023-54181: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix issue in verifying allow_ptr_leaks CVE-2023-54178: In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() CVE-2023-54154: In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix target_cmd_counter leak CVE-2023-54137: In the Linux kernel, the following vulnerability has been resolved: vfio/type1: fix cap_migration information leak CVE-2023-54134: In the Linux kernel, the following vulnerability has been resolved: autofs: fix memory leak of waitqueues in autofs_catatonic_mode CVE-2023-54117: In the Linux kernel, the following vulnerability has been resolved: s390/dcssblk: fix kernel crash with list_add corruption CVE-2023-54113: In the Linux kernel, the following vulnerability has been resolved: rcu: dump vmalloc memory info safely CVE-2023-54112: In the Linux kernel, the following vulnerability has been resolved: kcm: Fix memory leak in error path of kcm_sendmsg() CVE-2023-54045: In the Linux kernel, the following vulnerability has been resolved: audit: fix possible soft lockup in __audit_inode_child() CVE-2023-54006: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-race around unix_tot_inflight. CVE-2023-53996: In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make enc_dec_hypercall() accept a size instead of npages CVE-2023-53995: In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix one memleak in __inet_del_ifa() CVE-2023-53861: In the Linux kernel, the following vulnerability has been resolved: ext4: correct grp validation in ext4_mb_good_group CVE-2023-53860: In the Linux kernel, the following vulnerability has been resolved: dm: don't attempt to queue IO under RCU protection CVE-2023-53856: In the Linux kernel, the following vulnerability has been resolved: of: overlay: Call of_changeset_init() early CVE-2023-53848: In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix a deadlock in r5l_exit_log() CVE-2023-53836: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skb refcnt race after locking changes CVE-2023-53831: In the Linux kernel, the following vulnerability has been resolved: net: read sk->sk_family once in sk_mc_loop() CVE-2023-53825: In the Linux kernel, the following vulnerability has been resolved: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). CVE-2023-53817: In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() CVE-2023-53799: In the Linux kernel, the following vulnerability has been resolved: crypto: api - Use work queue in crypto_destroy_instance CVE-2023-53752: In the Linux kernel, the following vulnerability has been resolved: net: deal with integer overflows in kmalloc_reserve() CVE-2023-53743: In the Linux kernel, the following vulnerability has been resolved: PCI: Free released resource after coalescing CVE-2023-53727: In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: avoid stalls in fq_pie_timer() CVE-2023-53726: In the Linux kernel, the following vulnerability has been resolved: arm64: csum: Fix OoB access in IP checksum code for negative lengths CVE-2023-53722: In the Linux kernel, the following vulnerability has been resolved: md: raid1: fix potential OOB in raid1_remove_disk() CVE-2023-53711: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption CVE-2023-53676: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() CVE-2023-53672: In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref CVE-2023-53663: In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Check instead of asserting on nested TSC scaling support CVE-2023-53662: In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} CVE-2023-53649: In the Linux kernel, the following vulnerability has been resolved: perf trace: Really free the evsel->priv area CVE-2023-53647: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't dereference ACPI root object handle CVE-2023-53596: In the Linux kernel, the following vulnerability has been resolved: drivers: base: Free de
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.55-75.123 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.55-75.123.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.55-75.123.amzn2023 |
Vulnerabilities 75
-
Critical 9.8
lwt: Fix return values of BPF xmit ops
In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirec…
-
Critical 9.3
x86/sev: Make enc_dec_hypercall() accept a size instead of npages
In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make enc_dec_hypercall() accept a size instead of npages enc_dec_hypercall() accepted a page count instead of a size, which forced its callers to round up. As a result, non-page alig…
-
High 8.8
HID: multitouch: Correct devm device reference for hidinput input_dev name
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the…
-
High 8.8
scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a sess…
-
High 8.2
NFS: Fix a potential data corruption
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the…
-
High 7.8
Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component
A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…
-
High 7.8
Use-after-free in Linux kernel's net/sched: sch_qfq component
A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue()…
-
High 7.8
netfilter: nftables: exthdr: fix 4-byte stack OOB write
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption. This construct…
-
High 7.8
netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR…
-
High 7.8
pstore/ram: Check start of empty przs during init
In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Check start of empty przs during init After commit 30696378f68a ("pstore/ram: Do not treat empty buffers as valid"), initialization would assume a prz was valid after seeing that …
-
High 7.8
skbuff: skb_segment, Call zero copy functions before using skbuff frags
In the Linux kernel, the following vulnerability has been resolved: skbuff: skb_segment, Call zero copy functions before using skbuff frags Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") added the call to zero copy funct…
-
High 7.8
ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5 According to the ACPI specification 19.6.134, no argument is required to be passed for …
-
High 7.8
xsk: Fix xsk_diag use-after-free error during socket cleanup
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. T…
-
High 7.8
PM / devfreq: Fix leak in devfreq_dev_release()
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix leak in devfreq_dev_release() srcu_init_notifier_head() allocates resources that need to be released with a srcu_cleanup_notifier_head() call. Reported by kmemleak.
-
High 7.8
jbd2: check 'jh->b_transaction' before removing it from checkpoint
In the Linux kernel, the following vulnerability has been resolved: jbd2: check 'jh->b_transaction' before removing it from checkpoint Following process will corrupt ext4 image: Step 1: jbd2_journal_commit_transaction __jbd2_journal_insert_checkpoint(jh, comm…
-
High 7.8
null_blk: fix poll request timeout handling
In the Linux kernel, the following vulnerability has been resolved: null_blk: fix poll request timeout handling When doing io_uring benchmark on /dev/nullb0, it's easy to crash the kernel if poll requests timeout triggered, as reported by David. [1] BUG: kern…
-
High 7.8
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) and held indefinitely a…
-
High 7.8
net: deal with integer overflows in kmalloc_reserve()
In the Linux kernel, the following vulnerability has been resolved: net: deal with integer overflows in kmalloc_reserve() Blamed commit changed: ptr = kmalloc(size); if (ptr) size = ksize(ptr); size = kmalloc_size_roundup(size); ptr = kmalloc(size); This allo…
-
High 7.8
bpf, sockmap: Fix skb refcnt race after locking changes
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skb refcnt race after locking changes There is a race where skb's from the sk_psock_backlog can be referenced after userspace side has already skb_consumed() the sk_buff and…
-
High 7.8
dm: don't attempt to queue IO under RCU protection
In the Linux kernel, the following vulnerability has been resolved: dm: don't attempt to queue IO under RCU protection dm looks up the table for IO based on the request type, with an assumption that if the request is marked REQ_NOWAIT, it's fine to attempt to…
-
High 7.5
crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a c…
-
High 7.1
hsr: Fix uninit-value access in fill_frame_info()
In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in fill_frame_info() Syzbot reports the following uninit-value access problem. ===================================================== BUG: KMSAN: uninit-value in f…
-
High 7.1
arm64: csum: Fix OoB access in IP checksum code for negative lengths
In the Linux kernel, the following vulnerability has been resolved: arm64: csum: Fix OoB access in IP checksum code for negative lengths Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length calls") added an early return for zero-length inp…
-
High 7.0
Kernel: netfilter: potential slab-out-of-bound access due to integer underflow
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer o…
-
Medium 6.7
Kernel: netfilter: xtables out-of-bounds read in u32_match_it()
A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyon…
-
Medium 6.5
Kernel: rsvp: out-of-bounds read in rsvp_classify()
A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to…
-
Medium 6.1
Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosu…
-
Medium 5.5
Kernel: integer overflow in igmpv3_newpack leading to exploitable memory access
An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.
-
Medium 5.5
KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state When emulating nested VM-Exit, load L1's TSC multiplier if L1's desired ratio doesn't match the current ratio, not if the r…
-
Medium 5.5
md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()
In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() r5l_flush_stripe_to_raid() will check if the list 'flushing_ios' is empty, and then submit 'flush_bio', however, r5l_log_flus…
-
Medium 5.5
drm/msm/mdp5: Don't leak some plane state
In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Don't leak some plane state Apparently no one noticed that mdp5 plane states leak like a sieve ever since we introduced plane_state->commit refcount a few years ago in 21a01abbe…
-
Medium 5.5
x86/MCE: Always save CS register on AMD Zen IF Poison errors
In the Linux kernel, the following vulnerability has been resolved: x86/MCE: Always save CS register on AMD Zen IF Poison errors The Instruction Fetch (IF) units on current AMD Zen-based systems do not guarantee a synchronous #MC is delivered for poison consu…
-
Medium 5.1
Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()
A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading…
-
Medium 4.7
tracing: Fix race issue between cpu buffer write and swap
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race issue between cpu buffer write and swap Warning happened in rb_end_commit() at code: if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))) WARNING: CPU: 0 PID: 1…
-
Medium 4.7
Kernel: local dos vulnerability in scatterwalk_copychunks
A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to cras…
-
Medium 4.6
An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in …
-
Unscored —
An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3…
-
Unscored —
USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors(): BUG: KASAN: slab-out-of-bounds in read_descript…
-
Unscored —
af_unix: Fix data-races around user->unix_inflight.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-races around user->unix_inflight. user->unix_inflight is changed under spin_lock(unix_gc_lock), but too_many_unix_fds() reads it locklessly. Let's annotate the write/read ac…
-
Unscored —
scsi: qla4xxx: Add length check when parsing nlattrs
In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Add length check when parsing nlattrs There are three places that qla4xxx parses nlattrs: - qla4xxx_set_chap_entry() - qla4xxx_iface_set_param() - qla4xxx_sysfs_ddb_set_param()…
-
Unscored —
kobject: Add sanity check for kset->kobj.ktype in kset_register()
In the Linux kernel, the following vulnerability has been resolved: kobject: Add sanity check for kset->kobj.ktype in kset_register() When I register a kset in the following way: static struct kset my_kset; kobject_set_name(&my_kset.kobj, "my_kset"); ret = ks…
-
Unscored —
iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind
In the Linux kernel, the following vulnerability has been resolved: iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind When unbinding pasid - a race condition exists vs outstanding page faults. To prevent this, the pasid_state obje…
-
Unscored —
bpf: reject unhashed sockets in bpf_sk_assign
In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets in bpf_sk_assign The semantics for bpf_sk_assign are as follows: sk = some_lookup_func() bpf_sk_assign(skb, sk) bpf_sk_release(sk) That is, the sk is not consumed…
-
Unscored —
drivers: base: Free devm resources when unregistering a device
In the Linux kernel, the following vulnerability has been resolved: drivers: base: Free devm resources when unregistering a device In the current code, devres_release_all() only gets called if the device has a bus and has been probed. This leads to issues whe…
-
Unscored —
Drivers: hv: vmbus: Don't dereference ACPI root object handle
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't dereference ACPI root object handle Since the commit referenced in the Fixes: tag below the VMBus client driver is walking the ACPI namespace up from the VMBus ACPI …
-
Unscored —
perf trace: Really free the evsel->priv area
In the Linux kernel, the following vulnerability has been resolved: perf trace: Really free the evsel->priv area In 3cb4d5e00e037c70 ("perf trace: Free syscall tp fields in evsel->priv") it only was freeing if strcmp(evsel->tp_format->system, "syscalls") retu…
-
Unscored —
ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}
In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} If the filename casefolding fails, we'll be leaking memory from the fscrypt_name struct, namely from the 'crypto_buf.name'…
-
Unscored —
KVM: nSVM: Check instead of asserting on nested TSC scaling support
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Check instead of asserting on nested TSC scaling support Check for nested TSC scaling support on nested SVM VMRUN instead of asserting that TSC scaling is exposed to L1 if L1's MSR…
-
Unscored —
btrfs: output extra debug info if we failed to find an inline backref
In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref [BUG] Syzbot reported several warning triggered inside lookup_inline_extent_backref(). [CAUSE] As usual, the reproducer d…
-
Unscored —
md: raid1: fix potential OOB in raid1_remove_disk()
In the Linux kernel, the following vulnerability has been resolved: md: raid1: fix potential OOB in raid1_remove_disk() If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in raid1_remove_disk(). We have already found similar…
-
Unscored —
net/sched: fq_pie: avoid stalls in fq_pie_timer()
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: avoid stalls in fq_pie_timer() When setting a high number of flows (limit being 65536), fq_pie_timer() is currently using too much time as syzbot reported. Add logic to yie…
-
Unscored —
PCI: Free released resource after coalescing
In the Linux kernel, the following vulnerability has been resolved: PCI: Free released resource after coalescing release_resource() doesn't actually free the resource or resource list entry so free the resource list entry to avoid a leak.
-
Unscored —
crypto: api - Use work queue in crypto_destroy_instance
In the Linux kernel, the following vulnerability has been resolved: crypto: api - Use work queue in crypto_destroy_instance The function crypto_drop_spawn expects to be called in process context. However, when an instance is unregistered while it still has ac…
-
Unscored —
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
In the Linux kernel, the following vulnerability has been resolved: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720 ("kcm: Fix memory leak in error path of kcm_sendmsg()") suppre…
-
Unscored —
net: read sk->sk_family once in sk_mc_loop()
In the Linux kernel, the following vulnerability has been resolved: net: read sk->sk_family once in sk_mc_loop() syzbot is playing with IPV6_ADDRFORM quite a lot these days, and managed to hit the WARN_ON_ONCE(1) in sk_mc_loop() We have many more similar issu…
-
Unscored —
md/raid5-cache: fix a deadlock in r5l_exit_log()
In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix a deadlock in r5l_exit_log() Commit b13015af94cf ("md/raid5-cache: Clear conf->log after finishing work") introduce a new problem: // caller hold reconfig_mutex r5l_exit_l…
-
Unscored —
of: overlay: Call of_changeset_init() early
In the Linux kernel, the following vulnerability has been resolved: of: overlay: Call of_changeset_init() early When of_overlay_fdt_apply() fails, the changeset may be partially applied, and the caller is still expected to call of_overlay_remove() to clean up…
-
Unscored —
ext4: correct grp validation in ext4_mb_good_group
In the Linux kernel, the following vulnerability has been resolved: ext4: correct grp validation in ext4_mb_good_group Group corruption check will access memory of grp and will trigger kernel crash if grp is NULL. So do NULL check before corruption check.
-
Unscored —
net: ipv4: fix one memleak in __inet_del_ifa()
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix one memleak in __inet_del_ifa() I got the below warning when do fuzzing test: unregister_netdevice: waiting for bond0 to become free. Usage count = 2 It can be repoduced via: i…
-
Unscored —
af_unix: Fix data-race around unix_tot_inflight.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-race around unix_tot_inflight. unix_tot_inflight is changed under spin_lock(unix_gc_lock), but unix_release_sock() reads it locklessly. Let's use READ_ONCE() for unix_tot_in…
-
Unscored —
audit: fix possible soft lockup in __audit_inode_child()
In the Linux kernel, the following vulnerability has been resolved: audit: fix possible soft lockup in __audit_inode_child() Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. C…
-
Unscored —
kcm: Fix memory leak in error path of kcm_sendmsg()
In the Linux kernel, the following vulnerability has been resolved: kcm: Fix memory leak in error path of kcm_sendmsg() syzbot reported a memory leak like below: BUG: memory leak unreferenced object 0xffff88810b088c00 (size 240): comm "syz-executor186", pid 5…
-
Unscored —
rcu: dump vmalloc memory info safely
In the Linux kernel, the following vulnerability has been resolved: rcu: dump vmalloc memory info safely Currently, for double invoke call_rcu(), will dump rcu_head objects memory info, if the objects is not allocated from the slab allocator, the vmalloc_dump…
-
Unscored —
s390/dcssblk: fix kernel crash with list_add corruption
In the Linux kernel, the following vulnerability has been resolved: s390/dcssblk: fix kernel crash with list_add corruption Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk association") introduced new logic for gendisk association, requiring dr…
-
Unscored —
autofs: fix memory leak of waitqueues in autofs_catatonic_mode
In the Linux kernel, the following vulnerability has been resolved: autofs: fix memory leak of waitqueues in autofs_catatonic_mode Syzkaller reports a memory leak: BUG: memory leak unreferenced object 0xffff88810b279e00 (size 96): comm "syz-executor399", pid …
-
Unscored —
vfio/type1: fix cap_migration information leak
In the Linux kernel, the following vulnerability has been resolved: vfio/type1: fix cap_migration information leak Fix an information leak where an uninitialized hole in struct vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace. The defi…
-
Unscored —
scsi: target: core: Fix target_cmd_counter leak
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix target_cmd_counter leak The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in leaks across various transport types, e.g.:…
-
Unscored —
of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() when kmalloc() fail to allocate memory in kasprintf(), name or full_name will be NULL, strcmp() will cause null…
-
Unscored —
bpf: Fix issue in verifying allow_ptr_leaks
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix issue in verifying allow_ptr_leaks After we converted the capabilities of our networking-bpf program from cap_sys_admin to cap_net_admin+cap_bpf, our networking-bpf program failed to…
-
Unscored —
btrfs: fix lockdep splat and potential deadlock after failure running delayed items
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix lockdep splat and potential deadlock after failure running delayed items When running delayed items we are holding a delayed node's mutex and then we will attempt to modify a subvo…
-
Unscored —
amba: bus: fix refcount leak
In the Linux kernel, the following vulnerability has been resolved: amba: bus: fix refcount leak commit 5de1540b7bc4 ("drivers/amba: create devices from device tree") increases the refcount of of_node, but not releases it in amba_device_release, so there is r…
-
Unscored —
btrfs: set page extent mapped after read_folio in relocate_one_page
In the Linux kernel, the following vulnerability has been resolved: btrfs: set page extent mapped after read_folio in relocate_one_page One of the CI runs triggered the following panic assertion failed: PagePrivate(page) && page->private, in fs/btrfs/subpage.…
-
Unscored —
btrfs: release path before inode lookup during the ino lookup ioctl
In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl During the ino lookup ioctl we can end up calling btrfs_iget() to get an inode reference while we are holding on a root's b…
-
Unscored —
KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration Fix a goof where KVM tries to grab source vCPUs from the destination VM when doing intrahost migration. Grabbing the w…
-
Unscored —
usb: typec: bus: verify partner exists in typec_altmode_attention
In the Linux kernel, the following vulnerability has been resolved: usb: typec: bus: verify partner exists in typec_altmode_attention Some usb hubs will negotiate DisplayPort Alt mode with the device but will then negotiate a data role swap after entering the…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-37453.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-39189.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-39192.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-39193.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-42752.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-42753.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-42755.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-45871.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4623.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4921.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52628.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52886.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53179.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53204.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53208.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53210.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53324.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53331.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53338.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53354.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53368.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53395.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53426.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53438.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53454.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53456.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53462.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53480.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53501.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53518.html