Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-54324: In the Linux kernel, the following vulnerability has been resolved: dm: fix a race condition in retrieve_deps CVE-2023-5345: A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705. CVE-2023-52924: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't skip expired elements during walk CVE-2023-52923: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API CVE-2023-52582: In the Linux kernel, the following vulnerability has been resolved: netfs: Only call folio_start_fscache() one time for each folio CVE-2023-52580: In the Linux kernel, the following vulnerability has been resolved: net/core: Fix ETH_P_1588 flow dissector CVE-2023-52578: In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() CVE-2023-52576: In the Linux kernel, the following vulnerability has been resolved: x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer() CVE-2023-52574: In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed CVE-2023-52573: In the Linux kernel, the following vulnerability has been resolved: net: rds: Fix possible NULL-pointer dereference CVE-2023-52572: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultiplex_thread() CVE-2023-52569: In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item CVE-2023-52567: In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: Check IRQ data before use CVE-2023-52562: In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() CVE-2023-52501: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" CVE-2023-52482: In the Linux kernel, the following vulnerability has been resolved: x86/srso: Add SRSO mitigation for Hygon processors CVE-2023-52433: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element. CVE-2023-5197: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325. CVE-2023-42756: A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system. CVE-2023-42754: A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system. CVE-2023-4244: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability. We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8. CVE-2022-48628: In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.56-82.125 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.56-82.125.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.56-82.125.amzn2023 |
Vulnerabilities 22
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it …
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recomm…
-
High 7.8
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherw…
-
High 7.8
cifs: Fix UAF in cifs_demultiplex_thread()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultiplex_thread() There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 …
-
High 7.8
team: fix null-ptr-deref when team device type is changed
In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 001…
-
High 7.8
netfilter: nf_tables: adapt set backend to use GC transaction API
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from a…
-
High 7.8
Use-after-free in Linux kernel's fs/smb/client component
A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead…
-
Medium 5.5
Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allo…
-
Medium 5.5
x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
In the Linux kernel, the following vulnerability has been resolved: x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer() The code calling ima_free_kexec_buffer() runs long after the memblock allocator has already been torn down, potential…
-
Medium 4.4
Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap
A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the syst…
-
Unscored —
ceph: drop messages from MDS when unmounting
In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting When unmounting all the dirty buffers will be flushed and after the last osd request is finished the last reference of the i_count will be release…
-
Unscored —
x86/srso: Add SRSO mitigation for Hygon processors
In the Linux kernel, the following vulnerability has been resolved: x86/srso: Add SRSO mitigation for Hygon processors Add mitigation for the speculative return stack overflow vulnerability which exists on Hygon processors too.
-
Unscored —
ring-buffer: Do not attempt to read past "commit"
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" When iterating over the ring buffer while the ring buffer is active, the writer can corrupt the reader. There's barriers to help detect this …
-
Unscored —
mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()
In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() After the commit in Fixes:, if a module that created a slab cache does not release all of its allocated objects befo…
-
Unscored —
serial: 8250_port: Check IRQ data before use
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: Check IRQ data before use In case the leaf driver wants to use IRQ polling (irq = 0) and IIR register shows that an interrupt happened in the 8250 hardware the IRQ data can…
-
Unscored —
btrfs: remove BUG() after failure to insert delayed dir index item
In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release a…
-
Unscored —
net: rds: Fix possible NULL-pointer dereference
In the Linux kernel, the following vulnerability has been resolved: net: rds: Fix possible NULL-pointer dereference In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument Found by Linux Ver…
-
Unscored —
net: bridge: use DEV_STATS_INC()
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_I…
-
Unscored —
net/core: Fix ETH_P_1588 flow dissector
In the Linux kernel, the following vulnerability has been resolved: net/core: Fix ETH_P_1588 flow dissector When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is w…
-
Unscored —
netfs: Only call folio_start_fscache() one time for each folio
In the Linux kernel, the following vulnerability has been resolved: netfs: Only call folio_start_fscache() one time for each folio If a network filesystem using netfs implements a clamp_length() function, it can set subrequest lengths smaller than a page size…
-
Unscored —
netfilter: nf_tables: don't skip expired elements during walk
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't skip expired elements during walk There is an asymmetry between commit/abort and preparation phase if the following conditions are met: 1. set is a verdict map ("1…
-
Unscored —
dm: fix a race condition in retrieve_deps
In the Linux kernel, the following vulnerability has been resolved: dm: fix a race condition in retrieve_deps There's a race condition in the multipath target when retrieve_deps races with multipath_message calling dm_get_device and dm_put_device. retrieve_de…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-48628.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-4244.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-42754.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-42756.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-5197.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52433.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52482.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52501.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52562.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52567.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52569.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52572.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52573.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52574.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52576.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52578.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52580.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52582.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52923.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52924.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-5345.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54324.html