Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0607: netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() CVE-2024-0584: A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an igmp query packet, leading to a kernel information leak. CVE-2023-6932: A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. CVE-2023-6622: A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service. CVE-2023-6111: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times. We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. CVE-2023-52879: In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters CVE-2023-52869: In the Linux kernel, the following vulnerability has been resolved: pstore/platform: Add check for kstrdup CVE-2023-52868: In the Linux kernel, the following vulnerability has been resolved: thermal: core: prevent potential string overflow CVE-2023-52864: In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device CVE-2023-52860: In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process CVE-2023-52859: In the Linux kernel, the following vulnerability has been resolved: perf: hisi: Fix use-after-free when register pmu fails CVE-2023-52854: In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() CVE-2023-52846: In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() CVE-2023-52843: In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading mac header CVE-2023-52840: In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() CVE-2023-52837: In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_open CVE-2023-52835: In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound CVE-2023-52831: In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Don't offline the last non-isolated CPU CVE-2023-52828: In the Linux kernel, the following vulnerability has been resolved: bpf: Detect IP == ksym.end as part of BPF program CVE-2023-52813: In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATA_RESET CVE-2023-52803: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries CVE-2023-52796: In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper CVE-2023-52791: In the Linux kernel, the following vulnerability has been resolved: i2c: core: Run atomic i2c xfer when !preemptible CVE-2023-52788: In the Linux kernel, the following vulnerability has been resolved: i915/perf: Fix NULL deref bugs with drm_dbg() calls CVE-2023-52784: In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() CVE-2023-52781: In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' CVE-2023-52778: In the Linux kernel, the following vulnerability has been resolved: mptcp: deal with large GSO size CVE-2023-52772: In the Linux kernel, the following vulnerability has been resolved: af_unix: fix use-after-free in unix_stream_read_actor() CVE-2023-52763: In the Linux kernel, the following vulnerability has been resolved: i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. CVE-2023-52762: In the Linux kernel, the following vulnerability has been resolved: virtio-blk: fix implicit overflow on virtio_max_dma_size CVE-2023-52757: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when releasing mids CVE-2023-52752: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() CVE-2021-47432: In the Linux kernel, the following vulnerability has been resolved: lib/generic-radix-tree.c: Don't overflow in peek()
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.66-91.160 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.66-91.160.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.66-91.160.amzn2023 |
Vulnerabilities 33
-
High 8.8
hsr: Prevent use after free in prp_create_tagged_frame()
In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns …
-
High 7.8
smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid …
-
High 7.8
af_unix: fix use-after-free in unix_stream_read_actor()
In the Linux kernel, the following vulnerability has been resolved: af_unix: fix use-after-free in unix_stream_read_actor() syzbot reported the following crash [1] After releasing unix socket lock, u->oob_skb can be changed by another thread. We must temporar…
-
High 7.8
nbd: fix uaf in nbd_open
In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_open Commit 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set disk->private_data as NULL as before. UA…
-
High 7.8
tracing: Have trace_event_file have ref counters
In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable #…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument syn…
-
High 7.8
Use-after-free in Linux kernel's ipv4: igmp component
A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another…
-
High 7.0
platform/x86: wmi: Fix opening of char device
In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp…
-
Medium 6.6
bpf: Detect IP == ksym.end as part of BPF program
In the Linux kernel, the following vulnerability has been resolved: bpf: Detect IP == ksym.end as part of BPF program Now that bpf_throw kfunc is the first such call instruction that has noreturn semantics within the verifier, this also kicks in dead code eli…
-
Medium 6.6
Kernel: nf_tables: pointer math issue in nft_byteorder_eval()
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so …
-
Medium 5.5
lib/generic-radix-tree.c: Don't overflow in peek()
In the Linux kernel, the following vulnerability has been resolved: lib/generic-radix-tree.c: Don't overflow in peek() When we started spreading new inode numbers throughout most of the 64 bit inode space, that triggered some corner case bugs, in particular s…
-
Medium 5.5
pstore/platform: Add check for kstrdup
In the Linux kernel, the following vulnerability has been resolved: pstore/platform: Add check for kstrdup Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference.
-
Medium 5.5
Kernel: null pointer dereference vulnerability in nft_dynset_init()
A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.
-
Unscored —
smb: client: fix potential deadlock when releasing mids
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when releasing mids All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @s…
-
Unscored —
virtio-blk: fix implicit overflow on virtio_max_dma_size
In the Linux kernel, the following vulnerability has been resolved: virtio-blk: fix implicit overflow on virtio_max_dma_size The following codes have an implicit conversion from size_t to u32: (u32)max_size = (size_t)virtio_max_dma_size(vdev); This may lead o…
-
Unscored —
i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.
In the Linux kernel, the following vulnerability has been resolved: i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. The `i3c_master_bus_init` function may attach the I2C devices before the I3C bus initialization. In this flow, the DAT `a…
-
Unscored —
mptcp: deal with large GSO size
In the Linux kernel, the following vulnerability has been resolved: mptcp: deal with large GSO size After the blamed commit below, the TCP sockets (and the MPTCP subflows) can build egress packets larger than 64K. That exceeds the maximum DSS data size, the l…
-
Unscored —
usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function …
-
Unscored —
bonding: stop the device in bond_setup_by_slave()
In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. In the fo…
-
Unscored —
i915/perf: Fix NULL deref bugs with drm_dbg() calls
In the Linux kernel, the following vulnerability has been resolved: i915/perf: Fix NULL deref bugs with drm_dbg() calls When i915 perf interface is not available dereferencing it will lead to NULL dereferences. As returning -ENOTSUPP is pretty clear return wh…
-
Unscored —
i2c: core: Run atomic i2c xfer when !preemptible
In the Linux kernel, the following vulnerability has been resolved: i2c: core: Run atomic i2c xfer when !preemptible Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is disabled. However, non-atomic i2c transfers require preemption (e.g. in wait…
-
Unscored —
ipvlan: add ipvlan_route_v6_outbound() helper
In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi…
-
Unscored —
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking.…
-
Unscored —
crypto: pcrypt - Fix hungtask for PADATA_RESET
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATA_RESET We found a hungtask bug in test_aead_vec_cfg as follows: INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. "echo 0 > /proc/sys…
-
Unscored —
cpu/hotplug: Don't offline the last non-isolated CPU
In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Don't offline the last non-isolated CPU If a system has isolated CPUs via the "isolcpus=" command line parameter, then an attempt to offline the last housekeeping CPU will result…
-
Unscored —
perf/core: Bail out early if the request AUX area is out of bound
In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to …
-
Unscored —
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is…
-
Unscored —
llc: verify mac len before reading mac header
In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading mac header LLC reads the mac header with eth_hdr without verifying that the skb has an Ethernet header. Syzbot was able to enter llc_rcv on a tun device. Tu…
-
Unscored —
padata: Fix refcnt handling in padata_free_shell()
In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis …
-
Unscored —
perf: hisi: Fix use-after-free when register pmu fails
In the Linux kernel, the following vulnerability has been resolved: perf: hisi: Fix use-after-free when register pmu fails When we fail to register the uncore pmu, the pmu context may not been allocated. The error handing will call cpuhp_state_remove_instance…
-
Unscored —
drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process When tearing down a 'hisi_hns3' PMU, we mistakenly run the CPU hotplug callbacks after the devic…
-
Unscored —
thermal: core: prevent potential string overflow
In the Linux kernel, the following vulnerability has been resolved: thermal: core: prevent potential string overflow The dev->id value comes from ida_alloc() so it's a number between zero and INT_MAX. If it's too high then these sprintf()s will overflow.
-
Unscored —CVE-2024-0584 Rejected
Do not use this CVE as it is duplicate of CVE-2023-6932
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-47432.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52752.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52757.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52762.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52763.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52772.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52778.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52781.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52784.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52788.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52791.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52796.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52803.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52813.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52828.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52831.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52835.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52837.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52840.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52843.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52846.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52854.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52859.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52860.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52864.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52868.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52869.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52879.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-6111.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-6622.html