Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-22365: A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with `pam_namespace` configured will cause the `openat()` in `protect_dir()` to block the attempt, causing a local denial of service.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | pam | 0:1.5.1-8.amzn2023.0.4 |
| Amazon Linux · 2023 | pam-debuginfo | 0:1.5.1-8.amzn2023.0.4 |
| Amazon Linux · 2023 | pam-debugsource | 0:1.5.1-8.amzn2023.0.4 |
| Amazon Linux · 2023 | pam-devel | 0:1.5.1-8.amzn2023.0.4 |
| Amazon Linux · 2023 | pam-docs | 0:1.5.1-8.amzn2023.0.4 |
Vulnerabilities 1
-
Medium 5.5
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-22365.html