Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-26972: In the Linux kernel, the following vulnerability has been resolved: ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path CVE-2024-26808: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain CVE-2024-26673: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations CVE-2024-26671: In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race CVE-2024-26668: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow CVE-2024-26646: In the Linux kernel, the following vulnerability has been resolved: thermal: intel: hfi: Add syscore callbacks for system-wide PM CVE-2024-26644: In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume CVE-2024-26641: In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() CVE-2024-26640: In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy CVE-2024-26638: In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely CVE-2024-26635: In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. CVE-2024-26634: In the Linux kernel, the following vulnerability has been resolved: net: fix removing a namespace with conflicting altnames CVE-2024-26627: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler CVE-2024-26626: In the Linux kernel, the following vulnerability has been resolved: ipmr: fix kernel panic when forwarding mcast packets CVE-2024-26625: In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time CVE-2024-26614: In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once CVE-2024-26612: In the Linux kernel, the following vulnerability has been resolved: netfs, fscache: Prevent Oops in fscache_put_cache() CVE-2024-23849: In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. CVE-2024-1086: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. CVE-2023-52672: In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage CVE-2023-52623: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage warning CVE-2023-52622: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg CVE-2023-52621: In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers CVE-2023-52619: In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number CVE-2023-52615: In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock on mmap-ed hwrng CVE-2023-52614: In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overflow in trans_stat_show CVE-2023-52583: In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() CVE-2023-52498: In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code CVE-2023-52492: In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix NULL pointer in channel unregistration function CVE-2023-52489: In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage CVE-2023-52486: In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.77-99.164 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.77-99.164.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.77-99.164.amzn2023 |
Vulnerabilities 31
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slo…
KEV May 30, 2024 -
High 8.6
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h varia…
-
High 7.8
drm: Don't unref the same fb many times by mistake due to deadlock handling
In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry th…
-
High 7.8
PM / devfreq: Fix buffer overflow in trans_stat_show
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overflow in trans_stat_show Fix buffer overflow in trans_stat_show(). Convert simple snprintf to the more secure scnprintf with size of PAGE_SIZE. Add condition check…
-
High 7.8
SUNRPC: Fix a suspicious RCU usage warning
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage warning I received the following warning while running cthon against an ontap server running pNFS: [ 57.202521] ============================= [ 57.202522] W…
-
High 7.8
tcp: make sure init the accept_queue's spinlocks once
In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value …
-
High 7.8
llc: call sock_orphan() at release time
In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk…
-
High 7.8
tcp: add sanity checks to rx zerocopy
In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional …
-
High 7.8
thermal: intel: hfi: Add syscore callbacks for system-wide PM
In the Linux kernel, the following vulnerability has been resolved: thermal: intel: hfi: Add syscore callbacks for system-wide PM The kernel allocates a memory buffer and provides its location to the hardware, which uses it to update the HFI table. This alloc…
-
High 7.8
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale re…
-
High 7.5
ipmr: fix kernel panic when forwarding mcast packets
In the Linux kernel, the following vulnerability has been resolved: ipmr: fix kernel panic when forwarding mcast packets The stacktrace was: [ 86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092 [ 86.306815] #PF: supervisor read access …
-
High 7.0
pipe: wakeup wr_wait after setting max_usage
In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain co…
-
Medium 5.5
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RD…
-
Medium 5.5
netfs, fscache: Prevent Oops in fscache_put_cache()
In the Linux kernel, the following vulnerability has been resolved: netfs, fscache: Prevent Oops in fscache_put_cache() This function dereferences "cache" and then checks if it's IS_ERR_OR_NULL(). Check first, then dereference.
-
Medium 5.5
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler Inside scsi_eh_wakeup(), scsi_host_busy() is called & checked with host lock every time for deciding if error handl…
-
Medium 4.4
dmaengine: fix NULL pointer in channel unregistration function
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix NULL pointer in channel unregistration function __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local i…
-
Medium 4.4
nbd: always initialize struct msghdr completely
In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure th…
-
Unscored —
mm/sparsemem: fix race in accessing memory_section->usage
In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are su…
-
Unscored —
PM: sleep: Fix possible deadlocks in core system-wide PM code
In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes it…
-
Unscored —
ceph: fix deadlock or deadcode of misusing dget()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadc…
-
Unscored —
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /de…
-
Unscored —
pstore/ram: Fix crash when setting number of cpus to an odd number
In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number. The address of …
-
Unscored —
bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresp…
-
Unscored —
ext4: avoid online resizing failures due to oversized flex bg
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbg_size, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir…
-
Unscored —
net: fix removing a namespace with conflicting altnames
In the Linux kernel, the following vulnerability has been resolved: net: fix removing a namespace with conflicting altnames Mark reports a BUG() when a net namespace is removed. kernel BUG at net/core/dev.c:11520! Physical interfaces moved outside of init_net…
-
Unscored —
llc: Drop support for ETH_P_TR_802_2.
In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latte…
-
Unscored —
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRF…
-
Unscored —
netfilter: nft_limit: reject configurations that cause integer overflow
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as…
-
Unscored —
blk-mq: fix IO hang from sbitmap wakeup race
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. …
-
Unscored —
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since dest…
-
Unscored —CVE-2024-26972 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52486.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52489.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52492.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52498.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52583.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52614.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52615.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52619.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52621.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52622.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52623.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52672.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-1086.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-23849.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26612.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26614.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26625.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26626.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26627.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26634.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26635.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26638.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26640.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26641.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26644.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26646.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26668.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26671.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26673.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26808.html