Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-50017: In the Linux kernel, the following vulnerability has been resolved: x86/mm/ident_map: Use gbpages only where full GB page should be mapped. CVE-2024-26920: In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot CVE-2024-26910: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation CVE-2024-26828: In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() CVE-2024-26826: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow CVE-2024-26820: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed CVE-2024-26727: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT() if the newly created subvolume already got read CVE-2024-26726: In the Linux kernel, the following vulnerability has been resolved: btrfs: don't drop extent_map for free space inode on write error CVE-2024-26720: In the Linux kernel, the following vulnerability has been resolved: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again CVE-2024-26718: In the Linux kernel, the following vulnerability has been resolved: dm-crypt, dm-verity: disable tasklets CVE-2024-26707: In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() CVE-2024-26704: In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len CVE-2024-26698: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove CVE-2024-26696: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() CVE-2024-26689: In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg() CVE-2024-26688: In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super CVE-2024-26681: In the Linux kernel, the following vulnerability has been resolved: netdevsim: avoid potential loop in nsim_dev_trap_report_work() CVE-2024-26679: In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() CVE-2024-26676: In the Linux kernel, the following vulnerability has been resolved: af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. CVE-2024-26665: In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error CVE-2024-26629: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER CVE-2024-26603: In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ] CVE-2024-26602: In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the ability for this to be called at too high of a frequency and saturate the machine. CVE-2024-26601: In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such. This causes corruption of the buddy bitmap so we need to regenerate it in that case. CVE-2024-26583: In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires. CVE-2024-26582: In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and we trigger a use-after-free in process_rx_list when we try to read from the partially-read skb. CVE-2024-26581: In the Linux kernel, the following vulnerability has been reso
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.79-99.164 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.79-99.164.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.79-99.164.amzn2023 |
Vulnerabilities 38
-
Critical 9.8
net: tls: fix use-after-free with partial reads and async decrypt
In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and…
-
Critical 9.8
tls: fix race between async notify and socket close
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past tha…
-
Critical 9.4
cifs: fix underflow in parse_server_interfaces()
In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the …
-
Critical 9.1
tunnels: fix out of bounds access when building IPv6 PMTU error
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/…
-
High 8.8
ceph: prevent use-after-free in encode_cap_msg()
In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg() In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This imp…
-
High 8.1
smb: client: fix potential OOBs in smb2_parse_contexts()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing i…
-
High 7.8
crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the s…
-
High 7.8CVE-2024-26581 Public exploit
netfilter: nft_set_rbtree: skip end interval element from gc
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip end interval element from gc rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval el…
-
High 7.8
ext4: regenerate buddy after block freeing failed if under fc replay
In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_bu…
-
High 7.8
ext4: fix double-free of blocks due to wrong extents moved_len
In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and don…
-
High 7.8
dm-crypt, dm-verity: disable tasklets
In the Linux kernel, the following vulnerability has been resolved: dm-crypt, dm-verity: disable tasklets Tasklets have an inherent problem with memory corruption. The function tasklet_action_common calls tasklet_trylock, then it calls the tasklet callback an…
-
High 7.5
mptcp: fix data re-injection from stale subflow
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring…
-
Medium 6.6
Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function
A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
-
Medium 5.7CVE-2024-2193 Public exploit
Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the …
-
Medium 5.5
dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate m…
-
Medium 5.5
fs/ntfs3: Fix an NULL dereference bug
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_attr_list(). The "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow on a 64bit …
-
Medium 5.5
Kernel: stack overflow problem in open vswitch kernel module leading to dos
A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and ca…
-
Medium 5.5
In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and cr…
-
Medium 5.5
copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes,…
-
Medium 5.5
af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. syzbot reported a warning [0] in __unix_gc() with a repro, which creates a socketpair and sends one socket's fd to itself using th…
-
Medium 4.4
Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()
A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issu…
-
Unscored —
net: prevent mss overflow in skb_segment()
In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a forbidden value, but unfortunately the following computation in…
-
Unscored —
sched/membarrier: reduce the ability to hammer on sys_membarrier
In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in …
-
Unscored —
x86/fpu: Stop relying on userspace for info to fault in xsave buffer
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can b…
-
Unscored —
nfsd: fix RELEASE_LOCKOWNER
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER The test on so_count in nfsd4_release_lockowner() is nonsense and harmful. Revert to using check_for_locks(), changing that to not sleep. First: harmful. As is doc…
-
Unscored —
inet: read sk->sk_family once in inet_recv_error()
In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a…
-
Unscored —
netdevsim: avoid potential loop in nsim_dev_trap_report_work()
In the Linux kernel, the following vulnerability has been resolved: netdevsim: avoid potential loop in nsim_dev_trap_report_work() Many syzbot reports include the following trace [1] If nsim_dev_trap_report_work() can not grab the mutex, it should rearm itsel…
-
Unscored —
fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super When configuring a hugetlb filesystem via the fsconfig() syscall, there is a possible NULL dereference in hugetlbfs_fill_super(…
-
Unscored —
nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() Syzbot reported a hang issue in migrate_pages_batch() called by mbind() and nilfs_lookup_dirty_data_buffers() called in the log writer of…
-
Unscored —
hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove In commit ac5047671758 ("hv_netvsc: Disable NAPI before closing the VMBus channel"), napi_disable was getting called for a…
-
Unscored —
net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() Syzkaller reported [1] hitting a warning after failing to allocate resources for skb in hsr_init_skb(). Since a WARN_ONCE() call w…
-
Unscored —CVE-2024-26720 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
btrfs: don't drop extent_map for free space inode on write error
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't drop extent_map for free space inode on write error While running the CI for an unrelated change I hit the following panic with generic/648 on btrfs_holes_spacecache. assertion f…
-
Unscored —
btrfs: do not ASSERT() if the newly created subvolume already got read
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT() if the newly created subvolume already got read [BUG] There is a syzbot crash, triggered by the ASSERT() during subvolume creation: assertion failed: !anon_dev, in fs/b…
-
Unscored —
hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as t…
-
Unscored —
netfilter: ipset: fix performance regression in swap operation
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation The patch "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test", commit 28628fa9 fixes a race…
-
Unscored —
tracing/trigger: Fix to return error if failed to alloc snapshot
In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix register_snapshot_trigger() to return error code if it failed to allocate a snapshot instead of 0 (success). Unless that, …
-
Unscored —
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
In the Linux kernel, the following vulnerability has been resolved: x86/mm/ident_map: Use gbpages only where full GB page should be mapped. When ident_pud_init() uses only GB pages to create identity maps, large ranges of addresses not actually requested can …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52429.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52434.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52435.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52616.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52631.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-0340.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-0841.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-1151.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-2193.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-23850.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-23851.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26581.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26582.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26583.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26601.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26602.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26603.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26629.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26665.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26676.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26679.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26681.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26688.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26689.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26696.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26698.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26704.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26707.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26718.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26720.html