Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-36031: In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation CVE-2024-35809: In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal CVE-2024-35801: In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD CVE-2024-26898: In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts CVE-2024-26883: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches CVE-2024-26865: In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). syzkaller reported a warning of netns tracker [0] followed by KASAN splat [1] and another ref tracker warning [1]. syzkaller could not find a repro, but in the log, the only suspicious sequence was as follows: 18:26:22 executing program 1: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ... connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4001, 0x0, @loopback}, 0x1c) (async) The notable thing here is 0x4001 in connect(), which is RDS_TCP_PORT. CVE-2024-26815: In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check CVE-2024-26643: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout CVE-2024-26642: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag CVE-2024-26585: In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do. CVE-2024-26584: In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRESS in valid situations. For example, when the cryptd queue for AESNI is full (easy to trigger with an artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued to the backlog but still processed. In that case, the async callback will also be called twice: first with err == -EINPROGRESS, which it seems we can just ignore, then with err == 0. Compared to Sabrina's original patch this version uses the new tls_*crypt_async_wait() helpers and converts the EBUSY to EINPROGRESS to avoid having to modify all the error handling paths. The handling is identical. CVE-2024-25742: A malicious hypervisor can potentially break confidentiality and integrity of Linux SEV-SNP guests by injecting interrupts. CVE-2024-23307: Integer Overflow or Wraparound vulnerability in Linux kernel on x86 and ARM (md, raid, raid5 modules) allows Forced Integer Overflow.
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.84-99.169 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.84-99.169.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.84-99.169.amzn2023 |
Vulnerabilities 13
-
Critical 9.8
net: tls: handle backlogging of crypto requests
In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY inst…
-
Critical 9.8
tls: fix race between tx work scheduling and socket close
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). …
-
Critical 9.8
keys: Fix overwrite of key expiration on instantiation
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for…
-
High 7.8
netfilter: nf_tables: disallow anonymous set with timeout flag
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy …
-
High 7.8
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with…
-
High 7.8
net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check taprio_parse_tc_entry() is not correctly checking TCA_TAPRIO_TC_ENTRY_INDEX attribute: int tc; // Signed value tc = nla_get_u32(tb[TC…
-
High 7.8
rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). syzkaller reported a warning of netns tracker [0] followed by KASAN splat [1] and another ref tracker warning [1]. syzkaller coul…
-
High 7.8
bpf: Fix stackmap overflow check on 32-bit arches
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the res…
-
High 7.8
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the …
-
High 7.8
x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a p…
-
Medium 6.5
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and …
-
Medium 5.5
PCI/PM: Drain runtime-idle callbacks before driver removal
In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash …
-
Medium 4.4
Integer overflow in raid5_cache_count in Linux kernel
Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-23307.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-25742.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26584.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26585.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26642.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26643.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26815.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26865.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26883.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26898.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35801.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35809.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36031.html