Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-27431: In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program CVE-2024-27417: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() CVE-2024-27415: In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack CVE-2024-27413: In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size CVE-2024-27404: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data races on remote_id CVE-2024-27024: In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rds_conn_connect_if_down CVE-2024-27023: In the Linux kernel, the following vulnerability has been resolved: md: Fix missing release of 'active_io' for flush CVE-2024-26857: In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() CVE-2024-26851: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range CVE-2024-26849: In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array CVE-2024-26845: In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling CVE-2024-26844: In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter CVE-2024-26840: In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache() CVE-2024-26835: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure CVE-2024-26832: In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix missing folio cleanup in writeback race path CVE-2024-26805: In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter CVE-2024-26804: In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth CVE-2024-26803: In the Linux kernel, the following vulnerability has been resolved: net: veth: clear GRO when clearing XDP even when down CVE-2024-26798: In the Linux kernel, the following vulnerability has been resolved: fbcon: always restore the old font data in fbcon_do_set_font() CVE-2024-26793: In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_newlink() CVE-2024-26792: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of anonymous device after snapshot creation failure CVE-2024-26791: In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names CVE-2024-26789: In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/neonbs - fix out-of-bounds access on short input CVE-2024-26782: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix double-free on socket dismantle CVE-2024-26780: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC. CVE-2024-26774: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt CVE-2024-26773: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() CVE-2024-26772: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() CVE-2024-26764: In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio CVE-2024-26763: In the Linux kernel, the following vulnerability has been resolved: dm-crypt: don't modify the data when using authenticated encryption CVE-2024-26760: In the Linux kernel, the following vulnerability has been resolved: scsi: target: pscsi: Fix bio_put() for error case CVE-2024-26742: In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disable_managed_interrupts CVE-2024-26741: In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). CVE-2024-26735: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref CVE-2024-26686: In the Linux kernel, the following vulnerability has been resolved: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats CVE-2024-26659: In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly CVE-2024-26621: In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: don't force huge page alignment on 32 bit CVE-2024-1627: A vulnerability was discovered in the Linux kernel's IPv4 networking stack. Under certain conditions, MPTCP and NetLabel can be configured in a way that triggers a double free memory error in net/ipv4/af_inet.c:inet_sock_destruct(). This may lead to a system crash, denial of service, or potential arbitrary code execution. CVE-2023-52641: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() CVE-2023-52620: In the Linux kernel, the following vulnerability has been resolve
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.82-99.168 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.82-99.168.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.82-99.168.amzn2023 |
Vulnerabilities 39
-
Critical 9.8
scsi: target: pscsi: Fix bio_put() for error case
In the Linux kernel, the following vulnerability has been resolved: scsi: target: pscsi: Fix bio_put() for error case As of commit 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc wrapper"), a bio allocated by bio_kmalloc() must be freed by bio_un…
-
Critical 9.8
mptcp: fix double-free on socket dismantle
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix double-free on socket dismantle when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inet_opt' for the new socket has the same …
-
High 8.8
netfilter: bridge: confirm multicast packets before passing them up the stack
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack conntrack nf_confirm logic cannot handle cloned skbs referencing the same nf_conn entry, which will happen for mu…
-
High 8.2
mm: huge_memory: don't force huge page alignment on 32 bit
In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: don't force huge page alignment on 32 bit commit efa7df3e3bb5 ("mm: align larger anonymous mappings on THP boundaries") caused two issues [1] [2] reported on 32 bit system or…
-
High 8.2
mptcp: fix data races on remote_id
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data races on remote_id Similar to the previous patch, address the data race on remote_id, adding the suitable ONCE annotations.
-
High 7.8
netfilter: nf_tables: disallow timeout for anonymous sets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.
-
High 7.8
xhci: handle isoc Babble and Buffer Overrun events properly
In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of t…
-
High 7.8
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avo…
-
High 7.8
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid alloc…
-
High 7.8
crypto: arm64/neonbs - fix out-of-bounds access on short input
In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/neonbs - fix out-of-bounds access on short input The bit-sliced implementation of AES-CTR operates on blocks of 128 bytes, and will fall back to the plain NEON version for tail …
-
High 7.8
btrfs: fix double free of anonymous device after snapshot creation failure
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of anonymous device after snapshot creation failure When creating a snapshot we may do a double free of an anonymous device in case there's an error committing the tran…
-
High 7.8
gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_newlink() The gtp_link_ops operations structure for the subsystem must be registered after registering the gtp_net_ops pernet operations stru…
-
High 7.8
net: ip_tunnel: prevent perpetual headroom growth
In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read…
-
High 7.8
cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure bein…
-
High 7.5
scsi: target: core: Add TMF to tmr_list handling
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list take…
-
High 7.5
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vml…
-
High 7.3
geneve: make sure to pull inner header in geneve_rx()
In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inne…
-
High 7.1
dm-crypt: don't modify the data when using authenticated encryption
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: don't modify the data when using authenticated encryption It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. …
-
Unscored —
fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() It is preferable to exit through the out: label because internal debugging functions are located there.
-
Unscored —
fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
In the Linux kernel, the following vulnerability has been resolved: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats lock_task_sighand() can trigger a hard lockup. If NR_CPUS threads call do_task_stat() at the same time and the …
-
Unscored —
ipv6: sr: fix possible use-after-free and null-ptr-deref
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref The pernet operations structure for the subsystem must be registered before registering the generic netlink family.
-
Unscored —
dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().
In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). syzkaller reported a warning [0] in inet_csk_destroy_sock() with no repro. WARN_ON(inet_sk(sk)->inet_num && !i…
-
Unscored —
scsi: smartpqi: Fix disable_managed_interrupts
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disable_managed_interrupts Correct blk-mq registration issue with module parameter disable_managed_interrupts enabled. When we turn off the default PCI_IRQ_AFFINITY flag, …
-
Unscored —
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the following kernel warning appears: WARNING: CPU: 3 PID…
-
Unscored —
ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt Determine if bb_fragments is 0 instead of determining bb_free to eliminate the risk of dividing by zero wh…
-
Unscored —
af_unix: Fix task hung while purging oob_skb in GC.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC. syzbot reported a task hung; at the same time, GC was looping infinitely in list_for_each_entry_safe() for OOB skb. [0] syzbot demonstrated…
-
Unscored —
btrfs: dev-replace: properly validate device names
In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead t…
-
Unscored —
fbcon: always restore the old font data in fbcon_do_set_font()
In the Linux kernel, the following vulnerability has been resolved: fbcon: always restore the old font data in fbcon_do_set_font() Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when vc_resize() failed) started restoring old font data upon failure…
-
Unscored —
net: veth: clear GRO when clearing XDP even when down
In the Linux kernel, the following vulnerability has been resolved: net: veth: clear GRO when clearing XDP even when down veth sets NETIF_F_GRO automatically when XDP is enabled, because both features use the same NAPI machinery. The logic to clear NETIF_F_GR…
-
Unscored —
netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` …
-
Unscored —
mm: zswap: fix missing folio cleanup in writeback race path
In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix missing folio cleanup in writeback race path In zswap_writeback_entry(), after we get a folio from __read_swap_cache_async(), we grab the tree lock again to check that the swap…
-
Unscored —
netfilter: nf_tables: set dormant flag on hook register failure
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure We need to set the dormant flag again if we fail to register the hooks. During memory pressure hook registration can fail and w…
-
Unscored —
cachefiles: fix memory leak in cachefiles_add_cache()
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache() The following memory leak was reported after unbinding /dev/cachefiles: =================================================================…
-
Unscored —
block: Fix WARNING in _copy_from_iter
In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_iter because an iov_iter is supposedly used in the wrong direction. The reason is that syzcaller managed to gen…
-
Unscored —
netlink: add nla be16/32 types to minlen array
In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.…
-
Unscored —
md: Fix missing release of 'active_io' for flush
In the Linux kernel, the following vulnerability has been resolved: md: Fix missing release of 'active_io' for flush submit_flushes atomic_set(&mddev->flush_pending, 1); rdev_for_each_rcu(rdev, mddev) atomic_inc(&mddev->flush_pending); bi->bi_end_io = md_end_…
-
Unscored —
net/rds: fix WARNING in rds_conn_connect_if_down
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rds_conn_connect_if_down If connection isn't established yet, get_mr() will fail, trigger connection after get_mr().
-
Unscored —
efi/capsule-loader: fix incorrect allocation size
In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/cap…
-
Unscored —
ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_geta…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52620.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52641.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-1627.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26621.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26659.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26686.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26735.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26741.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26742.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26760.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26763.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26764.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26772.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26773.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26774.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26780.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26782.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26789.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26791.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26792.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26793.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26798.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26803.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26804.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26805.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26832.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26835.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26840.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26844.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26845.html