Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35976: In the Linux kernel, the following vulnerability has been resolved: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING CVE-2024-35973: In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb CVE-2024-35970: In the Linux kernel, the following vulnerability has been resolved: af_unix: Clear stale u->oob_skb. CVE-2024-35969: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr CVE-2024-35955: In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration CVE-2024-35950: In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes[] with dev->mode_config.mutex CVE-2024-35944: In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() CVE-2024-35936: In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() CVE-2024-35935: In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() CVE-2024-35925: In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in blk_rq_stat_sum() CVE-2024-35910: In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets CVE-2024-35908: In the Linux kernel, the following vulnerability has been resolved: tls: get psock ref after taking rxlock to avoid leak CVE-2024-35902: In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference CVE-2024-35900: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject new basechain after table flag update CVE-2024-35899: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: flush pending destroy work before exit_net release CVE-2024-35897: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard table flag update with pending basechain deletion CVE-2024-35896: In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length CVE-2024-35895: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem CVE-2024-35890: In the Linux kernel, the following vulnerability has been resolved: gro: fix ownership transfer CVE-2024-35888: In the Linux kernel, the following vulnerability has been resolved: erspan: make sure erspan_base_hdr is present in skb->head CVE-2024-35884: In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in a tunnel CVE-2024-35872: In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix GUP-fast succeeding on secretmem folios CVE-2024-35868: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_write() CVE-2024-35865: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_oplock_break() CVE-2024-35864: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break() CVE-2024-35862: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_network_name_deleted() CVE-2024-35861: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() CVE-2024-27393: In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle CVE-2024-26928: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show() CVE-2024-26925: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC sequence. nf_tables_module_autoload() temporarily releases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the abort phase after nft_gc_seq_end() is called. CVE-2024-26923: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() CVE-2024-26921: In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.87-99.174 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.87-99.174.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.87-99.174.amzn2023 |
Vulnerabilities 32
-
Critical 9.8
smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
Critical 9.8
smb: client: fix potential UAF in smb2_is_network_name_deleted()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_network_name_deleted() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
Critical 9.8
smb: client: fix potential UAF in smb2_is_valid_lease_break()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
Critical 9.8
smb: client: fix potential UAF in smb2_is_valid_oplock_break()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
Critical 9.8
udp: do not accept non-tunnel GSO skbs landing in a tunnel
In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in a tunnel When rx-udp-gro-forwarding is enabled UDP packets might be GROed when being forwarded. If such packets might land in a tunnel this c…
-
High 8.8
kprobes: Fix possible use-after-free issue on kprobe registration
In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change …
-
High 8.8
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item…
-
High 7.8
inet: inet_defrag: prevent sk release while still in use
In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such …
-
High 7.8
af_unix: Fix garbage collector racing against connect()
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a pe…
-
High 7.8
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), o…
-
High 7.8
mm/secretmem: fix GUP-fast succeeding on secretmem folios
In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix GUP-fast succeeding on secretmem folios folio_is_secretmem() currently relies on secretmem folios being LRU folios, to save some cycles. However, folios might reside in a fo…
-
High 7.8
gro: fix ownership transfer
In the Linux kernel, the following vulnerability has been resolved: gro: fix ownership transfer If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skb_segment_list those skbs can be reused as-is. Th…
-
High 7.8
netfilter: nf_tables: discard table flag update with pending basechain deletion
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard table flag update with pending basechain deletion Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dorma…
-
High 7.8
tcp: properly terminate timers for kernel sockets
In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigge…
-
High 7.8
drm/client: Fully protect modes[] with dev->mode_config.mutex
In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes[] with dev->mode_config.mutex The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus w…
-
High 7.5
xen-netfront: Add missing skb_mark_for_recycle
In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling…
-
High 7.3
erspan: make sure erspan_base_hdr is present in skb->head
In the Linux kernel, the following vulnerability has been resolved: erspan: make sure erspan_base_hdr is present in skb->head syzbot reported a problem in ip6erspan_rcv() [1] Issue is that ip6erspan_rcv() (and erspan_rcv()) no longer make sure erspan_base_hdr…
-
High 7.3
netfilter: nf_tables: flush pending destroy work before exit_net release
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: flush pending destroy work before exit_net release Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy work before netlink notifier") to address a race…
-
High 7.1
netfilter: validate user input for expected length
In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length I got multiple syzbot reports showing old bugs exposed by BPF after commit 20f2505fb436 ("bpf: Try to avoid kzalloc in cgroup/{s,g}etsockopt…
-
High 7.1
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
In the Linux kernel, the following vulnerability has been resolved: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING syzbot reported an illegal copy in xsk_setsockopt() [1] Make sure to validate setsockopt() @optlen parameter. [1] BUG: KASAN: slab…
-
Medium 6.3
af_unix: Clear stale u->oob_skb.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Clear stale u->oob_skb. syzkaller started to report deadlock of unix_gc_lock after commit 4090fa373f0e ("af_unix: Replace garbage collection algorithm."), but it just uncovers the bu…
-
Medium 5.5
geneve: fix header validation in geneve[6]_xmit_skb
In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb syzbot is able to trigger an uninit-value in geneve_xmit() [1] Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses s…
-
Unscored —
smb: client: fix potential UAF in cifs_debug_files_proc_show()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
Unscored —
smb: client: fix potential UAF in cifs_stats_proc_write()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_write() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
Unscored —
bpf, sockmap: Prevent lock inversion deadlock in map delete elem
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing…
-
Unscored —
netfilter: nf_tables: reject new basechain after table flag update
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject new basechain after table flag update When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and…
-
Unscored —
net/rds: fix possible cp null dereference
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp->cp_conn would produce null dereference [Simon Horman adds:] Analysis: * cp is a parameter of __rds_rdma_map and is not …
-
Unscored —
tls: get psock ref after taking rxlock to avoid leak
In the Linux kernel, the following vulnerability has been resolved: tls: get psock ref after taking rxlock to avoid leak At the start of tls_sw_recvmsg, we take a reference on the psock, and then call tls_rx_reader_lock. If that fails, we return directly with…
-
Unscored —
block: prevent division by zero in blk_rq_stat_sum()
In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in blk_rq_stat_sum() The expression dst->nr_samples + src->nr_samples may have zero value on overflow. It is necessary to add a check to avoid division by zero…
-
Unscored —
btrfs: send: handle path ref underflow in header iterate_inode_ref()
In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't acciden…
-
Unscored —
btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible condi…
-
Unscored —
VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26921.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26923.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26925.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26928.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27393.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35861.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35862.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35864.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35865.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35868.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35872.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35884.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35888.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35890.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35895.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35896.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35897.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35899.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35900.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35902.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35908.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35910.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35925.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35935.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35936.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35944.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35950.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35955.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35969.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35970.html