Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-36959: In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() CVE-2024-36953: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() CVE-2024-36944: In the Linux kernel, the following vulnerability has been resolved: Reapply "drm/qxl: simplify qxl_fence_wait" CVE-2024-36940: In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() CVE-2024-36939: In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_register() in nfs_net_init(). CVE-2024-36938: In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue CVE-2024-36937: In the Linux kernel, the following vulnerability has been resolved: xdp: use flags field to disambiguate broadcast redirect CVE-2024-36933: In the Linux kernel, the following vulnerability has been resolved: nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). CVE-2024-36929: In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs CVE-2024-36918: In the Linux kernel, the following vulnerability has been resolved: bpf: Check bloom filter map value size CVE-2024-36917: In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in blk_ioctl_discard() CVE-2024-36916: In the Linux kernel, the following vulnerability has been resolved: blk-iocost: avoid out of bounds shift CVE-2024-36912: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl CVE-2024-36910: In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory CVE-2024-36909: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted CVE-2024-36905: In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets CVE-2024-36904: In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). CVE-2024-36902: In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() CVE-2024-36901: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent NULL dereference in ip6_output() CVE-2024-36898: In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix uninitialised kfifo CVE-2024-36896: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal CVE-2024-36890: In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers CVE-2024-36889: In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_nxt is properly initialized on connect CVE-2024-36883: In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init CVE-2024-36882: In the Linux kernel, the following vulnerability has been resolved: mm: use memalloc_nofs_save() in page_cache_ra_order() CVE-2024-36028: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() CVE-2024-36017: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation CVE-2024-36000: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge CVE-2024-35999: In the Linux kernel, the following vulnerability has been resolved: smb3: missing lock when picking channel CVE-2024-35947: In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser CVE-2024-26900: In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev->serial
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.91-99.172 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.91-99.172.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.91-99.172.amzn2023 |
Vulnerabilities 31
-
Critical 9.6
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an erro…
-
Critical 9.3
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail s…
-
Critical 9.1
USB: core: Fix access violation during port device removal
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that t…
-
High 8.4
uio_hv_generic: Don't free decrypted memory
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned …
-
High 7.8
net: fix out-of-bounds access in ops_init
In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is …
-
High 7.8
mm/slab: make __free(kfree) accept error pointers
In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(…
-
High 7.8
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid…
-
High 7.8
bpf: Check bloom filter map value size
In the Linux kernel, the following vulnerability has been resolved: bpf: Check bloom filter map value size This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map…
-
High 7.8
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
In the Linux kernel, the following vulnerability has been resolved: nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO_NET_HDR_GSO_UDP layer…
-
High 7.8
pinctrl: core: delete incorrect free in pinctrl_enable()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_…
-
High 7.5
smb3: missing lock when picking channel
In the Linux kernel, the following vulnerability has been resolved: smb3: missing lock when picking channel Coverity spotted a place where we should have been holding the channel lock when accessing the ses channel index. Addresses-Coverity: 1582039 ("Data ra…
-
High 7.5
net: core: reject skb_copy(_expand) for fraglist GSO skbs
In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_…
-
High 7.1
gpiolib: cdev: fix uninitialised kfifo
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix uninitialised kfifo If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection the…
-
Medium 6.5
blk-iocost: avoid out of bounds shift
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: avoid out of bounds shift UBSAN catches undefined behavior in blk-iocost, where sometimes iocg->delay is shifted right by a number that is too large, resulting in undefined behavi…
-
Medium 5.5
dyndbg: fix old BUG_ON in >control parser
In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't really look), lets make sure by removing it, doing pr_err and return -EINVAL instead.
-
Medium 5.5
Reapply "drm/qxl: simplify qxl_fence_wait"
In the Linux kernel, the following vulnerability has been resolved: Reapply "drm/qxl: simplify qxl_fence_wait" This reverts commit 07ed11afb68d94eadd4ffc082b97c2331307c5ea. Stephen Rostedt reports: "I went to run my tests on my VMs and the tests hung on boot …
-
Medium 4.4
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not b…
-
Unscored —
md: fix kmemleak of rdev->serial
In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev->serial If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs. unreferenced object 0xffff88815a350000 (size…
-
Unscored —
mm/hugetlb: fix missing hugetlb_lock for resv uncharge
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_…
-
Unscored —
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute nee…
-
Unscored —
mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() When I did memory failure tests recently, below warning occurs: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 8 PID: 1011 at k…
-
Unscored —
mm: use memalloc_nofs_save() in page_cache_ra_order()
In the Linux kernel, the following vulnerability has been resolved: mm: use memalloc_nofs_save() in page_cache_ra_order() See commit f2c817bed58d ("mm: use memalloc_nofs_save in readahead path"), ensure that page_cache_ra_order() do not attempt to reclaim fil…
-
Unscored —
mptcp: ensure snd_nxt is properly initialized on connect
In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_nxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snd_una: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b…
-
Unscored —
ipv6: prevent NULL dereference in ip6_output()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent NULL dereference in ip6_output() According to syzbot, there is a chance that ip6_dst_idev() returns NULL in ip6_output(). Most places in IPv6 stack deal with a NULL idev just fi…
-
Unscored —
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() syzbot is able to trigger the following crash [1], caused by unsafe ip6_dst_idev() use. Indeed ip6_dst_idev() can retur…
-
Unscored —
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1],…
-
Unscored —
block: fix overflow in blk_ioctl_discard()
In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in blk_ioctl_discard() There is no check for overflow of 'start + len' in blk_ioctl_discard(). Hung task occurs if submit an discard ioctl with the following param: start …
-
Unscored —
xdp: use flags field to disambiguate broadcast redirect
In the Linux kernel, the following vulnerability has been resolved: xdp: use flags field to disambiguate broadcast redirect When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redir…
-
Unscored —
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in …
-
Unscored —
nfs: Handle error of rpc_proc_register() in nfs_net_init().
In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_register() in nfs_net_init(). syzkaller reported a warning [0] triggered while destroying immature netns. rpc_proc_register() was called in init_nfs_fs(), but it…
-
Unscored —
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() incl…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26900.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35947.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35999.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36000.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36017.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36028.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36882.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36883.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36889.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36890.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36896.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36898.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36901.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36902.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36904.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36905.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36909.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36910.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36912.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36916.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36917.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36918.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36929.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36933.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36937.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36938.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36939.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36940.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36944.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36953.html