Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-42247: In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses CVE-2024-42246: In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket CVE-2024-42245: In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" CVE-2024-42244: In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume CVE-2024-42240: In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation CVE-2024-42232: In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() CVE-2024-42229: In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use CVE-2024-42161: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD CVE-2024-42154: In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length CVE-2024-42136: In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow CVE-2024-42131: In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic CVE-2024-42109: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally flush pending work before notifier CVE-2024-42106: In the Linux kernel, the following vulnerability has been resolved: inet_diag: Initialize pad field in struct inet_diag_req_v2 CVE-2024-42103: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix adding block group to a reclaim list and the unused list during reclaim CVE-2024-42102: In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" CVE-2024-41091: kernel: virtio-net: tun: mlx5_core short frame denial of service CVE-2024-41090: kernel: virtio-net: tap: mlx5_core short frame denial of service CVE-2024-41081: In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() CVE-2024-41078: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure CVE-2024-41077: In the Linux kernel, the following vulnerability has been resolved: null_blk: fix validation of block size CVE-2024-41076: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix memory leak in nfs4_set_security_label CVE-2024-41075: In the Linux kernel, the following vulnerability has been resolved: cachefiles: add consistency check for copen/cread CVE-2024-41074: In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set object to close if ondemand_id < 0 in copen CVE-2024-41073: In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload CVE-2024-41058: In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() CVE-2024-41057: In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() CVE-2024-41055: In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() CVE-2024-41051: In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemand_object_worker to finish when dropping object CVE-2024-41050: In the Linux kernel, the following vulnerability has been resolved: cachefiles: cyclic allocation of msg_id to avoid reuse CVE-2024-41049: In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode CVE-2024-41048: In the Linux kernel, the following vulnerability has been resolved: skmsg: Skip zero length skb in sk_msg_recvmsg CVE-2024-41041: In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). CVE-2024-41035: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor CVE-2024-41027: In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL as expected CVE-2024-41020: In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path CVE-2024-41019: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate ff offset CVE-2024-41012: In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected CVE-2024-41007: In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets CVE-2024-40947: In the Linux kernel, the following vulnerability has been resolved: ima: Avoid blocking in RCU read-side critical section CVE-2024-39487: In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.102-108.177 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.102-108.177.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.102-108.177.amzn2023 |
Vulnerabilities 40
-
Critical 9.8
nvme: avoid double free special payload
In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECI…
-
Critical 9.8
ila: block BH in ila_output()
In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is c…
-
Critical 9.8
libceph: fix race between delayed_work() and ceph_monc_stop()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Bo…
-
High 8.8
tap: add missing verification for short frame
In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be…
-
High 8.8
tun: add missing verification for short frame
In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent…
-
High 7.8
ima: Avoid blocking in RCU read-side critical section
In the Linux kernel, the following vulnerability has been resolved: ima: Avoid blocking in RCU read-side critical section A panic happens in ima_match_policy: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 PGD 42f873067 P4D 0 Oops: …
-
High 7.8
filelock: Remove locks reliably when fcntl/close race is detected
In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the firs…
-
High 7.8
fs/ntfs3: Validate ff offset
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate ff offset This adds sanity checks for ff offset. There is a check on rt->first_free at first, but walking through by ff without any check. If the second ff is a large offse…
-
High 7.8
filelock: Fix fcntl/close race recovery compat path
In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies …
-
High 7.8
udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). syzkaller triggered the warning [0] in udp_v4_early_demux(). In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount of …
-
High 7.8
filelock: fix potential use-after-free in posix_lock_inode
In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a loc…
-
High 7.8
cachefiles: wait for ondemand_object_worker to finish when dropping object
In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemand_object_worker to finish when dropping object When queuing ondemand_object_worker() to re-open the object, cachefiles_object is not pinned. The cachefiles_object …
-
High 7.8
cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() We got the following issue in our fault injection stress test: ============================================================…
-
High 7.8
cachefiles: add consistency check for copen/cread
In the Linux kernel, the following vulnerability has been resolved: cachefiles: add consistency check for copen/cread This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below: * Gener…
-
High 7.8
btrfs: fix adding block group to a reclaim list and the unused list during reclaim
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix adding block group to a reclaim list and the unused list during reclaim There is a potential parallel list adding for retrying in btrfs_reclaim_bgs_work and adding to the unused li…
-
High 7.8
netfilter: nf_tables: unconditionally flush pending work before notifier
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally flush pending work before notifier syzbot reports: KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf in nft_commit…
-
High 7.5
tcp: avoid too many retransmit packets
In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCP_USER_TIMEOUT, and the other peer retracted its window to zero, tcp_retransmit_timer() can retransmit a packet every two jif…
-
High 7.5
skmsg: Skip zero length skb in sk_msg_recvmsg
In the Linux kernel, the following vulnerability has been resolved: skmsg: Skip zero length skb in sk_msg_recvmsg When running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch platform, the following kernel panic occurs: [...] Oops[#1]: CPU: 22 PI…
-
High 7.5
wireguard: allowedips: avoid unaligned 64-bit memory accesses
In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses On the parisc platform, the kernel issues kernel warnings because swap_endian() tries to load a 128-bit IPv6 address from an unal…
-
High 7.1
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte…
-
Unscored —
Fix userfaultfd_api to return EINVAL as expected
In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL as expected Currently if we request a feature that is not set in the Kernel config we fail silently and return all the available features. However, the ma…
-
Unscored —
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved…
-
Unscored —
cachefiles: cyclic allocation of msg_id to avoid reuse
In the Linux kernel, the following vulnerability has been resolved: cachefiles: cyclic allocation of msg_id to avoid reuse Reusing the msg_id after a maliciously completed reopen request may cause a read request to remain unprocessed and result in a hung, as …
-
Unscored —
mm: prevent derefencing NULL ptr in pfn_section_valid()
In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call…
-
Unscored —
cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() We got the following issue in our fault injection stress test: ===============================================================…
-
Unscored —
cachefiles: Set object to close if ondemand_id < 0 in copen
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set object to close if ondemand_id < 0 in copen If copen is maliciously called in the user mode, it may delete the request corresponding to the random id. And the request may have…
-
Unscored —
NFSv4: Fix memory leak in nfs4_set_security_label
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix memory leak in nfs4_set_security_label We leak nfs_fattr and nfs4_label every time we set a security xattr.
-
Unscored —
null_blk: fix validation of block size
In the Linux kernel, the following vulnerability has been resolved: null_blk: fix validation of block size Block size should be between 512 and PAGE_SIZE and be a power of 2. The current check does not validate this, so update the check. Without this patch, n…
-
Unscored —
btrfs: qgroup: fix quota root leak after quota disable failure
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'o…
-
Unscored —
Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in …
-
Unscored —
inet_diag: Initialize pad field in struct inet_diag_req_v2
In the Linux kernel, the following vulnerability has been resolved: inet_diag: Initialize pad field in struct inet_diag_req_v2 KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw sockets uses the pad field in struct inet_diag_req_v2 for the u…
-
Unscored —
mm: avoid overflows in dirty throttling logic
In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications…
-
Unscored —
cdrom: rearrange last_media_change check to avoid unintentional overflow
In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter this splat: [ 366.015950…
-
Unscored —
tcp_metrics: validate source addr length
In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at al…
-
Unscored —
bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - Use a default branch in the switch statement to initialize `val'.] GCC warns that `val' may be used uninitialized …
-
Unscored —
crypto: aead,cipher - zeroize key buffer after use
In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer n…
-
Unscored —
x86/bhi: Avoid warning in #DB handler due to BHI mitigation
In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY …
-
Unscored —
USB: serial: mos7840: fix crash on resume
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic re…
-
Unscored —
Revert "sched/fair: Make sure to try to detach at least one movable task"
In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. b0defa7ae03ec changed the load balancing logic to ignor…
-
Unscored —
net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to lo…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39487.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40947.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41007.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41012.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41019.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41020.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41027.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41035.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41041.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41048.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41049.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41050.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41051.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41055.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41057.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41058.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41073.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41074.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41075.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41076.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41077.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41078.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41081.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41090.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41091.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42102.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42103.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42106.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42109.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42131.html