Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-36008: In the Linux kernel, the following vulnerability has been resolved: ipv4: check for NULL idev in ip_route_use_hint() CVE-2024-36005: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path CVE-2024-35998: In the Linux kernel, the following vulnerability has been resolved: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result CVE-2024-35996: In the Linux kernel, the following vulnerability has been resolved: cpu: Re-enable CPU mitigations by default for !X86 architectures CVE-2024-35995: In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Use access_width over bit_width for system memory accesses CVE-2024-35989: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms CVE-2024-35984: In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: fix NULL function pointer dereference CVE-2024-35981: In the Linux kernel, the following vulnerability has been resolved: virtio_net: Do not send RSS key if it is not supported CVE-2024-35857: In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() CVE-2024-35849: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() CVE-2024-35847: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error CVE-2024-27395: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit CVE-2024-27022: In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized CVE-2024-27020: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() CVE-2024-27019: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() CVE-2024-27018: In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: skip conntrack input hook for promisc packets CVE-2024-27016: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate pppoe header CVE-2024-27015: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: incorrect pppoe tuple CVE-2024-27013: In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev CVE-2024-27004: In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree during disable_unused CVE-2024-27003: In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree for clk_summary CVE-2024-27000: In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state CVE-2024-26993: In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() CVE-2024-26992: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS CVE-2024-26989: In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Fix level3 translation fault in swsusp_save() CVE-2024-26988: In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow CVE-2024-26987: In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled CVE-2024-26983: In the Linux kernel, the following vulnerability has been resolved: bootconfig: use memblock_free_late to free xbc memory to buddy CVE-2024-26939: In the Linux kernel, the following vulnerability has been resolved: drm/i915/vma: Fix UAF on destroy against retire race Object debugging tools were sporadically reporting illegal attempts to free a still active i915 VMA object when parking a GT believed to be idle. CVE-2024-26924: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element CVE-2024-26605: In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of Qualcomm PCIe controllers as reported by lockdep
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.90-99.173 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.90-99.173.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.90-99.173.amzn2023 |
Vulnerabilities 31
-
High 8.2
netfilter: br_netfilter: skip conntrack input hook for promisc packets
In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: skip conntrack input hook for promisc packets For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input…
-
High 7.8
netfilter: nft_set_pipapo: do not free live element
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 10…
-
High 7.8
drm/i915/vma: Fix UAF on destroy against retire race
In the Linux kernel, the following vulnerability has been resolved: drm/i915/vma: Fix UAF on destroy against retire race Object debugging tools were sporadically reporting illegal attempts to free a still active i915 VMA object when parking a GT believed to b…
-
High 7.8
bootconfig: use memblock_free_late to free xbc memory to buddy
In the Linux kernel, the following vulnerability has been resolved: bootconfig: use memblock_free_late to free xbc memory to buddy On the time to free xbc memory in xbc_exit(), memblock may has handed over memory to buddy allocator. So it doesn't make sense t…
-
High 7.8
netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_table…
-
High 7.8
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_ta…
-
High 7.8
fork: defer linking file vma until vma is fully initialized
In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork hugetlbfs_fallocate dup_mmap hugetlbfs_punch_ho…
-
High 7.8
net: openvswitch: Fix Use-After-Free in ovs_ct_exit
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical secti…
-
High 7.8
irqchip/gic-v3-its: Prevent double free on error
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least on…
-
High 7.5
icmp: prevent possible NULL dereferences from icmp_build_probe()
In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL. if (__in_dev_get_rcu(dev) && _…
-
High 7.5
smb3: fix lock ordering potential deadlock in cifs_sync_mid_result
In the Linux kernel, the following vulnerability has been resolved: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result Coverity spotted that the cifs_sync_mid_result function could deadlock "Thread deadlock (ORDER_REVERSAL) lock_order: Calling…
-
High 7.3
KVM: x86/pmu: Disable support for adaptive PEBS
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and becaus…
-
High 7.1
netfilter: flowtable: validate pppoe header
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate pppoe header Ensure there is sufficient room to access the protocol field of the PPPoe header. Validate it once before the flowtable lookup, then use a helper f…
-
Medium 5.5
dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms During the removal of the idxd driver, registered offline callback is invoked as part of the clean up process. However, on syste…
-
Unscored —
PCI/ASPM: Fix deadlock when enabling ASPM
In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of Qualcomm PCIe controllers as reported by lockdep…
-
Unscored —
mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled When I did hard offline test with hugetlb pages, below deadlock occurs: ==============================================…
-
Unscored —
init/main.c: Fix potential static_command_line memory overflow
In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_co…
-
Unscored —
arm64: hibernate: Fix level3 translation fault in swsusp_save()
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Fix level3 translation fault in swsusp_save() On arm64 machines, swsusp_save() faults if it attempts to access MEMBLOCK_NOMAP memory ranges. This can be reproduced in QEMU u…
-
Unscored —
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_ge…
-
Unscored —
serial: mxs-auart: add spinlock around changing cts state
In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kerne…
-
Unscored —
clk: Get runtime PM before walking tree for clk_summary
In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree for clk_summary Similar to the previous commit, we should make sure that all devices are runtime resumed before printing the clk_summary through debugf…
-
Unscored —
clk: Get runtime PM before walking tree during disable_unused
In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree during disable_unused Doug reported [1] the following hung task: INFO: task swapper/0:1 blocked for more than 122 seconds. Not tainted 5.15.149-21875-g…
-
Unscored —
tun: limit printing rate when illegal packet received by tun dev
In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping p…
-
Unscored —
netfilter: flowtable: incorrect pppoe tuple
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: incorrect pppoe tuple pppoe traffic reaching ingress path does not match the flowtable entry because the pppoe header is expected to be at the network header offset. Thi…
-
Unscored —
btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_…
-
Unscored —
virtio_net: Do not send RSS key if it is not supported
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Do not send RSS key if it is not supported There is a bug when setting the RSS options in virtio_net that can break the whole machine, getting the kernel into an infinite loop. Ru…
-
Unscored —
i2c: smbus: fix NULL function pointer dereference
In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: fix NULL function pointer dereference Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function …
-
Unscored —
ACPI: CPPC: Use access_width over bit_width for system memory accesses
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Use access_width over bit_width for system memory accesses To align with ACPI 6.3+, since bit_width can be any 8-bit value, it cannot be depended on to be always on a clean 8b bou…
-
Unscored —
cpu: Re-enable CPU mitigations by default for !X86 architectures
In the Linux kernel, the following vulnerability has been resolved: cpu: Re-enable CPU mitigations by default for !X86 architectures Rename x86's to CPU_MITIGATIONS, define it in generic code, and force it on for all architectures exception x86. A recent comm…
-
Unscored —
netfilter: nf_tables: honor table dormant flag from netdev release event path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook…
-
Unscored —
ipv4: check for NULL idev in ip_route_use_hint()
In the Linux kernel, the following vulnerability has been resolved: ipv4: check for NULL idev in ip_route_use_hint() syzbot was able to trigger a NULL deref in fib_validate_source() in an old tree [1]. It appears the bug exists in latest trees. All calls to _…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26605.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26924.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26939.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26983.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26987.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26988.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26989.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26992.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26993.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27000.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27003.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27004.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27013.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27015.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27016.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27018.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27019.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27020.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27022.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-27395.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35847.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35849.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35857.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35981.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35984.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35989.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35995.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35996.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-35998.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36005.html