Skip to content
OpenAdvisories
Medium ALAS2023-2024-709 13 CVEs

Moderate: kernel security update (Amazon Linux 2023)

Published Aug 28, 2024 · Updated Dec 5, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-44944: In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID CVE-2024-44934: In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: wait for previous gc cycles when removing port CVE-2024-43873: In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacket_allow CVE-2024-43871: In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() CVE-2024-43870: In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit CVE-2024-43869: In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release CVE-2024-43823: In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() CVE-2024-42302: In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal CVE-2024-42268: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync reset reload CVE-2024-42259: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation CVE-2024-42258: In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines CVE-2024-42159: In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitise num_phys CVE-2024-41042: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate

Fixed packages 21

ReleasePackageFixed in
Amazon Linux · 2023 bpftool 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 bpftool-debuginfo 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-debuginfo 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-aarch64 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-x86_64 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-devel 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-headers 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-libbpf 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-libbpf-devel 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-libbpf-static 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-livepatch-6.1.106-116.188 0:1.0-0.amzn2023
Amazon Linux · 2023 kernel-modules-extra 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-modules-extra-common 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-tools 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-tools-debuginfo 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 kernel-tools-devel 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 perf 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 perf-debuginfo 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 python3-perf 0:6.1.106-116.188.amzn2023
Amazon Linux · 2023 python3-perf-debuginfo 0:6.1.106-116.188.amzn2023

Vulnerabilities 13

  • High 7.8
    CVE-2024-42259

    drm/i915/gem: Fix Virtual Memory mapping boundaries calculation

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-44934

    net: bridge: mcast: wait for previous gc cycles when removing port

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: wait for previous gc cycles when removing port syzbot hit a use-after-free[1] which is caused because the bridge doesn't make sure that all previous garbage has been colle…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2024-42258

    mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines

    In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit"…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-41042

    netfilter: nf_tables: prefer nft_chain_validate

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-42159

    scsi: mpi3mr: Sanitise num_phys

    In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitise num_phys Information is stored in mr_sas_port->phy_mask, values larger then size of this field shouldn't be allowed.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-42268

    net/mlx5: Fix missing lock on sync reset reload

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on that host, it misses taking devlink lock before call…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-42302

    PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal

    In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-43823

    PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()

    In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() If IORESOURCE_MEM is not provided in Device Tree due to any error, resource_list_first_type() wi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-43869

    perf: Fix event leak upon exec and file release

    In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release The perf pending task work is never waited upon the matching event release. In the case of a child event, released via free_event() directly, t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-43870

    perf: Fix event leak upon exit

    In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-43871

    devres: Fix memory leakage caused by driver API devm_free_percpu()

    In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory leakage when use driver API devm_free_percpu() to free memory allocated by devm_alloc_percpu(), fixed b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-43873

    vhost/vsock: always initialize seqpacket_allow

    In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacket_allow There are two issues around seqpacket_allow: 1. seqpacket_allow is not initialized when socket is created. Thus if features are never set, it wi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-44944

    netfilter: ctnetlink: use helper function to calculate expect ID

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-41042.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-42159.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-42258.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-42259.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-42268.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-42302.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-43823.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-43869.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-43870.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-43871.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-43873.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-44934.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-44944.html