Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-46763: In the Linux kernel, the following vulnerability has been resolved: fou: Fix null-ptr-deref in GRO. CVE-2024-46711: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix ID 0 endp usage after multiple re-creations CVE-2024-46707: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 CVE-2024-46689: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB CVE-2024-46679: In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings CVE-2024-44974: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp CVE-2024-44946: In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcm_sendmsg() for the same socket. CVE-2024-41098: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.109-118.189 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.109-118.189.amzn2023 |
Vulnerabilities 8
-
High 7.8CVE-2024-44946 Public exploit
kcm: Serialise kcm_sendmsg() for the same socket.
In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcm_sendmsg() for the same socket. syzkaller reported UAF in kcm_release(). [0] The scenario is 1. Thread A builds a skb with MSG_MORE and sets kcm->seq_skb. 2. Thread A resume…
-
High 7.8
mptcp: pm: avoid possible UaF when selecting endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a …
-
High 7.5
fou: Fix null-ptr-deref in GRO.
In the Linux kernel, the following vulnerability has been resolved: fou: Fix null-ptr-deref in GRO. We observed a null-ptr-deref in fou_gro_receive() while shutting down a host. [0] The NULL pointer is sk->sk_user_data, and the offset 8 is of protocol in stru…
-
Unscored —
ata: libata-core: Fix null pointer dereference on error
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error If the ata_port_alloc() call in ata_host_alloc() fails, ata_host_release() will get called. However, the code in ata_host_release() tri…
-
Unscored —
ethtool: check device is present when getting link settings
In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg…
-
Unscored —
soc: qcom: cmd-db: Map shared memory as WC, not WB
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache evicti…
-
Unscored —
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a w…
-
Unscored —
mptcp: pm: fix ID 0 endp usage after multiple re-creations
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix ID 0 endp usage after multiple re-creations 'local_addr_used' and 'add_addr_accepted' are decremented for addresses not related to the initial subflow (ID0), because the source…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41098.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44946.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44974.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46679.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46689.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46707.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46711.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46763.html