Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47674: In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case CVE-2024-47668: In the Linux kernel, the following vulnerability has been resolved: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() CVE-2024-47665: In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup CVE-2024-46865: In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc CVE-2024-46858: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync CVE-2024-46857: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs CVE-2024-46855: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks CVE-2024-46848: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Limit the period on Haswell CVE-2024-46840: In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete CVE-2024-46830: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS CVE-2024-46829: In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling CVE-2024-46828: In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness CVE-2024-46826: In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read CVE-2024-46822: In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry CVE-2024-46800: In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue CVE-2024-46783: In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg() CVE-2024-46782: In the Linux kernel, the following vulnerability has been resolved: ila: call nf_unregister_net_hooks() sooner CVE-2024-46777: In the Linux kernel, the following vulnerability has been resolved: udf: Avoid excessive partition lengths CVE-2024-46752: In the Linux kernel, the following vulnerability has been resolved: btrfs: replace BUG_ON() with error handling at update_ref_for_cow() CVE-2024-46750: In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock() CVE-2024-46745: In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots CVE-2024-46744: In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size CVE-2024-46743: In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk CVE-2024-46739: In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind CVE-2024-46738: In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() CVE-2024-46734: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd CVE-2024-46713: In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization CVE-2024-43892: In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr CVE-2023-54247: In the Linux kernel, the following vulnerability has been resolved: bpf: Silence a warning in btf_type_id_size()
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.111-120.187 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.111-120.187.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.111-120.187.amzn2023 |
Vulnerabilities 29
-
Critical 9.8
fou: fix initialization of grc
In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitialized.
-
High 8.1
mptcp: pm: Fix uaf in __timer_delete_sync
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_…
-
High 7.8
memcg: protect concurrent access to mem_cgroup_idr
In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to f…
-
High 7.8
perf/aux: Fix AUX buffer serialization
In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly insufficient to serialize the AUX buffer, add a per RB mutex to fully serialize it. Note that in the loc…
-
High 7.8
btrfs: fix race between direct IO write and fsync when using same fd
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is …
-
High 7.8
VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resour…
-
High 7.8
PCI: Add missing bridge lock to pci_bus_lock()
In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock() One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886…
-
High 7.8
udf: Avoid excessive partition lengths
In the Linux kernel, the following vulnerability has been resolved: udf: Avoid excessive partition lengths Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition le…
-
High 7.8
sch/netem: fix use after free in netem_dequeue
In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog(…
-
High 7.8
KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and l…
-
High 7.8
lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
In the Linux kernel, the following vulnerability has been resolved: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() If we need to increase the tree depth, allocate a new node, and then race with another thread that increased the tree depth b…
-
High 7.8
mm: avoid leaving partial pfn mappings around in error case
In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated wi…
-
High 7.5
netfilter: nft_socket: fix sk refcount leaks
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning.
-
High 7.3
of/irq: Prevent device address out-of-bounds read in interrupt map walk
In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells pr…
-
High 7.1
sched: sch_cake: fix bulk flow accounting logic for host fairness
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is u…
-
Medium 5.5
i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup Definitely condition dma_get_cache_alignment * defined value > 256 during driver initialization is not reason to BUG_ON(). Tu…
-
Unscored —
bpf: Silence a warning in btf_type_id_size()
In the Linux kernel, the following vulnerability has been resolved: bpf: Silence a warning in btf_type_id_size() syzbot reported a warning in [1] with the following stacktrace: WARNING: CPU: 0 PID: 5005 at kernel/bpf/btf.c:1988 btf_type_id_size+0x2d9/0x9d0 ke…
-
Unscored —
uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind For primary VM Bus channels, primary_channel pointer is always NULL. This pointer is valid only for the secondary channel…
-
Unscored —
Squashfs: sanity check symbolic link size
In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbol…
-
Unscored —
Input: uinput - reject requests with unreasonable number of slots
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory…
-
Unscored —
btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
In the Linux kernel, the following vulnerability has been resolved: btrfs: replace BUG_ON() with error handling at update_ref_for_cow() Instead of a BUG_ON() just return an error, log an error message and abort the transaction in case we find an extent buffer…
-
Unscored —
ila: call nf_unregister_net_hooks() sooner
In the Linux kernel, the following vulnerability has been resolved: ila: call nf_unregister_net_hooks() sooner syzbot found an use-after-free Read in ila_nf_input [1] Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hoo…
-
Unscored —
tcp_bpf: fix return value of tcp_bpf_sendmsg()
In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg() When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message siz…
-
Unscored —
arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry In a review discussion of the changes to support vCPU hotplug where a check was added on the GICC being enabled if was onli…
-
Unscored —
ELF: fix kernel.randomize_va_space double read
In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with un…
-
Unscored —
rtmutex: Drop rt_mutex::wait_lock before scheduling
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case…
-
Unscored —
btrfs: clean up our handling of refs == 0 in snapshot delete
In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transi…
-
Unscored —
perf/x86/intel: Limit the period on Haswell
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Limit the period on Haswell Running the ltp test cve-2015-3290 concurrently reports the following warnings. perfevents: irq loop stuck! WARNING: CPU: 31 PID: 32438 at arch/x86…
-
Unscored —
net/mlx5: Fix bridge mode operations when there are no VFs
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa [ 168.967392…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54247.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-43892.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46713.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46734.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46738.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46739.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46743.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46744.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46745.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46750.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46752.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46777.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46782.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46783.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46800.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46822.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46826.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46828.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46829.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46830.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46840.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46848.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46855.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46857.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46858.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46865.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-47665.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-47668.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-47674.html