Skip to content
OpenAdvisories
Medium ALAS2023-2024-765 5 CVEs

Moderate: kernel security update (Amazon Linux 2023)

Published Nov 13, 2024 · Updated Dec 5, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47685: syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zero() to clear the whole TCP header, as done in nf_reject_ip_tcphdr_put() CVE-2024-46695: In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook CVE-2024-38632: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix potential memory leak in vfio_intx_enable() CVE-2024-35963: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input CVE-2023-52751: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2_query_info_compound()

Fixed packages 21

ReleasePackageFixed in
Amazon Linux · 2023 bpftool 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 bpftool-debuginfo 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-debuginfo 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-aarch64 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-x86_64 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-devel 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-headers 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-libbpf 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-libbpf-devel 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-libbpf-static 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-livepatch-6.1.115-126.197 0:1.0-0.amzn2023
Amazon Linux · 2023 kernel-modules-extra 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-modules-extra-common 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-tools 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-tools-debuginfo 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 kernel-tools-devel 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 perf 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 perf-debuginfo 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 python3-perf 0:6.1.115-126.197.amzn2023
Amazon Linux · 2023 python3-perf-debuginfo 0:6.1.115-126.197.amzn2023

Vulnerabilities 5

  • Critical 9.8
    CVE-2024-46695

    selinux,smack: don't bypass permissions check in inode_setsecctx hook

    In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesys…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-52751

    smb: client: fix use-after-free in smb2_query_info_compound()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2_query_info_compound() The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2024-35963

    Bluetooth: hci_sock: Fix not validating setsockopt user input

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input Check user input length before copying data.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-38632

    vfio/pci: fix potential memory leak in vfio_intx_enable()

    In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix potential memory leak in vfio_intx_enable() If vfio_irq_ctx_alloc() failed will lead to 'name' memory leak.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-47685

    netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-52751.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-35963.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-38632.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-46695.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-47685.html