Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47660: In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENT_WATCHED flags lazily CVE-2024-46763: In the Linux kernel, the following vulnerability has been resolved: fou: Fix null-ptr-deref in GRO. CVE-2024-46717: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release CVE-2024-46711: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix ID 0 endp usage after multiple re-creations CVE-2024-46707: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 CVE-2024-46689: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB CVE-2024-46686: In the Linux kernel, the following vulnerability has been resolved: smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() CVE-2024-46679: In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings CVE-2024-45022: In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 CVE-2024-45021: In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops CVE-2024-45019: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Take state lock during tx timeout reporter CVE-2024-45018: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use CVE-2024-45016: In the Linux kernel, the following vulnerability has been resolved: netem: fix return value if duplicate enqueue fails CVE-2024-45009: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req CVE-2024-45008: In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots CVE-2024-45006: In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration CVE-2024-45003: In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context CVE-2024-45000: In the Linux kernel, the following vulnerability has been resolved: fs/netfs/fscache_cookie: add missing "n_accesses" check CVE-2024-44991: In the Linux kernel, the following vulnerability has been resolved: tcp: prevent concurrent execution of tcp_sk_exit_batch CVE-2024-44990: In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in bond_ipsec_offload_ok CVE-2024-44989: In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null pointer dereference CVE-2024-44986: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() CVE-2024-44983: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header CVE-2024-44974: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp CVE-2024-44947: In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate CVE-2024-44946: In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcm_sendmsg() for the same socket. CVE-2024-43897: In the Linux kernel, the following vulnerability has been resolved: net: drop bad gso csum_start and offset in virtio_net_hdr CVE-2024-43835: In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning CVE-2024-42314: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when adding pages to compressed bio CVE-2024-41098: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error CVE-2024-41096: In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msi_capability_init CVE-2024-40972: In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock CVE-2023-54145: In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log CVE-2023-53728: In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.109-118.189 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.109-118.189.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.109-118.189.amzn2023 |
Vulnerabilities 34
-
Critical 9.8
net/mlx5e: SHAMPO, Fix incorrect page release
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAG…
-
High 8.2
mptcp: pm: only decrement add_addr_accepted for MPJ req
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter hel…
-
High 8.1
ipv6: fix possible UAF in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to mak…
-
High 7.8
PCI/MSI: Fix UAF in msi_capability_init
In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msi_capability_init KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488 Use-after-free read at 0x0000000024629571 (in …
-
High 7.8
btrfs: fix extent map use-after-free when adding pages to compressed bio
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when adding pages to compressed bio At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the ex…
-
High 7.8
net: drop bad gso csum_start and offset in virtio_net_hdr
In the Linux kernel, the following vulnerability has been resolved: net: drop bad gso csum_start and offset in virtio_net_hdr Tighten csum_start and csum_offset checks in virtio_net_hdr_to_skb for GSO packets. The function already checks that a checksum reque…
-
High 7.8CVE-2024-44946 Public exploit
kcm: Serialise kcm_sendmsg() for the same socket.
In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcm_sendmsg() for the same socket. syzkaller reported UAF in kcm_release(). [0] The scenario is 1. Thread A builds a skb with MSG_MORE and sets kcm->seq_skb. 2. Thread A resume…
-
High 7.8
mptcp: pm: avoid possible UaF when selecting endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a …
-
High 7.8
fs/netfs/fscache_cookie: add missing "n_accesses" check
In the Linux kernel, the following vulnerability has been resolved: fs/netfs/fscache_cookie: add missing "n_accesses" check This fixes a NULL pointer dereference bug due to a data race which looks like this: BUG: kernel NULL pointer dereference, address: 0000…
-
High 7.8
netem: fix return value if duplicate enqueue fails
In the Linux kernel, the following vulnerability has been resolved: netem: fix return value if duplicate enqueue fails There is a bug in netem_enqueue() introduced by commit 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") that can lead to…
-
High 7.8
net/mlx5e: Take state lock during tx timeout reporter
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Take state lock during tx timeout reporter mlx5e_safe_reopen_channels() requires the state lock taken. The referenced changed in the Fixes tag removed the lock to fix another issue…
-
High 7.8
mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 The __vmap_pages_range_noflush() assumes its argument pages** contains pages with the same page shift…
-
High 7.5
fou: Fix null-ptr-deref in GRO.
In the Linux kernel, the following vulnerability has been resolved: fou: Fix null-ptr-deref in GRO. We observed a null-ptr-deref in fou_gro_receive() while shutting down a host. [0] The NULL pointer is sk->sk_user_data, and the offset 8 is of protocol in stru…
-
High 7.1
memcg_write_event_control(): fix a user-triggerable oops
In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).
-
Unscored —
posix-timers: Ensure timer ID search-loop limit is valid
In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation…
-
Unscored —
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (a…
-
Unscored —
ext4: do not create EA inode under buffer lock
In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allo…
-
Unscored —
ata: libata-core: Fix null pointer dereference on error
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error If the ata_port_alloc() call in ata_host_alloc() fails, ata_host_release() will get called. However, the code in ata_host_release() tri…
-
Unscored —
virtio_net: Fix napi_skb_cache_put warning
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: …
-
Unscored —CVE-2024-44947 Public exploit
fuse: Initialize beyond-EOF page contents before setting uptodate
In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page c…
-
Unscored —
netfilter: flowtable: validate vlan header
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header Ensure there is sufficient room to access the protocol field of the VLAN header, validate it once before the flowtable lookup. =====================…
-
Unscored —
bonding: fix xfrm real_dev null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null pointer dereference We shouldn't set real_dev to NULL because packets can be in transit and xfrm might call xdo_dev_offload_ok() in parallel. All callbacks ass…
-
Unscored —
bonding: fix null pointer deref in bond_ipsec_offload_ok
In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in bond_ipsec_offload_ok We must check if there is an active slave before dereferencing the pointer.
-
Unscored —
tcp: prevent concurrent execution of tcp_sk_exit_batch
In the Linux kernel, the following vulnerability has been resolved: tcp: prevent concurrent execution of tcp_sk_exit_batch Its possible that two threads call tcp_sk_exit_batch() concurrently, once from the cleanup_net workqueue, once from a task that failed t…
-
Unscored —
vfs: Don't evict inode under the inode lru traversing context
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at f…
-
Unscored —
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-sp…
-
Unscored —
Input: MT - limit max slots
In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible…
-
Unscored —
netfilter: flowtable: initialise extack before use
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload.
-
Unscored —
ethtool: check device is present when getting link settings
In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg…
-
Unscored —
smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
In the Linux kernel, the following vulnerability has been resolved: smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() This happens when called from SMB2_read() while using rdma and reaching the rdma_readwrite_threshold.
-
Unscored —
soc: qcom: cmd-db: Map shared memory as WC, not WB
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache evicti…
-
Unscored —
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a w…
-
Unscored —
mptcp: pm: fix ID 0 endp usage after multiple re-creations
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix ID 0 endp usage after multiple re-creations 'local_addr_used' and 'add_addr_accepted' are decremented for addresses not related to the initial subflow (ID0), because the source…
-
Unscored —
fsnotify: clear PARENT_WATCHED flags lazily
In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENT_WATCHED flags lazily In some setups directories can have many (usually negative) dentries. Hence __fsnotify_update_child_dentry_flags() function can take a significant …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53728.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54145.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40972.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41096.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41098.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-42314.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-43835.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-43897.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44946.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44947.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44974.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44983.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44986.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44989.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44990.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-44991.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45000.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45003.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45006.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45008.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45009.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45016.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45018.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45019.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45021.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-45022.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46679.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46686.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46689.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46707.html