Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-54236: In the Linux kernel, the following vulnerability has been resolved: net/net_failover: fix txq exceeding warning CVE-2023-53684: In the Linux kernel, the following vulnerability has been resolved: xfrm: Zero padding when dumping algos and encap CVE-2023-53378: In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Treat the DPT BO as a framebuffer CVE-2023-53348: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock when aborting transaction during relocation with scrub CVE-2023-53246: In the Linux kernel, the following vulnerability has been resolved: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL CVE-2023-53093: In the Linux kernel, the following vulnerability has been resolved: tracing: Do not let histogram values have some modifiers CVE-2023-53088: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix UaF in listener shutdown CVE-2023-53083: In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page CVE-2023-53080: In the Linux kernel, the following vulnerability has been resolved: xsk: Add missing overflow check in xdp_umem_reg CVE-2023-53073: In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Always clear status for idx CVE-2023-53072: In the Linux kernel, the following vulnerability has been resolved: mptcp: use the workqueue to destroy unaccepted sockets CVE-2023-53065: In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output CVE-2023-53060: In the Linux kernel, the following vulnerability has been resolved: igb: revert rtnl_lock() that causes deadlock CVE-2023-53055: In the Linux kernel, the following vulnerability has been resolved: fscrypt: destroy keyring after security_sb_delete() CVE-2023-53053: In the Linux kernel, the following vulnerability has been resolved: erspan: do not use skb_mac_header() in ndo_start_xmit() CVE-2023-53051: In the Linux kernel, the following vulnerability has been resolved: dm crypt: add cond_resched() to dmcrypt_write() CVE-2023-53044: In the Linux kernel, the following vulnerability has been resolved: dm stats: check for and propagate alloc_percpu failure CVE-2023-2194: An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. CVE-2023-1611: A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea CVE-2023-1583: A NULL pointer dereference has been discovered in the Linux Kernel, in io_file_bitmap_get in io_uring/filetable.c. CVE-2022-4269: A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.23-36.46 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.23-36.46.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.23-36.46.amzn2023 |
Vulnerabilities 21
-
Critical 9.8
nfsd: don't replace page in rq_pages if it's a continuation of last page
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's …
-
High 7.8
perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output syzkaller reportes a KASAN issue with stack-out-of-bounds. The call trace is as follows: dump_stack+…
-
High 7.8
mptcp: use the workqueue to destroy unaccepted sockets
In the Linux kernel, the following vulnerability has been resolved: mptcp: use the workqueue to destroy unaccepted sockets Christoph reported a UaF at token lookup time after having refactored the passive socket initialization part: BUG: KASAN: use-after-free…
-
High 7.8
xsk: Add missing overflow check in xdp_umem_reg
In the Linux kernel, the following vulnerability has been resolved: xsk: Add missing overflow check in xdp_umem_reg The number of chunks can overflow u32. Make sure to return -EINVAL on overflow. Also remove a redundant u32 cast assigning umem->npgs.
-
High 7.8
mptcp: fix UaF in listener shutdown
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix UaF in listener shutdown As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path is prone to an UaF issue. BUG: KASAN: …
-
High 7.8
drm/i915/dpt: Treat the DPT BO as a framebuffer
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Treat the DPT BO as a framebuffer Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that t…
-
Medium 6.7
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->bl…
-
Medium 6.3
A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows …
-
Medium 5.5
A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirec…
-
Medium 5.5
A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the…
-
Medium 5.5
btrfs: fix deadlock when aborting transaction during relocation with scrub
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock when aborting transaction during relocation with scrub Before relocating a block group we pause scrub, then do the relocation and then unpause scrub. The relocation proces…
-
Unscored —
dm stats: check for and propagate alloc_percpu failure
In the Linux kernel, the following vulnerability has been resolved: dm stats: check for and propagate alloc_percpu failure Check alloc_precpu()'s return value and return an error from dm_stats_init() if it fails. Update alloc_dev() to fail if dm_stats_init() …
-
Unscored —
dm crypt: add cond_resched() to dmcrypt_write()
In the Linux kernel, the following vulnerability has been resolved: dm crypt: add cond_resched() to dmcrypt_write() The loop in dmcrypt_write may be running for unbounded amount of time, thus we need cond_resched() in it. This commit fixes the following warni…
-
Unscored —
erspan: do not use skb_mac_header() in ndo_start_xmit()
In the Linux kernel, the following vulnerability has been resolved: erspan: do not use skb_mac_header() in ndo_start_xmit() Drivers should not assume skb_mac_header(skb) == skb->data in their ndo_start_xmit(). Use skb_network_offset() and skb_transport_offset…
-
Unscored —
fscrypt: destroy keyring after security_sb_delete()
In the Linux kernel, the following vulnerability has been resolved: fscrypt: destroy keyring after security_sb_delete() fscrypt_destroy_keyring() must be called after all potentially-encrypted inodes were evicted; otherwise it cannot safely destroy the keyrin…
-
Unscored —
igb: revert rtnl_lock() that causes deadlock
In the Linux kernel, the following vulnerability has been resolved: igb: revert rtnl_lock() that causes deadlock The commit 6faee3d4ee8b ("igb: Add lock to avoid data race") adds rtnl_lock to eliminate a false data race shown below (FREE from device detaching…
-
Unscored —
perf/x86/amd/core: Always clear status for idx
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Always clear status for idx The variable 'status' (which contains the unhandled overflow bits) is not being properly masked in some cases, displaying the following warning:…
-
Unscored —
tracing: Do not let histogram values have some modifiers
In the Linux kernel, the following vulnerability has been resolved: tracing: Do not let histogram values have some modifiers Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or grouped in buckets or log. Give an error if a value is…
-
Unscored —
cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
In the Linux kernel, the following vulnerability has been resolved: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL…
-
Unscored —
xfrm: Zero padding when dumping algos and encap
In the Linux kernel, the following vulnerability has been resolved: xfrm: Zero padding when dumping algos and encap When copying data to user-space we should ensure that only valid data is copied over. Padding in structures may be filled with random (possibly…
-
Unscored —
net/net_failover: fix txq exceeding warning
In the Linux kernel, the following vulnerability has been resolved: net/net_failover: fix txq exceeding warning The failover txq is inited as 16 queues. when a packet is transmitted from the failover device firstly, the failover device will select the queue w…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-4269.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1583.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-1611.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53044.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53051.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53053.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53055.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53060.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53065.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53072.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53073.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53080.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53083.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53088.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53093.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53246.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53348.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53378.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53684.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54236.html