Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-41001: In the Linux kernel, the following vulnerability has been resolved: io_uring/sqpoll: work around a potential audit memory leak CVE-2024-41000: In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check CVE-2024-40996: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskb_pull_reason CVE-2024-40995: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() CVE-2024-40989: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Disassociate vcpus from redistributor region on teardown CVE-2024-40984: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." CVE-2024-40966: In the Linux kernel, the following vulnerability has been resolved: tty: add the option to have a tty reject a new ldisc CVE-2024-40961: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL deref in fib6_nh_init() CVE-2024-40960: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL dereference in rt6_probe() CVE-2024-40959: In the Linux kernel, the following vulnerability has been resolved: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() CVE-2024-40958: In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle zero refcount net CVE-2024-40957: In the Linux kernel, the following vulnerability has been resolved: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors CVE-2024-40954: In the Linux kernel, the following vulnerability has been resolved: net: do not leave a dangling sk pointer, when socket creation fails CVE-2024-40953: In the Linux kernel, the following vulnerability has been resolved: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() CVE-2024-40948: In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: fix crash on ZONE_DEVICE CVE-2024-40935: In the Linux kernel, the following vulnerability has been resolved: cachefiles: flush all requests after setting CACHEFILES_DEAD CVE-2024-40931: In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect CVE-2024-40927: In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case CVE-2024-40924: In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Make DPT object unshrinkable CVE-2024-40921: In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state CVE-2024-40920: In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state CVE-2024-40914: In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: don't unpoison huge_zero_folio CVE-2024-40913: In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds CVE-2024-40908: In the Linux kernel, the following vulnerability has been resolved: bpf: Set run context for rawtp test_run callback CVE-2024-40905: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() CVE-2024-40904: In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages CVE-2024-40901: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory CVE-2024-40900: In the Linux kernel, the following vulnerability has been resolved: cachefiles: remove requests from xarray during flushing requests CVE-2024-39509: In the Linux kernel, the following vulnerability has been resolved: HID: core: remove unnecessary WARN_ON() in implement() CVE-2024-39503: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type CVE-2024-39500: In the Linux kernel, the following vulnerability has been resolved: sock_map: avoid race between sock_map_close and sk_psock_put CVE-2024-39499: In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() CVE-2024-39496: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace CVE-2024-39474: In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL CVE-2024-39371: In the Linux kernel, the following vulnerability has been resolved: io_uring: check for non-NULL file pointer in io_file_can_poll() CVE-2024-39298: In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages CVE-2024-38619: In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized CVE-2024-36978: In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.96-102.177 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.96-102.177.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.96-102.177.amzn2023 |
Vulnerabilities 38
-
High 7.9
KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
In the Linux kernel, the following vulnerability has been resolved: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the loads and stores are atomic. In the extremely unlikely s…
-
High 7.8
net: sched: sch_multiq: fix possible OOB write in multiq_tune()
In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used…
-
High 7.8
btrfs: zoned: fix use-after-free due to race with dev replace
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace While loading a zone's info during creation of a block group, we can race with a device replace operation and then trigger a use-…
-
High 7.8
sock_map: avoid race between sock_map_close and sk_psock_put
In the Linux kernel, the following vulnerability has been resolved: sock_map: avoid race between sock_map_close and sk_psock_put sk_psock_get will return NULL if the refcount of psock has gone to 0, which will happen when the last call of sk_psock_put is done…
-
High 7.8
netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage coll…
-
High 7.8
cachefiles: remove requests from xarray during flushing requests
In the Linux kernel, the following vulnerability has been resolved: cachefiles: remove requests from xarray during flushing requests Even with CACHEFILES_DEAD set, we can still read the requests, so in the following concurrency the request may be used after i…
-
High 7.8
drm/i915/dpt: Make DPT object unshrinkable
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Make DPT object unshrinkable In some scenarios, the DPT object gets shrunk but the actual framebuffer did not and thus its still there on the DPT's vm->bound_list. Then it tries…
-
High 7.8
net: do not leave a dangling sk pointer, when socket creation fails
In the Linux kernel, the following vulnerability has been resolved: net: do not leave a dangling sk pointer, when socket creation fails It is possible to trigger a use-after-free by: * attaching an fentry probe to __sock_release() and the probe calling the bp…
-
High 7.8
netns: Make get_net_ns() handle zero refcount net
In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle zero refcount net Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xd…
-
High 7.8
ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel i…
-
High 7.8
KVM: arm64: Disassociate vcpus from redistributor region on teardown
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Disassociate vcpus from redistributor region on teardown When tearing down a redistributor region, make sure we don't have any dangling pointer to that region stored in a vcpu.
-
High 7.5
seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
In the Linux kernel, the following vulnerability has been resolved: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for PREROUTING hook, in PREROUTING h…
-
High 7.3
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions …
-
High 7.1
net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state I converted br_mst_set_state to RCU to avoid a vlan use-after-free but forgot to change the vlan group dereference helper. Switc…
-
Unscored —
usb-storage: alauda: Check whether the media is initialized
In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alaud…
-
Unscored —
mm/memory-failure: fix handling of dissolved but not taken off from buddy pages
In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages When I did memory failure tests recently, below panic occurs: page: refcount:0 mapcount:0 mapping:0000000000000…
-
Unscored —
io_uring: check for non-NULL file pointer in io_file_can_poll()
In the Linux kernel, the following vulnerability has been resolved: io_uring: check for non-NULL file pointer in io_file_can_poll() In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had…
-
Unscored —
mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") includes support for __GFP_NOFAIL, but it pres…
-
Unscored —
vmci: prevent speculation leaks by sanitizing event in event_deliver()
In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() an…
-
Unscored —
HID: core: remove unnecessary WARN_ON() in implement()
In the Linux kernel, the following vulnerability has been resolved: HID: core: remove unnecessary WARN_ON() in implement() Syzkaller hit a warning [1] in a call to implement() when trying to write a value into a field of smaller size in an output report. Sinc…
-
Unscored —
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driv…
-
Unscored —
ipv6: fix possible race in __fib6_drop_pcpu_from()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu…
-
Unscored —
bpf: Set run context for rawtp test_run callback
In the Linux kernel, the following vulnerability has been resolved: bpf: Set run context for rawtp test_run callback syzbot reported crash when rawtp program executed through the test_run interface calls bpf_get_attach_cookie helper or any other helper that t…
-
Unscored —
cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have go…
-
Unscored —
mm/huge_memory: don't unpoison huge_zero_folio
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: don't unpoison huge_zero_folio When I did memory failure tests recently, below panic occurs: kernel BUG at include/linux/mm.h:1135! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI…
-
Unscored —
net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state Pass the already obtained vlan group pointer to br_mst_vlan_set_state() instead of dereferencing it again. Each caller has …
-
Unscored —
xhci: Handle TD clearing for multiple streams case
In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for…
-
Unscored —
mptcp: ensure snd_una is properly initialized on connect
In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It turns out that syzkal…
-
Unscored —
cachefiles: flush all requests after setting CACHEFILES_DEAD
In the Linux kernel, the following vulnerability has been resolved: cachefiles: flush all requests after setting CACHEFILES_DEAD In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILES_DEAD, the cachefiles_…
-
Unscored —
mm/page_table_check: fix crash on ZONE_DEVICE
In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: fix crash on ZONE_DEVICE Not all pages may apply to pgtable check. One example is ZONE_DEVICE pages: they map PFNs directly, and they don't allocate page_ext at all even …
-
Unscored —
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
In the Linux kernel, the following vulnerability has been resolved: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() ip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly. syzbot reported: Oops: general protection fault, probably…
-
Unscored —
ipv6: prevent possible NULL dereference in rt6_probe()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL dereference in rt6_probe() syzbot caught a NULL dereference in rt6_probe() [1] Bail out if __in6_dev_get() returns NULL. [1] Oops: general protection fault, probab…
-
Unscored —
ipv6: prevent possible NULL deref in fib6_nh_init()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL deref in fib6_nh_init() syzbot reminds us that in6_dev_get() can return NULL. fib6_nh_init() ip6_validate_gw( &idev ) ip6_route_check_nh( idev ) *idev = in6_dev_ge…
-
Unscored —
tty: add the option to have a tty reject a new ldisc
In the Linux kernel, the following vulnerability has been resolved: tty: add the option to have a tty reject a new ldisc ... and use it to limit the virtual terminals to just N_TTY. They are kind of special, and in particular, the "con_write()" routine violat…
-
Unscored —
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to add …
-
Unscored —
bpf: Avoid splat in pskb_pull_reason
In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskb_pull_reason syzkaller builds (CONFIG_DEBUG_NET=y) frequently trigger a debug hint in pskb_may_pull. We'd like to retain this debug check because it might hint at inte…
-
Unscored —
block/ioctl: prefer different overflow check
In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed integer overflow sanitizer shows this report: [ 62.982337] ------------[ cut here ]----------…
-
Unscored —
io_uring/sqpoll: work around a potential audit memory leak
In the Linux kernel, the following vulnerability has been resolved: io_uring/sqpoll: work around a potential audit memory leak kmemleak complains that there's a memory leak related to connect handling: unreferenced object 0xffff0001093bdf00 (size 128): comm "…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36978.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-38619.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39298.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39371.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39474.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39496.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39499.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39500.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39503.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-39509.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40900.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40901.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40904.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40905.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40908.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40913.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40914.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40920.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40921.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40924.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40927.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40931.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40935.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40948.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40953.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40954.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40957.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40958.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40959.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40960.html