ALAS2-2020-1556


Amazon Linux 2 Security Advisory: ALAS-2020-1556
Advisory Release Date: 2020-11-09 17:10 Pacific
Advisory Updated Date: 2020-11-11 18:07 Pacific
Severity: Important

Issue Overview:

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161151868References: N/A (cve-2020-0423)

A flaw was found in the way the Linux kernel's Bluetooth implementation handled L2CAP (Logical Link Control and Adaptation Protocol) packets with A2MP (Alternate MAC-PHY Manager Protocol) CID (Channel Identifier). This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-12351 )

An information leak flaw was found in the way Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP (Alternate MAC-PHY Manager Protocol) packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-12352 )

A heap buffer overflow flaw was found in the way the Linux kernel's Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-24490 )

A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25211 )


Affected Packages:

kernel


Issue Correction:
Run yum update kernel to update your system.

New Packages:
aarch64:
    kernel-4.14.203-156.332.amzn2.aarch64
    kernel-headers-4.14.203-156.332.amzn2.aarch64
    kernel-debuginfo-common-aarch64-4.14.203-156.332.amzn2.aarch64
    perf-4.14.203-156.332.amzn2.aarch64
    perf-debuginfo-4.14.203-156.332.amzn2.aarch64
    python-perf-4.14.203-156.332.amzn2.aarch64
    python-perf-debuginfo-4.14.203-156.332.amzn2.aarch64
    kernel-tools-4.14.203-156.332.amzn2.aarch64
    kernel-tools-devel-4.14.203-156.332.amzn2.aarch64
    kernel-tools-debuginfo-4.14.203-156.332.amzn2.aarch64
    kernel-devel-4.14.203-156.332.amzn2.aarch64
    kernel-debuginfo-4.14.203-156.332.amzn2.aarch64

i686:
    kernel-headers-4.14.203-156.332.amzn2.i686

src:
    kernel-4.14.203-156.332.amzn2.src

x86_64:
    kernel-4.14.203-156.332.amzn2.x86_64
    kernel-headers-4.14.203-156.332.amzn2.x86_64
    kernel-debuginfo-common-x86_64-4.14.203-156.332.amzn2.x86_64
    perf-4.14.203-156.332.amzn2.x86_64
    perf-debuginfo-4.14.203-156.332.amzn2.x86_64
    python-perf-4.14.203-156.332.amzn2.x86_64
    python-perf-debuginfo-4.14.203-156.332.amzn2.x86_64
    kernel-tools-4.14.203-156.332.amzn2.x86_64
    kernel-tools-devel-4.14.203-156.332.amzn2.x86_64
    kernel-tools-debuginfo-4.14.203-156.332.amzn2.x86_64
    kernel-devel-4.14.203-156.332.amzn2.x86_64
    kernel-debuginfo-4.14.203-156.332.amzn2.x86_64
    kernel-livepatch-4.14.203-156.332-1.0-0.amzn2.x86_64