ALAS2-2021-1634

Amazon Linux 2 Security Advisory: ALAS-2021-1634
Advisory Release Date: 2021-04-29 18:36 Pacific
Advisory Updated Date: 2021-05-03 17:31 Pacific
Severity: Low
Issue Overview:

A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The issue does not break the isolation or security of what is running inside the enclave as the Nitro Enclave's security model already excludes the instance running the Nitro Enclaves kernel driver from its trust boundary.
For the issue to occur, the Nitro Enclaves kernel module needs to be loaded and in use, and Nitro Enclave (ne) group permissions are required. Only trusted Nitro Enclaves software runs with the ne group permissions, and no interactive logins are in the group by default. As a result, the only actors in a position to take advantage of this issue would already have to have root privileges. While this issue has no impact to Nitro Enclave's security or isolation properties, we recommend that customers update to the latest Kernel provided by Amazon Linux.


Affected Packages:

kernel


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update kernel to update your system.

New Packages:
aarch64:
    kernel-4.14.231-173.361.amzn2.aarch64
    kernel-headers-4.14.231-173.361.amzn2.aarch64
    kernel-debuginfo-common-aarch64-4.14.231-173.361.amzn2.aarch64
    perf-4.14.231-173.361.amzn2.aarch64
    perf-debuginfo-4.14.231-173.361.amzn2.aarch64
    python-perf-4.14.231-173.361.amzn2.aarch64
    python-perf-debuginfo-4.14.231-173.361.amzn2.aarch64
    kernel-tools-4.14.231-173.361.amzn2.aarch64
    kernel-tools-devel-4.14.231-173.361.amzn2.aarch64
    kernel-tools-debuginfo-4.14.231-173.361.amzn2.aarch64
    kernel-devel-4.14.231-173.361.amzn2.aarch64
    kernel-debuginfo-4.14.231-173.361.amzn2.aarch64

i686:
    kernel-headers-4.14.231-173.361.amzn2.i686

src:
    kernel-4.14.231-173.361.amzn2.src

x86_64:
    kernel-4.14.231-173.361.amzn2.x86_64
    kernel-headers-4.14.231-173.361.amzn2.x86_64
    kernel-debuginfo-common-x86_64-4.14.231-173.361.amzn2.x86_64
    perf-4.14.231-173.361.amzn2.x86_64
    perf-debuginfo-4.14.231-173.361.amzn2.x86_64
    python-perf-4.14.231-173.361.amzn2.x86_64
    python-perf-debuginfo-4.14.231-173.361.amzn2.x86_64
    kernel-tools-4.14.231-173.361.amzn2.x86_64
    kernel-tools-devel-4.14.231-173.361.amzn2.x86_64
    kernel-tools-debuginfo-4.14.231-173.361.amzn2.x86_64
    kernel-devel-4.14.231-173.361.amzn2.x86_64
    kernel-debuginfo-4.14.231-173.361.amzn2.x86_64
    kernel-livepatch-4.14.231-173.361-1.0-0.amzn2.x86_64

Additional References

Red Hat: 

Mitre: