Amazon Linux 2 Security Advisory: ALAS-2023-2328
Advisory Release Date: 2023-10-30 23:59 Pacific
Advisory Updated Date: 2024-08-01 03:00 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
2024-08-01: CVE-2023-52528 was added to this advisory.
2024-08-01: CVE-2023-52577 was added to this advisory.
2024-08-01: CVE-2023-52566 was added to this advisory.
2024-08-01: CVE-2023-52527 was added to this advisory.
2024-07-03: CVE-2023-52574 was added to this advisory.
2024-06-06: CVE-2023-52567 was added to this advisory.
2024-04-11: CVE-2023-42754 was added to this advisory.
A flaw in the kernel Xen event handler can cause a deadlock with Xen console handling in unprivileged Xen guests. (CVE-2023-34324)
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system. (CVE-2023-42754)
In the Linux kernel, the following vulnerability has been resolved:
ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (CVE-2023-52527)
In the Linux kernel, the following vulnerability has been resolved:
net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (CVE-2023-52566)
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_port: Check IRQ data before use (CVE-2023-52567)
In the Linux kernel, the following vulnerability has been resolved:
team: fix null-ptr-deref when team device type is changed (CVE-2023-52574)
In the Linux kernel, the following vulnerability has been resolved:
dccp: fix dccp_v4_err()/dccp_v6_err() again (CVE-2023-52577)
Affected Packages:
kernel
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update kernel to update your system.
aarch64:
kernel-4.14.327-246.539.amzn2.aarch64
kernel-headers-4.14.327-246.539.amzn2.aarch64
kernel-debuginfo-common-aarch64-4.14.327-246.539.amzn2.aarch64
perf-4.14.327-246.539.amzn2.aarch64
perf-debuginfo-4.14.327-246.539.amzn2.aarch64
python-perf-4.14.327-246.539.amzn2.aarch64
python-perf-debuginfo-4.14.327-246.539.amzn2.aarch64
kernel-tools-4.14.327-246.539.amzn2.aarch64
kernel-tools-devel-4.14.327-246.539.amzn2.aarch64
kernel-tools-debuginfo-4.14.327-246.539.amzn2.aarch64
kernel-devel-4.14.327-246.539.amzn2.aarch64
kernel-debuginfo-4.14.327-246.539.amzn2.aarch64
i686:
kernel-headers-4.14.327-246.539.amzn2.i686
src:
kernel-4.14.327-246.539.amzn2.src
x86_64:
kernel-4.14.327-246.539.amzn2.x86_64
kernel-headers-4.14.327-246.539.amzn2.x86_64
kernel-debuginfo-common-x86_64-4.14.327-246.539.amzn2.x86_64
perf-4.14.327-246.539.amzn2.x86_64
perf-debuginfo-4.14.327-246.539.amzn2.x86_64
python-perf-4.14.327-246.539.amzn2.x86_64
python-perf-debuginfo-4.14.327-246.539.amzn2.x86_64
kernel-tools-4.14.327-246.539.amzn2.x86_64
kernel-tools-devel-4.14.327-246.539.amzn2.x86_64
kernel-tools-debuginfo-4.14.327-246.539.amzn2.x86_64
kernel-devel-4.14.327-246.539.amzn2.x86_64
kernel-debuginfo-4.14.327-246.539.amzn2.x86_64
kernel-livepatch-4.14.327-246.539-1.0-0.amzn2.x86_64