Amazon Linux 2 Security Advisory: ALAS-2024-2696
Advisory Release Date: 2024-11-08 18:01 Pacific
Advisory Updated Date: 2024-11-15 14:00 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
ipv6: prevent UAF in ip6_send_skb() (CVE-2024-44987)
In the Linux kernel, the following vulnerability has been resolved:
VMCI: Fix use-after-free when removing resource in vmci_resource_remove() (CVE-2024-46738)
In the Linux kernel, the following vulnerability has been resolved:
of/irq: Prevent device address out-of-bounds read in interrupt map walk (CVE-2024-46743)
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: sanity check symbolic link size (CVE-2024-46744)
In the Linux kernel, the following vulnerability has been resolved:
Input: uinput - reject requests with unreasonable number of slots (CVE-2024-46745)
In the Linux kernel, the following vulnerability has been resolved:
PCI: Add missing bridge lock to pci_bus_lock() (CVE-2024-46750)
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (CVE-2024-46756)
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (nct6775-core) Fix underflows seen when writing limit attributes (CVE-2024-46757)
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (lm95234) Fix underflows seen when writing limit attributes (CVE-2024-46758)
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (adc128d818) Fix underflows seen when writing limit attributes (CVE-2024-46759)
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: protect references to superblock parameters exposed in sysfs (CVE-2024-46780)
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix missing cleanup on rollforward recovery error (CVE-2024-46781)
In the Linux kernel, the following vulnerability has been resolved:
sch/netem: fix use after free in netem_dequeue (CVE-2024-46800)
In the Linux kernel, the following vulnerability has been resolved:
rtmutex: Drop rt_mutex::wait_lock before scheduling (CVE-2024-46829)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: clean up our handling of refs == 0 in snapshot delete (CVE-2024-46840)
Affected Packages:
kernel
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update kernel to update your system.
System reboot is required in order to complete this update.
aarch64:
kernel-4.14.355-271.569.amzn2.aarch64
kernel-headers-4.14.355-271.569.amzn2.aarch64
kernel-debuginfo-common-aarch64-4.14.355-271.569.amzn2.aarch64
perf-4.14.355-271.569.amzn2.aarch64
perf-debuginfo-4.14.355-271.569.amzn2.aarch64
python-perf-4.14.355-271.569.amzn2.aarch64
python-perf-debuginfo-4.14.355-271.569.amzn2.aarch64
kernel-tools-4.14.355-271.569.amzn2.aarch64
kernel-tools-devel-4.14.355-271.569.amzn2.aarch64
kernel-tools-debuginfo-4.14.355-271.569.amzn2.aarch64
kernel-devel-4.14.355-271.569.amzn2.aarch64
kernel-debuginfo-4.14.355-271.569.amzn2.aarch64
i686:
kernel-headers-4.14.355-271.569.amzn2.i686
src:
kernel-4.14.355-271.569.amzn2.src
x86_64:
kernel-4.14.355-271.569.amzn2.x86_64
kernel-headers-4.14.355-271.569.amzn2.x86_64
kernel-debuginfo-common-x86_64-4.14.355-271.569.amzn2.x86_64
perf-4.14.355-271.569.amzn2.x86_64
perf-debuginfo-4.14.355-271.569.amzn2.x86_64
python-perf-4.14.355-271.569.amzn2.x86_64
python-perf-debuginfo-4.14.355-271.569.amzn2.x86_64
kernel-tools-4.14.355-271.569.amzn2.x86_64
kernel-tools-devel-4.14.355-271.569.amzn2.x86_64
kernel-tools-debuginfo-4.14.355-271.569.amzn2.x86_64
kernel-devel-4.14.355-271.569.amzn2.x86_64
kernel-debuginfo-4.14.355-271.569.amzn2.x86_64
kernel-livepatch-4.14.355-271.569-1.0-0.amzn2.x86_64