ALAS-2025-2778

Amazon Linux 2 Security Advisory: ALAS-2025-2778
Advisory Release Date: 2025-02-26 22:35 Pacific
Advisory Updated Date: 2025-04-08 23:17 Pacific
Severity: Important
Issue Overview:

In the Linux kernel, the following vulnerability has been resolved:

net: relax socket state check at accept time. (CVE-2024-36484)

In the Linux kernel, the following vulnerability has been resolved:

bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CVE-2024-39487)

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CVE-2024-40901)

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984)

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix UBSAN warning in kv_dpm.c (CVE-2024-40988)

In the Linux kernel, the following vulnerability has been resolved:

filelock: Fix fcntl/close race recovery compat path (CVE-2024-41020)

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix kernel bug on rename operation of broken directory (CVE-2024-41034)

In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CVE-2024-41035)

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix uninit-value in copy_name (CVE-2024-41059)

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CVE-2024-41097)

In the Linux kernel, the following vulnerability has been resolved:

ftruncate: pass a signed offset (CVE-2024-42084)

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: add missing check for inode numbers on directory entries (CVE-2024-42104)

In the Linux kernel, the following vulnerability has been resolved:

bnx2x: Fix multiple UBSAN array-index-out-of-bounds (CVE-2024-42148)


Affected Packages:

kernel


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update kernel to update your system.

New Packages:
aarch64:
    kernel-4.14.352-267.564.amzn2.aarch64
    kernel-headers-4.14.352-267.564.amzn2.aarch64
    kernel-debuginfo-common-aarch64-4.14.352-267.564.amzn2.aarch64
    perf-4.14.352-267.564.amzn2.aarch64
    perf-debuginfo-4.14.352-267.564.amzn2.aarch64
    python-perf-4.14.352-267.564.amzn2.aarch64
    python-perf-debuginfo-4.14.352-267.564.amzn2.aarch64
    kernel-tools-4.14.352-267.564.amzn2.aarch64
    kernel-tools-devel-4.14.352-267.564.amzn2.aarch64
    kernel-tools-debuginfo-4.14.352-267.564.amzn2.aarch64
    kernel-devel-4.14.352-267.564.amzn2.aarch64
    kernel-debuginfo-4.14.352-267.564.amzn2.aarch64

i686:
    kernel-headers-4.14.352-267.564.amzn2.i686

src:
    kernel-4.14.352-267.564.amzn2.src

x86_64:
    kernel-4.14.352-267.564.amzn2.x86_64
    kernel-headers-4.14.352-267.564.amzn2.x86_64
    kernel-debuginfo-common-x86_64-4.14.352-267.564.amzn2.x86_64
    perf-4.14.352-267.564.amzn2.x86_64
    perf-debuginfo-4.14.352-267.564.amzn2.x86_64
    python-perf-4.14.352-267.564.amzn2.x86_64
    python-perf-debuginfo-4.14.352-267.564.amzn2.x86_64
    kernel-tools-4.14.352-267.564.amzn2.x86_64
    kernel-tools-devel-4.14.352-267.564.amzn2.x86_64
    kernel-tools-debuginfo-4.14.352-267.564.amzn2.x86_64
    kernel-devel-4.14.352-267.564.amzn2.x86_64
    kernel-debuginfo-4.14.352-267.564.amzn2.x86_64
    kernel-livepatch-4.14.352-267.564-1.0-0.amzn2.x86_64

Changelog:

2025-04-08: CVE-2024-40901 was added to this advisory.

2025-03-10: CVE-2024-42084 was added to this advisory.

2025-03-10: CVE-2024-39487 was added to this advisory.

2025-03-07: CVE-2024-41034 was added to this advisory.

2025-03-07: CVE-2024-41035 was added to this advisory.

2025-03-07: CVE-2024-41059 was added to this advisory.

2025-03-07: CVE-2024-41097 was added to this advisory.

2025-03-07: CVE-2024-41020 was added to this advisory.

2025-03-07: CVE-2024-40984 was added to this advisory.

2025-03-07: CVE-2024-40988 was added to this advisory.

2025-03-07: CVE-2024-36484 was added to this advisory.

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2024-36484, CVE-2024-39487, CVE-2024-40901, CVE-2024-40984, CVE-2024-40988, CVE-2024-41020, CVE-2024-41034, CVE-2024-41035, CVE-2024-41059, CVE-2024-41097, CVE-2024-42084, CVE-2024-42104, CVE-2024-42148

Mitre: CVE-2024-36484, CVE-2024-39487, CVE-2024-40901, CVE-2024-40984, CVE-2024-40988, CVE-2024-41020, CVE-2024-41034, CVE-2024-41035, CVE-2024-41059, CVE-2024-41097, CVE-2024-42084, CVE-2024-42104, CVE-2024-42148