Amazon Linux 2 Security Advisory: ALASKERNEL-5.10-2022-007
Advisory Release Date: 2022-01-20 23:56 Pacific
Advisory Updated Date: 2024-12-05 01:00 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
2024-12-05: CVE-2021-47384 was added to this advisory.
2024-12-05: CVE-2021-47373 was added to this advisory.
2024-12-05: CVE-2021-47376 was added to this advisory.
2024-12-05: CVE-2021-47387 was added to this advisory.
2024-12-05: CVE-2021-47379 was added to this advisory.
2024-12-05: CVE-2021-47406 was added to this advisory.
2024-12-05: CVE-2021-47390 was added to this advisory.
2024-12-05: CVE-2021-47360 was added to this advisory.
2024-12-05: CVE-2021-47386 was added to this advisory.
2024-12-05: CVE-2021-47404 was added to this advisory.
2024-12-05: CVE-2021-47408 was added to this advisory.
2024-12-05: CVE-2021-47407 was added to this advisory.
2024-11-08: CVE-2021-47378 was added to this advisory.
2023-08-31: CVE-2021-34866 was added to this advisory.
A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system. (CVE-2021-20321)
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689. (CVE-2021-34866)
A flaw was found in the Linux kernel. A memory leak in the ccp-ops crypto driver can allow attackers to cause a denial of service. This vulnerability is similar with the older CVE-2019-18808. The highest threat from this vulnerability is to system availability. (CVE-2021-3744)
A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability. (CVE-2021-3764)
An out-of-bounds (OOB) memory write flaw was found in prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the bpf in the Linux kernel. In this flaw, the multiplication to calculate the size could lead to an integer overflow which could allow a local attacker, with a special user privilege, to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. (CVE-2021-41864)
A flaw was discovered in the cryptographic receive code in the Linux kernel's implementation of transparent interprocess communication. An attacker, with the ability to send TIPC messages to the target, can corrupt memory and escalate privileges on the target system. (CVE-2021-43267)
In the Linux kernel, the following vulnerability has been resolved:
binder: make sure fd closes complete (CVE-2021-47360)
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v3-its: Fix potential VPE leak on error (CVE-2021-47373)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add oversize check before call kvcalloc() (CVE-2021-47376)
In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: destroy cm id before destroy qp to avoid use after free (CVE-2021-47378)
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (CVE-2021-47379)
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47384)
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47386)
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: schedutil: Use kobject release() method to free sugov_tunables (CVE-2021-47387)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() (CVE-2021-47390)
In the Linux kernel, the following vulnerability has been resolved:
HID: betop: fix slab-out-of-bounds Write in betop_probe (CVE-2021-47404)
In the Linux kernel, the following vulnerability has been resolved:
ext4: add error checking to ext4_ext_replay_set_iblocks() (CVE-2021-47406)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Handle SRCU initialization failure during page track init (CVE-2021-47407)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: serialize hash resizes and cleanups (CVE-2021-47408)
Affected Packages:
kernel
Note:
This advisory is applicable to Amazon Linux 2 - Kernel-5.10 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update kernel to update your system.
aarch64:
kernel-5.10.75-79.358.amzn2.aarch64
kernel-headers-5.10.75-79.358.amzn2.aarch64
kernel-debuginfo-common-aarch64-5.10.75-79.358.amzn2.aarch64
perf-5.10.75-79.358.amzn2.aarch64
perf-debuginfo-5.10.75-79.358.amzn2.aarch64
python-perf-5.10.75-79.358.amzn2.aarch64
python-perf-debuginfo-5.10.75-79.358.amzn2.aarch64
kernel-tools-5.10.75-79.358.amzn2.aarch64
kernel-tools-devel-5.10.75-79.358.amzn2.aarch64
kernel-tools-debuginfo-5.10.75-79.358.amzn2.aarch64
bpftool-5.10.75-79.358.amzn2.aarch64
bpftool-debuginfo-5.10.75-79.358.amzn2.aarch64
kernel-devel-5.10.75-79.358.amzn2.aarch64
kernel-debuginfo-5.10.75-79.358.amzn2.aarch64
kernel-livepatch-5.10.75-79.358-1.0-0.amzn2.aarch64
i686:
kernel-headers-5.10.75-79.358.amzn2.i686
src:
kernel-5.10.75-79.358.amzn2.src
x86_64:
kernel-5.10.75-79.358.amzn2.x86_64
kernel-headers-5.10.75-79.358.amzn2.x86_64
kernel-debuginfo-common-x86_64-5.10.75-79.358.amzn2.x86_64
perf-5.10.75-79.358.amzn2.x86_64
perf-debuginfo-5.10.75-79.358.amzn2.x86_64
python-perf-5.10.75-79.358.amzn2.x86_64
python-perf-debuginfo-5.10.75-79.358.amzn2.x86_64
kernel-tools-5.10.75-79.358.amzn2.x86_64
kernel-tools-devel-5.10.75-79.358.amzn2.x86_64
kernel-tools-debuginfo-5.10.75-79.358.amzn2.x86_64
bpftool-5.10.75-79.358.amzn2.x86_64
bpftool-debuginfo-5.10.75-79.358.amzn2.x86_64
kernel-devel-5.10.75-79.358.amzn2.x86_64
kernel-debuginfo-5.10.75-79.358.amzn2.x86_64
kernel-livepatch-5.10.75-79.358-1.0-0.amzn2.x86_64