ALASKERNEL-5.10-2023-026

References: CVE-2022-47929  CVE-2023-0045  CVE-2023-0179  CVE-2023-0240  CVE-2023-0394  CVE-2023-0459  CVE-2023-0461  CVE-2023-21102  CVE-2023-23454  CVE-2023-23455 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

2024-04-10: CVE-2023-0461 was added to this advisory.

2024-02-01: CVE-2023-0240 was added to this advisory.

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c. (CVE-2022-47929)

The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. (CVE-2023-0179)

There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161. (CVE-2023-0240)

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.

The setsockopt TCP_ULP operation does not require any privilege.

We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

efi: rt-wrapper: Add missing include (CVE-2023-21102)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23455)

Issue Correction:
Run yum update kernel to update your system.

New Packages:

aarch64:
    kernel-5.10.165-143.735.amzn2.aarch64
    kernel-headers-5.10.165-143.735.amzn2.aarch64
    kernel-debuginfo-common-aarch64-5.10.165-143.735.amzn2.aarch64
    perf-5.10.165-143.735.amzn2.aarch64
    perf-debuginfo-5.10.165-143.735.amzn2.aarch64
    python-perf-5.10.165-143.735.amzn2.aarch64
    python-perf-debuginfo-5.10.165-143.735.amzn2.aarch64
    kernel-tools-5.10.165-143.735.amzn2.aarch64
    kernel-tools-devel-5.10.165-143.735.amzn2.aarch64
    kernel-tools-debuginfo-5.10.165-143.735.amzn2.aarch64
    bpftool-5.10.165-143.735.amzn2.aarch64
    bpftool-debuginfo-5.10.165-143.735.amzn2.aarch64
    kernel-devel-5.10.165-143.735.amzn2.aarch64
    kernel-debuginfo-5.10.165-143.735.amzn2.aarch64
    kernel-livepatch-5.10.165-143.735-1.0-0.amzn2.aarch64

i686:
    kernel-headers-5.10.165-143.735.amzn2.i686

src:
    kernel-5.10.165-143.735.amzn2.src

x86_64:
    kernel-5.10.165-143.735.amzn2.x86_64
    kernel-headers-5.10.165-143.735.amzn2.x86_64
    kernel-debuginfo-common-x86_64-5.10.165-143.735.amzn2.x86_64
    perf-5.10.165-143.735.amzn2.x86_64
    perf-debuginfo-5.10.165-143.735.amzn2.x86_64
    python-perf-5.10.165-143.735.amzn2.x86_64
    python-perf-debuginfo-5.10.165-143.735.amzn2.x86_64
    kernel-tools-5.10.165-143.735.amzn2.x86_64
    kernel-tools-devel-5.10.165-143.735.amzn2.x86_64
    kernel-tools-debuginfo-5.10.165-143.735.amzn2.x86_64
    bpftool-5.10.165-143.735.amzn2.x86_64
    bpftool-debuginfo-5.10.165-143.735.amzn2.x86_64
    kernel-devel-5.10.165-143.735.amzn2.x86_64
    kernel-debuginfo-5.10.165-143.735.amzn2.x86_64
    kernel-livepatch-5.10.165-143.735-1.0-0.amzn2.x86_64