ALASKERNEL-5.15-2022-001

References: CVE-2022-1015  CVE-2022-1016  CVE-2022-1158  CVE-2022-1263  CVE-2022-1353  CVE-2022-1729  CVE-2022-23222  CVE-2022-28893  CVE-2022-29581  CVE-2022-29582  CVE-2022-30594  CVE-2022-3526 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

2024-03-25: CVE-2022-0500 was removed from this advisory.

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle return with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

When the KVM updates the guest's page table entry, it will first use get_user_pages_fast() to pin the page, and when it fails (e.g. the vma->flags has VM_IO or VM_PFNMAP), it will get corresponding VMA where the page lies in through find_vma_intersection(), calculate the physical address, and map the page to the kernel virtual address through memremap(), and finally, write the update.
The problem is that when we get the vma through find_vma_intersection(), only VM_PFNMAP is checked, not both VM_IO and VM_PFNMAP. In the reproducer below, after the KVM_SET_USER_MEMORY_REGION is completed, we replace the guest's memory mapping with the kernel-user shared region of io_uring and then perform the KVM_TRANSLATE operation, which finally triggers the page table entry update. Now, memremap() will return page_offset_base (direct mapping of all physical memory) + vaddr (the linear address of KVM_TRANSLATE) + vm_pgoff (the offset when io_uring performs mmap(2)), and use the return value as the base address for CMPXCHG (write 0x21 in this case). Since both vaddr and vm_pgoff are controllable by the user-mode process, writing may exceed the previously mapped guest memory space and trigger exceptions such as UAF. The vulnerability shares similarities with CVE-2021-22543. (CVE-2022-1158)

A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. (CVE-2022-1263)

A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information. (CVE-2022-1353)

perf: Fix sys_perf_event_open() race against self (CVE-2022-1729)

A flaw was found in the Linux kernel's adjust_ptr_min_max_vals in the kernel/bpf/verifier.c function. In this flaw, a missing sanity check for *_OR_NULL pointer types that perform pointer arithmetic may cause a kernel information leak issue. (CVE-2022-23222)

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state. (CVE-2022-28893)

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions. (CVE-2022-29581)

A use-after-free flaw was found in the Linux kernel's io_uring interface subsystem in the way a user triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or escalate their privileges on the system. (CVE-2022-29582)

The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

Issue Correction:
Run yum update kernel to update your system.

New Packages:

aarch64:
    kernel-5.15.43-20.123.amzn2.aarch64
    kernel-headers-5.15.43-20.123.amzn2.aarch64
    kernel-debuginfo-common-aarch64-5.15.43-20.123.amzn2.aarch64
    perf-5.15.43-20.123.amzn2.aarch64
    perf-debuginfo-5.15.43-20.123.amzn2.aarch64
    python-perf-5.15.43-20.123.amzn2.aarch64
    python-perf-debuginfo-5.15.43-20.123.amzn2.aarch64
    kernel-tools-5.15.43-20.123.amzn2.aarch64
    kernel-tools-devel-5.15.43-20.123.amzn2.aarch64
    kernel-tools-debuginfo-5.15.43-20.123.amzn2.aarch64
    bpftool-5.15.43-20.123.amzn2.aarch64
    bpftool-debuginfo-5.15.43-20.123.amzn2.aarch64
    kernel-devel-5.15.43-20.123.amzn2.aarch64
    kernel-debuginfo-5.15.43-20.123.amzn2.aarch64
    kernel-livepatch-5.15.43-20.123-1.0-0.amzn2.aarch64

i686:
    kernel-headers-5.15.43-20.123.amzn2.i686

src:
    kernel-5.15.43-20.123.amzn2.src

x86_64:
    kernel-5.15.43-20.123.amzn2.x86_64
    kernel-headers-5.15.43-20.123.amzn2.x86_64
    kernel-debuginfo-common-x86_64-5.15.43-20.123.amzn2.x86_64
    perf-5.15.43-20.123.amzn2.x86_64
    perf-debuginfo-5.15.43-20.123.amzn2.x86_64
    python-perf-5.15.43-20.123.amzn2.x86_64
    python-perf-debuginfo-5.15.43-20.123.amzn2.x86_64
    kernel-tools-5.15.43-20.123.amzn2.x86_64
    kernel-tools-devel-5.15.43-20.123.amzn2.x86_64
    kernel-tools-debuginfo-5.15.43-20.123.amzn2.x86_64
    bpftool-5.15.43-20.123.amzn2.x86_64
    bpftool-debuginfo-5.15.43-20.123.amzn2.x86_64
    kernel-devel-5.15.43-20.123.amzn2.x86_64
    kernel-debuginfo-5.15.43-20.123.amzn2.x86_64
    kernel-livepatch-5.15.43-20.123-1.0-0.amzn2.x86_64