ALASKERNEL-5.15-2023-013

References: CVE-2022-47929  CVE-2022-4842  CVE-2022-48424  CVE-2023-0045  CVE-2023-0179  CVE-2023-0394  CVE-2023-0459  CVE-2023-0461  CVE-2023-23454  CVE-2023-23455  CVE-2023-26544 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

2024-04-10: CVE-2023-0461 was added to this advisory.

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c. (CVE-2022-47929)

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system. (CVE-2022-4842)

In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur. (CVE-2022-48424)

The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the kernel API using STIBP as a mitigation, leaving the process exposed for a short period of time after a syscall. The kernel also does not issue an IBPB immediately during the syscall. (CVE-2023-0045)

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. (CVE-2023-0179)

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0459)

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.

The setsockopt TCP_ULP operation does not require any privilege.

We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23455)

In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. (CVE-2023-26544)

Issue Correction:
Run yum update kernel to update your system.

New Packages:

aarch64:
    kernel-5.15.90-54.138.amzn2.aarch64
    kernel-headers-5.15.90-54.138.amzn2.aarch64
    kernel-debuginfo-common-aarch64-5.15.90-54.138.amzn2.aarch64
    perf-5.15.90-54.138.amzn2.aarch64
    perf-debuginfo-5.15.90-54.138.amzn2.aarch64
    python-perf-5.15.90-54.138.amzn2.aarch64
    python-perf-debuginfo-5.15.90-54.138.amzn2.aarch64
    kernel-tools-5.15.90-54.138.amzn2.aarch64
    kernel-tools-devel-5.15.90-54.138.amzn2.aarch64
    kernel-tools-debuginfo-5.15.90-54.138.amzn2.aarch64
    bpftool-5.15.90-54.138.amzn2.aarch64
    bpftool-debuginfo-5.15.90-54.138.amzn2.aarch64
    kernel-devel-5.15.90-54.138.amzn2.aarch64
    kernel-debuginfo-5.15.90-54.138.amzn2.aarch64
    kernel-livepatch-5.15.90-54.138-1.0-0.amzn2.aarch64

i686:
    kernel-headers-5.15.90-54.138.amzn2.i686

src:
    kernel-5.15.90-54.138.amzn2.src

x86_64:
    kernel-5.15.90-54.138.amzn2.x86_64
    kernel-headers-5.15.90-54.138.amzn2.x86_64
    kernel-debuginfo-common-x86_64-5.15.90-54.138.amzn2.x86_64
    perf-5.15.90-54.138.amzn2.x86_64
    perf-debuginfo-5.15.90-54.138.amzn2.x86_64
    python-perf-5.15.90-54.138.amzn2.x86_64
    python-perf-debuginfo-5.15.90-54.138.amzn2.x86_64
    kernel-tools-5.15.90-54.138.amzn2.x86_64
    kernel-tools-devel-5.15.90-54.138.amzn2.x86_64
    kernel-tools-debuginfo-5.15.90-54.138.amzn2.x86_64
    bpftool-5.15.90-54.138.amzn2.x86_64
    bpftool-debuginfo-5.15.90-54.138.amzn2.x86_64
    kernel-devel-5.15.90-54.138.amzn2.x86_64
    kernel-debuginfo-5.15.90-54.138.amzn2.x86_64
    kernel-livepatch-5.15.90-54.138-1.0-0.amzn2.x86_64