ALASKERNEL-5.15-2023-015


Amazon Linux 2 Security Advisory: ALASKERNEL-5.15-2023-015
Advisory Release Date: 2023-03-17 16:46 Pacific
Advisory Updated Date: 2024-01-19 02:20 Pacific
Severity: Important

Issue Overview:

2024-01-19: CVE-2023-7192 was added to this advisory.

2023-10-31: CVE-2023-45863 was added to this advisory.

2023-08-31: CVE-2023-2985 was added to this advisory.

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a (CVE-2022-2196)

It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is dynamically partitioned between non-idle threads. This allows an attacker to control speculative execution on the adjacent thread. (CVE-2022-27672)

Detected a few exploitable gadgets that could leak secret memory through a side-channel such as MDS as well as insufficient hardening of the usercopy functions against spectre-v1. (CVE-2023-0458)

kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

The upstream bug report describes this issue as follows:

A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)

Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.
We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation() determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch target
injection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. (CVE-2023-1998)

In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service. (CVE-2023-2985)

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)


Affected Packages:

kernel


Note:

This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update kernel to update your system.

New Packages:
aarch64:
    kernel-5.15.102-61.139.amzn2.aarch64
    kernel-headers-5.15.102-61.139.amzn2.aarch64
    kernel-debuginfo-common-aarch64-5.15.102-61.139.amzn2.aarch64
    perf-5.15.102-61.139.amzn2.aarch64
    perf-debuginfo-5.15.102-61.139.amzn2.aarch64
    python-perf-5.15.102-61.139.amzn2.aarch64
    python-perf-debuginfo-5.15.102-61.139.amzn2.aarch64
    kernel-tools-5.15.102-61.139.amzn2.aarch64
    kernel-tools-devel-5.15.102-61.139.amzn2.aarch64
    kernel-tools-debuginfo-5.15.102-61.139.amzn2.aarch64
    bpftool-5.15.102-61.139.amzn2.aarch64
    bpftool-debuginfo-5.15.102-61.139.amzn2.aarch64
    kernel-devel-5.15.102-61.139.amzn2.aarch64
    kernel-debuginfo-5.15.102-61.139.amzn2.aarch64
    kernel-livepatch-5.15.102-61.139-1.0-0.amzn2.aarch64

i686:
    kernel-headers-5.15.102-61.139.amzn2.i686

src:
    kernel-5.15.102-61.139.amzn2.src

x86_64:
    kernel-5.15.102-61.139.amzn2.x86_64
    kernel-headers-5.15.102-61.139.amzn2.x86_64
    kernel-debuginfo-common-x86_64-5.15.102-61.139.amzn2.x86_64
    perf-5.15.102-61.139.amzn2.x86_64
    perf-debuginfo-5.15.102-61.139.amzn2.x86_64
    python-perf-5.15.102-61.139.amzn2.x86_64
    python-perf-debuginfo-5.15.102-61.139.amzn2.x86_64
    kernel-tools-5.15.102-61.139.amzn2.x86_64
    kernel-tools-devel-5.15.102-61.139.amzn2.x86_64
    kernel-tools-debuginfo-5.15.102-61.139.amzn2.x86_64
    bpftool-5.15.102-61.139.amzn2.x86_64
    bpftool-debuginfo-5.15.102-61.139.amzn2.x86_64
    kernel-devel-5.15.102-61.139.amzn2.x86_64
    kernel-debuginfo-5.15.102-61.139.amzn2.x86_64
    kernel-livepatch-5.15.102-61.139-1.0-0.amzn2.x86_64