Amazon Linux 2 Security Advisory: ALASLIVEPATCH-2024-165
Advisory Release Date: 2024-02-15 04:09 Pacific
Advisory Updated Date: 2024-02-19 17:58 Pacific
Severity:
Important
Issue Overview:
An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access. (CVE-2023-6040)
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. (CVE-2024-23849)
Affected Packages:
kernel-livepatch-4.14.336-253.554
Issue Correction:
Run yum update kernel-livepatch-4.14.336-253.554 to update your system.
New Packages:
src:
kernel-livepatch-4.14.336-253.554-1.0-2.amzn2.src
x86_64:
kernel-livepatch-4.14.336-253.554-1.0-2.amzn2.x86_64
kernel-livepatch-4.14.336-253.554-debuginfo-1.0-2.amzn2.x86_64