ALAS-2023-148

Amazon Linux 2023 Security Advisory: ALAS-2023-148
Advisory Release Date: 2023-03-30 21:11 Pacific
Advisory Updated Date: 2024-02-01 17:56 Pacific
Severity: Important
Issue Overview:

2024-02-01: CVE-2023-30456 was added to this advisory.

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation.

The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability.

We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2. (CVE-2023-2235)

do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4. (CVE-2023-30456)


Affected Packages:

kernel


Issue Correction:
Run dnf update kernel --releasever=2023.0.20230329 to update your system.

New Packages:
aarch64:
    kernel-libbpf-6.1.21-1.45.amzn2023.aarch64
    python3-perf-debuginfo-6.1.21-1.45.amzn2023.aarch64
    kernel-tools-6.1.21-1.45.amzn2023.aarch64
    kernel-libbpf-devel-6.1.21-1.45.amzn2023.aarch64
    kernel-headers-6.1.21-1.45.amzn2023.aarch64
    bpftool-debuginfo-6.1.21-1.45.amzn2023.aarch64
    kernel-tools-devel-6.1.21-1.45.amzn2023.aarch64
    bpftool-6.1.21-1.45.amzn2023.aarch64
    kernel-livepatch-6.1.21-1.45-1.0-0.amzn2023.aarch64
    perf-6.1.21-1.45.amzn2023.aarch64
    perf-debuginfo-6.1.21-1.45.amzn2023.aarch64
    kernel-libbpf-static-6.1.21-1.45.amzn2023.aarch64
    kernel-tools-debuginfo-6.1.21-1.45.amzn2023.aarch64
    python3-perf-6.1.21-1.45.amzn2023.aarch64
    kernel-6.1.21-1.45.amzn2023.aarch64
    kernel-debuginfo-6.1.21-1.45.amzn2023.aarch64
    kernel-debuginfo-common-aarch64-6.1.21-1.45.amzn2023.aarch64
    kernel-devel-6.1.21-1.45.amzn2023.aarch64

src:
    kernel-6.1.21-1.45.amzn2023.src

x86_64:
    kernel-tools-devel-6.1.21-1.45.amzn2023.x86_64
    python3-perf-debuginfo-6.1.21-1.45.amzn2023.x86_64
    kernel-libbpf-devel-6.1.21-1.45.amzn2023.x86_64
    bpftool-6.1.21-1.45.amzn2023.x86_64
    kernel-libbpf-6.1.21-1.45.amzn2023.x86_64
    kernel-livepatch-6.1.21-1.45-1.0-0.amzn2023.x86_64
    kernel-tools-debuginfo-6.1.21-1.45.amzn2023.x86_64
    bpftool-debuginfo-6.1.21-1.45.amzn2023.x86_64
    perf-6.1.21-1.45.amzn2023.x86_64
    perf-debuginfo-6.1.21-1.45.amzn2023.x86_64
    kernel-libbpf-static-6.1.21-1.45.amzn2023.x86_64
    kernel-tools-6.1.21-1.45.amzn2023.x86_64
    python3-perf-6.1.21-1.45.amzn2023.x86_64
    kernel-headers-6.1.21-1.45.amzn2023.x86_64
    kernel-debuginfo-6.1.21-1.45.amzn2023.x86_64
    kernel-6.1.21-1.45.amzn2023.x86_64
    kernel-debuginfo-common-x86_64-6.1.21-1.45.amzn2023.x86_64
    kernel-devel-6.1.21-1.45.amzn2023.x86_64

Additional References

Red Hat: CVE-2023-2235, CVE-2023-28466, CVE-2023-30456

Mitre: CVE-2023-2235, CVE-2023-28466, CVE-2023-30456