ALAS-2023-299

References: CVE-2022-48502  CVE-2023-3611  CVE-2023-3776  CVE-2023-39197  CVE-2023-44466  CVE-2023-51043  CVE-2023-52885  CVE-2024-0639 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. (CVE-2022-48502)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. (CVE-2023-3776)

An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. (CVE-2023-39197)

An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32. (CVE-2023-44466)

In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (CVE-2023-52885)

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

Issue Correction:
Run dnf update kernel --releasever 2023.1.20230823 to update your system.

New Packages:

aarch64:
    bpftool-6.1.41-63.109.amzn2023.aarch64
    python3-perf-debuginfo-6.1.41-63.109.amzn2023.aarch64
    kernel-libbpf-static-6.1.41-63.109.amzn2023.aarch64
    perf-debuginfo-6.1.41-63.109.amzn2023.aarch64
    python3-perf-6.1.41-63.109.amzn2023.aarch64
    kernel-tools-devel-6.1.41-63.109.amzn2023.aarch64
    kernel-libbpf-6.1.41-63.109.amzn2023.aarch64
    perf-6.1.41-63.109.amzn2023.aarch64
    kernel-livepatch-6.1.41-63.109-1.0-0.amzn2023.aarch64
    kernel-tools-6.1.41-63.109.amzn2023.aarch64
    kernel-libbpf-devel-6.1.41-63.109.amzn2023.aarch64
    bpftool-debuginfo-6.1.41-63.109.amzn2023.aarch64
    kernel-headers-6.1.41-63.109.amzn2023.aarch64
    kernel-tools-debuginfo-6.1.41-63.109.amzn2023.aarch64
    kernel-6.1.41-63.109.amzn2023.aarch64
    kernel-debuginfo-6.1.41-63.109.amzn2023.aarch64
    kernel-debuginfo-common-aarch64-6.1.41-63.109.amzn2023.aarch64
    kernel-devel-6.1.41-63.109.amzn2023.aarch64

src:
    kernel-6.1.41-63.109.amzn2023.src

x86_64:
    kernel-livepatch-6.1.41-63.109-1.0-0.amzn2023.x86_64
    bpftool-6.1.41-63.109.amzn2023.x86_64
    kernel-libbpf-devel-6.1.41-63.109.amzn2023.x86_64
    kernel-tools-6.1.41-63.109.amzn2023.x86_64
    kernel-tools-debuginfo-6.1.41-63.109.amzn2023.x86_64
    perf-debuginfo-6.1.41-63.109.amzn2023.x86_64
    kernel-libbpf-6.1.41-63.109.amzn2023.x86_64
    python3-perf-debuginfo-6.1.41-63.109.amzn2023.x86_64
    bpftool-debuginfo-6.1.41-63.109.amzn2023.x86_64
    python3-perf-6.1.41-63.109.amzn2023.x86_64
    kernel-libbpf-static-6.1.41-63.109.amzn2023.x86_64
    kernel-headers-6.1.41-63.109.amzn2023.x86_64
    kernel-tools-devel-6.1.41-63.109.amzn2023.x86_64
    perf-6.1.41-63.109.amzn2023.x86_64
    kernel-debuginfo-6.1.41-63.109.amzn2023.x86_64
    kernel-6.1.41-63.109.amzn2023.x86_64
    kernel-debuginfo-common-x86_64-6.1.41-63.109.amzn2023.x86_64
    kernel-devel-6.1.41-63.109.amzn2023.x86_64