ALASLIVEPATCH-2025-035

References: CVE-2024-36899  CVE-2024-49960  CVE-2024-49996  CVE-2024-50055  CVE-2024-50121  CVE-2024-50242  CVE-2024-50246  CVE-2024-50247  CVE-2024-50257  CVE-2024-50262  CVE-2024-53206 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix timer use-after-free on failed mount (CVE-2024-49960)

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix buffer overflow when parsing NFS reparse points (CVE-2024-49996)

In the Linux kernel, the following vulnerability has been resolved:

driver core: bus: Fix double free in driver API bus_register() (CVE-2024-50055)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net (CVE-2024-50121)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Additional check in ntfs_file_release (CVE-2024-50242)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Add rough attr alloc_size check (CVE-2024-50246)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Check if more than chunk-size bytes are written (CVE-2024-50247)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: Fix use-after-free in get_info() (CVE-2024-50257)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262)

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix use-after-free of nreq in reqsk_timer_handler(). (CVE-2024-53206)

Issue Correction:
Run dnf update kernel-livepatch-6.1.115-126.197 --releasever 2023.6.20250203 to update your system.

New Packages:

aarch64:
    kernel-livepatch-6.1.115-126.197-1.0-1.amzn2023.aarch64

src:
    kernel-livepatch-6.1.115-126.197-1.0-1.amzn2023.src

x86_64:
    kernel-livepatch-6.1.115-126.197-1.0-1.amzn2023.x86_64