ALAS-2018-993


Amazon Linux AMI Security Advisory: ALAS-2018-993
Advisory Release Date: 2018-05-10 23:20 Pacific
Severity: Medium

Issue Overview:

Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service:
An error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP, packet length can be exploited by a malicious local user to cause a kernel crash and a DoS. (CVE-2018-5803 )

Mishandling mutex within libsas allowing local Denial of Service
The Serial Attached SCSI (SAS) implementation in the Linux kernel mishandles a mutex within libsas. This allows local users to cause a denial of service (deadlock) by triggering certain error-handling code. (CVE-2017-18232 )

A flaw was found in the Linux kernel's client-side implementation of the cifs protocol. This flaw allows an attacker controlling the server to kernel panic a client which has the CIFS server mounted.(CVE-2018-1066 )


Affected Packages:

kernel


Issue Correction:
Run yum update kernel to update your system.

New Packages:
i686:
    kernel-debuginfo-common-i686-4.9.93-41.60.amzn1.i686
    kernel-4.9.93-41.60.amzn1.i686
    kernel-tools-devel-4.9.93-41.60.amzn1.i686
    perf-4.9.93-41.60.amzn1.i686
    kernel-debuginfo-4.9.93-41.60.amzn1.i686
    kernel-tools-debuginfo-4.9.93-41.60.amzn1.i686
    kernel-devel-4.9.93-41.60.amzn1.i686
    kernel-headers-4.9.93-41.60.amzn1.i686
    kernel-tools-4.9.93-41.60.amzn1.i686
    perf-debuginfo-4.9.93-41.60.amzn1.i686

noarch:
    kernel-doc-4.9.93-41.60.amzn1.noarch

src:
    kernel-4.9.93-41.60.amzn1.src

x86_64:
    perf-4.9.93-41.60.amzn1.x86_64
    kernel-tools-debuginfo-4.9.93-41.60.amzn1.x86_64
    perf-debuginfo-4.9.93-41.60.amzn1.x86_64
    kernel-tools-4.9.93-41.60.amzn1.x86_64
    kernel-4.9.93-41.60.amzn1.x86_64
    kernel-devel-4.9.93-41.60.amzn1.x86_64
    kernel-tools-devel-4.9.93-41.60.amzn1.x86_64
    kernel-headers-4.9.93-41.60.amzn1.x86_64
    kernel-debuginfo-4.9.93-41.60.amzn1.x86_64
    kernel-debuginfo-common-x86_64-4.9.93-41.60.amzn1.x86_64