Amazon Linux 2 : kernel (ALAS-2019-1145)

Medium Nessus Plugin ID 121054

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The USB subsystem mishandles size checks during the reading of an
extra descriptor, related to __usb_get_extra_descriptor in
drivers/usb/core/usb.c.(CVE-2018-20169)

A flaw was found where an attacker may be able to have an uncontrolled
read to kernel-memory from within a vm guest. A race condition between
connect() and close() function may allow an attacker using the
AF_VSOCK protocol to gather a 4 byte information leak or possibly
impersonate AF_VSOCK messages destined to other clients or leak kernel
memory.(CVE-2018-14625)

Solution

Run 'yum update kernel' to update your system.

See Also

https://alas.aws.amazon.com/AL2/ALAS-2019-1145.html

Plugin Details

Severity: Medium

ID: 121054

File Name: al2_ALAS-2019-1145.nasl

Version: 1.1

Type: local

Agent: unix

Published: 2019/01/10

Modified: 2019/01/10

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS v3.0

Base Score: 7

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:kernel-headers, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:python-perf, p-cpe:/a:amazon:linux:python-perf-debuginfo, cpe:/o:amazon:linux:2

Patch Publication Date: 2019/01/09

Reference Information

CVE: CVE-2018-14625, CVE-2018-20169

ALAS: 2019-1145