Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-036)

high Nessus Plugin ID 166131

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of kernel installed on the remote host is prior to 5.4.214-120.368. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-036 advisory.

2025-07-03: CVE-2022-50083 was added to this advisory.

2025-07-03: CVE-2022-50097 was added to this advisory.

2025-07-03: CVE-2022-50092 was added to this advisory.

2025-07-03: CVE-2022-50228 was added to this advisory.

2025-07-03: CVE-2022-50127 was added to this advisory.

2025-07-03: CVE-2022-50072 was added to this advisory.

2025-07-03: CVE-2022-50220 was added to this advisory.

2025-07-03: CVE-2022-49964 was added to this advisory.

2025-07-03: CVE-2022-49977 was added to this advisory.

2025-07-03: CVE-2022-50185 was added to this advisory.

2025-07-03: CVE-2022-50205 was added to this advisory.

2025-07-03: CVE-2022-49986 was added to this advisory.

2025-07-03: CVE-2022-49984 was added to this advisory.

2025-07-03: CVE-2022-50202 was added to this advisory.

2025-07-03: CVE-2022-50030 was added to this advisory.

2025-07-03: CVE-2022-50149 was added to this advisory.

2025-07-03: CVE-2022-50126 was added to this advisory.

2025-07-03: CVE-2022-50008 was added to this advisory.

2025-07-03: CVE-2022-49987 was added to this advisory.

2025-07-03: CVE-2022-50211 was added to this advisory.

2025-07-03: CVE-2022-50200 was added to this advisory.

2025-05-21: CVE-2022-49568 was added to this advisory.

2024-08-27: CVE-2022-48686 was added to this advisory.

2024-08-27: CVE-2022-48704 was added to this advisory.

2024-08-27: CVE-2021-47202 was added to this advisory.

2024-08-27: CVE-2022-48697 was added to this advisory.

2024-08-27: CVE-2022-48688 was added to this advisory.

2024-08-27: CVE-2022-48695 was added to this advisory.

2024-07-03: CVE-2019-25162 was added to this advisory.

2024-06-06: CVE-2022-48687 was added to this advisory.

2024-04-10: CVE-2023-1095 was added to this advisory.

2024-03-13: CVE-2022-3176 was added to this advisory.

2023-10-12: CVE-2023-2860 was added to this advisory.

In the Linux kernel, the following vulnerability has been resolved:

i2c: Fix a potential use after free

Free the adap structure only after we are done using it.This patch just moves the put_device() down a bit to avoid theuse after free.

[wsa: added comment to the code, added Fixes tag] (CVE-2019-25162)

A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (CVE-2021-4159)

In the Linux kernel, the following vulnerability has been resolved:

thermal: Fix NULL pointer dereferences in of_thermal_ functions (CVE-2021-47202)

A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
A-223375145References: Upstream kernel (CVE-2022-20369)

A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. (CVE-2022-2153)

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. (CVE-2022-2586)

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege escalation problem. (CVE-2022-2588)

Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured. (CVE-2022-2663)

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. (CVE-2022-3028)

A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE handling. (CVE-2022-3176)

A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to crash the system. (CVE-2022-40307)

mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. (CVE-2022-41222)

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix UAF when detecting digest errors (CVE-2022-48686)

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix kernel crash during module removal (CVE-2022-48688)

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Fix use-after-free warning (CVE-2022-48695)

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix a use-after-free (CVE-2022-48697)

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: add a force flush to delay work when radeon (CVE-2022-48704)

In the Linux kernel, the following vulnerability has been resolved:

KVM: Don't null dereference ops->destroy (CVE-2022-49568)

In the Linux kernel, the following vulnerability has been resolved:

arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level (CVE-2022-49964)

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977)

In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report (CVE-2022-49984)

In the Linux kernel, the following vulnerability has been resolved:

scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq (CVE-2022-49986)

In the Linux kernel, the following vulnerability has been resolved:

md: call __md_stop_writes in md_stop (CVE-2022-49987)

In the Linux kernel, the following vulnerability has been resolved:

kprobes: don't call disarm_kprobe() for disabled kprobes (CVE-2022-50008)

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (CVE-2022-50030)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pnfs: Fix a use-after-free bug in open (CVE-2022-50072)

In the Linux kernel, the following vulnerability has been resolved:

ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (CVE-2022-50083)

In the Linux kernel, the following vulnerability has been resolved:

dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (CVE-2022-50092)

In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: s3fb: Check the size of screen before memset_io() (CVE-2022-50097)

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (CVE-2022-50126)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix error unwind in rxe_create_qp() (CVE-2022-50127)

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential deadlock in __driver_attach (CVE-2022-50149)

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (CVE-2022-50185)

In the Linux kernel, the following vulnerability has been resolved:

selinux: Add boundary check in put_entry() (CVE-2022-50200)

In the Linux kernel, the following vulnerability has been resolved:

PM: hibernate: defer device probing when resuming from hibernation (CVE-2022-50202)

In the Linux kernel, the following vulnerability has been resolved:

ext2: Add more validity checks for inode counts (CVE-2022-50205)

In the Linux kernel, the following vulnerability has been resolved:

md-raid10: fix KASAN warning (CVE-2022-50211)

In the Linux kernel, the following vulnerability has been resolved:

usbnet: Fix linkwatch use-after-free on disconnect (CVE-2022-50220)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CVE-2022-50228)

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
-- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

The upstream advisory describes this issue as follows:

This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute arbitrary code in the context of the kernel. (CVE-2023-2860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update kernel' to update your system.

Plugin Details

Severity: High

ID: 166131

File Name: al2_ALASKERNEL-5_4-2022-036.nasl

Version: 1.24

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 10/14/2022

Updated: 7/8/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-1679

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2022-48695

Vulnerability Information

CPE: cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:python-perf, p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:python-perf-debuginfo, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-headers

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/30/2022

Vulnerability Publication Date: 5/6/2022

CISA Known Exploited Vulnerability Due Dates: 7/17/2024

Exploitable With

Core Impact

Reference Information

CVE: CVE-2019-25162, CVE-2021-4159, CVE-2021-47202, CVE-2022-1679, CVE-2022-20369, CVE-2022-2153, CVE-2022-2586, CVE-2022-2588, CVE-2022-26373, CVE-2022-2663, CVE-2022-3028, CVE-2022-3176, CVE-2022-3625, CVE-2022-39188, CVE-2022-40307, CVE-2022-41222, CVE-2022-48686, CVE-2022-48687, CVE-2022-48688, CVE-2022-48695, CVE-2022-48697, CVE-2022-48704, CVE-2022-49568, CVE-2022-49964, CVE-2022-49977, CVE-2022-49984, CVE-2022-49986, CVE-2022-49987, CVE-2022-50008, CVE-2022-50030, CVE-2022-50072, CVE-2022-50083, CVE-2022-50092, CVE-2022-50097, CVE-2022-50126, CVE-2022-50127, CVE-2022-50149, CVE-2022-50185, CVE-2022-50200, CVE-2022-50202, CVE-2022-50205, CVE-2022-50211, CVE-2022-50220, CVE-2022-50228, CVE-2023-1095, CVE-2023-2860

Detections

Analytics