Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-034 (ALASKERNEL-5.10-2023-034)

high Nessus Plugin ID 177770

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of kernel installed on the remote host is prior to 5.10.184-174.730. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-034 advisory.

A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action mirred) a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition. (CVE-2022-4269)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (CVE-2022-50067)

There is a potential deadlock in the eBPF subsystem in the Linux kernel.

The default sysctl configuration kernel.unprivileged_bpf_disabled on Amazon Linux does not allow unprivileged users to use eBPF. (CVE-2023-0160)

A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling of user-supplied data, which can lead to an assertion failure. This flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.
(CVE-2023-2156)

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). (CVE-2023-3111)

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. (CVE-2023-3141)

A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It can lead to null pointer dereference when gfs2_trans_begin being called and then fail ingfs2_evict_inode(). (CVE-2023-3212)

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. (CVE-2023-3268)

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. (CVE-2023-34256)

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal kernel information. (CVE-2023-3567)

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
This may result in denial of service or privilege escalation. (CVE-2023-35788)

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: Reinit port->pm on port specific driver unbind (CVE-2023-53176)

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Avoid undefined behavior: applying zero offset to null pointer (CVE-2023-53182)

In the Linux kernel, the following vulnerability has been resolved:

ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix WARNING in mb_find_extent (CVE-2023-53317)

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: do not write dirty data after degenerating to read-only (CVE-2023-53337)

In the Linux kernel, the following vulnerability has been resolved:

rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access (CVE-2023-53419)

In the Linux kernel, the following vulnerability has been resolved:

net: add vlan_get_protocol_and_depth() helper (CVE-2023-53433)

In the Linux kernel, the following vulnerability has been resolved:

ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

In the Linux kernel, the following vulnerability has been resolved:

x86/MCE/AMD: Use an u64 for bank_map (CVE-2023-53474)

In the Linux kernel, the following vulnerability has been resolved:

lib: cpu_rmap: Avoid use after free on rmap->obj array entries (CVE-2023-53484)

In the Linux kernel, the following vulnerability has been resolved:

tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (CVE-2023-53489)

In the Linux kernel, the following vulnerability has been resolved:

ext4: allow ext4_get_group_info() to fail (CVE-2023-53503)

In the Linux kernel, the following vulnerability has been resolved:

tipc: do not update mtu if msg_max is too small in mtu negotiation (CVE-2023-53517)

In the Linux kernel, the following vulnerability has been resolved:

blk-crypto: make blk_crypto_evict_key() more robust (CVE-2023-53536)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_rbtree: fix null deref on element insertion (CVE-2023-53566)

In the Linux kernel, the following vulnerability has been resolved:

spi: qup: Don't skip cleanup in remove's error path (CVE-2023-53567)

In the Linux kernel, the following vulnerability has been resolved:

ext2: Check block size validity during mount (CVE-2023-53569)

In the Linux kernel, the following vulnerability has been resolved:

null_blk: Always check queue mode setting from configfs (CVE-2023-53576)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Fix multiple LUN_RESET handling (CVE-2023-53586)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Sync IRQ works before buffer destruction (CVE-2023-53587)

In the Linux kernel, the following vulnerability has been resolved:

dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (CVE-2023-53604)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_fq: fix integer overflow of credit (CVE-2023-53624)

In the Linux kernel, the following vulnerability has been resolved:

rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed (CVE-2023-53655)

In the Linux kernel, the following vulnerability has been resolved:

fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (CVE-2023-53683)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (CVE-2023-53692)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix out-of-bounds access in ipv6_find_tlv() (CVE-2023-53705)

In the Linux kernel, the following vulnerability has been resolved:

serial: arc_uart: fix of_iomap leak in `arc_serial_probe` (CVE-2023-53719)

In the Linux kernel, the following vulnerability has been resolved:

vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (CVE-2023-53747)

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() (CVE-2023-53754)

In the Linux kernel, the following vulnerability has been resolved:

USB: usbtmc: Fix direction for 0-length ioctl control messages (CVE-2023-53761)

In the Linux kernel, the following vulnerability has been resolved:

dm flakey: fix a crash with invalid table line (CVE-2023-53786)

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (CVE-2023-53804)

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: release crypto keyslot before reporting I/O complete (CVE-2023-53810)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix null-ptr-deref in raid10_sync_request (CVE-2023-53832)

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix infinite loop in nilfs_mdt_get_block() (CVE-2023-53845)

In the Linux kernel, the following vulnerability has been resolved:

netlink: annotate accesses to nlk->cb_running (CVE-2023-53853)

In the Linux kernel, the following vulnerability has been resolved:

udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). (CVE-2023-54004)

In the Linux kernel, the following vulnerability has been resolved:

vmci_host: fix a race condition in vmci_host_poll() causing GPF (CVE-2023-54007)

In the Linux kernel, the following vulnerability has been resolved:

net: fix stack overflow when LRO is disabled for virtual interfaces (CVE-2023-54012)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device (CVE-2023-54015)

In the Linux kernel, the following vulnerability has been resolved:

ext4: set goal start correctly in ext4_mb_normalize_request (CVE-2023-54021)

In the Linux kernel, the following vulnerability has been resolved:

spmi: Add a check for remove callback when removing a SPMI driver (CVE-2023-54044)

In the Linux kernel, the following vulnerability has been resolved:

kheaders: Use array declaration instead of char (CVE-2023-54056)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix invalid free tracking in ext4_xattr_move_to_block() (CVE-2023-54062)

In the Linux kernel, the following vulnerability has been resolved:

scsi: qedi: Fix use after free bug in qedi_remove() (CVE-2023-54100)

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow (CVE-2023-54102)

In the Linux kernel, the following vulnerability has been resolved:

net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (CVE-2023-54114)

In the Linux kernel, the following vulnerability has been resolved:

inotify: Avoid reporting event with invalid wd (CVE-2023-54119)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix memleak for 'conf->bio_split' (CVE-2023-54123)

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_sdei: Fix sleep from invalid context BUG (CVE-2023-54160)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (CVE-2023-54168)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsit: Free cmds before session free (CVE-2023-54184)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: remove block_cb from driver_list before freeing (CVE-2023-54193)

In the Linux kernel, the following vulnerability has been resolved:

USB: sisusbvga: Add endpoint checks (CVE-2023-54213)

In the Linux kernel, the following vulnerability has been resolved:

net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (CVE-2023-54218)

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix data races around sk->sk_shutdown. (CVE-2023-54226)

In the Linux kernel, the following vulnerability has been resolved:

ACPI: EC: Fix oops when removing custom query handlers (CVE-2023-54244)

In the Linux kernel, the following vulnerability has been resolved:

debugobjects: Don't wake up kswapd from fill_pool() (CVE-2023-54268)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: Add a check for valid 'mad_agent' pointer (CVE-2023-54274)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix memleak of md thread (CVE-2023-54294)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix deadlock when converting an inline directory in nojournal mode (CVE-2023-54311)

A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update kernel' or or 'yum update --advisory ALAS2KERNEL-5.10-2023-034' to update your system.

Plugin Details

Severity: High

ID: 177770

File Name: al2_ALASKERNEL-5_10-2023-034.nasl

Version: 1.24

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 6/29/2023

Updated: 2/9/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-53604

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:kernel-livepatch-5.10.184-174.730, p-cpe:/a:amazon:linux:python-perf-debuginfo, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-headers, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:python-perf

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/21/2023

Vulnerability Publication Date: 12/5/2022

Reference Information

CVE: CVE-2022-4269, CVE-2022-50067, CVE-2023-0160, CVE-2023-2156, CVE-2023-3090, CVE-2023-3111, CVE-2023-3141, CVE-2023-3212, CVE-2023-3268, CVE-2023-34256, CVE-2023-3567, CVE-2023-35788, CVE-2023-53176, CVE-2023-53182, CVE-2023-53285, CVE-2023-53299, CVE-2023-53317, CVE-2023-53337, CVE-2023-53419, CVE-2023-53433, CVE-2023-53450, CVE-2023-53474, CVE-2023-53484, CVE-2023-53489, CVE-2023-53503, CVE-2023-53517, CVE-2023-53536, CVE-2023-53566, CVE-2023-53567, CVE-2023-53569, CVE-2023-53576, CVE-2023-53586, CVE-2023-53587, CVE-2023-53604, CVE-2023-53624, CVE-2023-53655, CVE-2023-53683, CVE-2023-53692, CVE-2023-53705, CVE-2023-53719, CVE-2023-53747, CVE-2023-53754, CVE-2023-53761, CVE-2023-53786, CVE-2023-53804, CVE-2023-53810, CVE-2023-53832, CVE-2023-53845, CVE-2023-53853, CVE-2023-54004, CVE-2023-54007, CVE-2023-54012, CVE-2023-54015, CVE-2023-54021, CVE-2023-54044, CVE-2023-54056, CVE-2023-54062, CVE-2023-54100, CVE-2023-54102, CVE-2023-54114, CVE-2023-54119, CVE-2023-54123, CVE-2023-54160, CVE-2023-54168, CVE-2023-54184, CVE-2023-54193, CVE-2023-54213, CVE-2023-54218, CVE-2023-54226, CVE-2023-54244, CVE-2023-54268, CVE-2023-54274, CVE-2023-54294, CVE-2023-54311, CVE-2024-0775

Detections

Analytics