Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-021 (ALASKERNEL-5.15-2023-021)

high Nessus Plugin ID 177781

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of kernel installed on the remote host is prior to 5.15.117-72.142. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-021 advisory.

In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. (CVE-2022-48425)

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF of alloc->vma in race with munmap() (CVE-2022-50240)

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF of alloc->vma in race with munmap() (CVE-2022-50338)

There is a potential deadlock in the eBPF subsystem in the Linux kernel.

The default sysctl configuration kernel.unprivileged_bpf_disabled on Amazon Linux does not allow unprivileged users to use eBPF. (CVE-2023-0160)

A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling of user-supplied data, which can lead to an assertion failure. This flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.
(CVE-2023-2156)

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It can lead to null pointer dereference when gfs2_trans_begin being called and then fail ingfs2_evict_inode(). (CVE-2023-3212)

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. (CVE-2023-3268)

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. (CVE-2023-34256)

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal kernel information. (CVE-2023-3567)

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
This may result in denial of service or privilege escalation. (CVE-2023-35788)

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: Reinit port->pm on port specific driver unbind (CVE-2023-53176)

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Avoid undefined behavior: applying zero offset to null pointer (CVE-2023-53182)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Add length check in indx_get_root (CVE-2023-53194)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix i_disksize exceeding i_size problem in paritally written case (CVE-2023-53270)

In the Linux kernel, the following vulnerability has been resolved:

ext4: add bounds checking in get_max_inline_xattr_value_size() (CVE-2023-53285)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() (CVE-2023-53294)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix leak of 'r10bio->remaining' for recovery (CVE-2023-53299)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix WARNING in mb_find_extent (CVE-2023-53317)

In the Linux kernel, the following vulnerability has been resolved:

rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access (CVE-2023-53419)

In the Linux kernel, the following vulnerability has been resolved:

net: add vlan_get_protocol_and_depth() helper (CVE-2023-53433)

In the Linux kernel, the following vulnerability has been resolved:

ext4: remove a BUG_ON in ext4_mb_release_group_pa() (CVE-2023-53450)

In the Linux kernel, the following vulnerability has been resolved:

x86/MCE/AMD: Use an u64 for bank_map (CVE-2023-53474)

In the Linux kernel, the following vulnerability has been resolved:

lib: cpu_rmap: Avoid use after free on rmap->obj array entries (CVE-2023-53484)

In the Linux kernel, the following vulnerability has been resolved:

virtio_net: Fix error unwinding of XDP initialization (CVE-2023-53499)

In the Linux kernel, the following vulnerability has been resolved:

ext4: allow ext4_get_group_info() to fail (CVE-2023-53503)

In the Linux kernel, the following vulnerability has been resolved:

nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update kernel' or or 'yum update --advisory ALAS2KERNEL-5.15-2023-021' to update your system.

Plugin Details

Severity: High

ID: 177781

File Name: al2_ALASKERNEL-5_15-2023-021.nasl

Version: 1.15

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 6/29/2023

Updated: 10/14/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-35788

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:python-perf-debuginfo, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:kernel-headers, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:python-perf, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:kernel-livepatch-5.15.117-72.142

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/21/2023

Vulnerability Publication Date: 3/19/2023

Reference Information

CVE: CVE-2022-48425, CVE-2022-50240, CVE-2023-0160, CVE-2023-2156, CVE-2023-3090, CVE-2023-3212, CVE-2023-3268, CVE-2023-34256, CVE-2023-3567, CVE-2023-35788, CVE-2023-53176, CVE-2023-53182, CVE-2023-53194, CVE-2023-53270, CVE-2023-53285, CVE-2023-53294, CVE-2023-53299, CVE-2023-53317, CVE-2023-53419, CVE-2023-53433, CVE-2023-53450, CVE-2023-53474, CVE-2023-53484, CVE-2023-53499, CVE-2023-53503, CVE-2023-53513, CVE-2024-0775

Detections

Analytics