Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-025 (ALASKERNEL-5.15-2023-025)

high Nessus Plugin ID 179798

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of kernel installed on the remote host is prior to 5.15.122-77.145. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-025 advisory.

An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.
(CVE-2022-48502)

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled?address, potentially leading to information disclosure. (CVE-2023-20569)

An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. (CVE-2023-20593)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. (CVE-2023-3776)

An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
(CVE-2023-39197)

An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.
(CVE-2023-44466)

In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (CVE-2023-52885)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix null pointer dereference in tracing_err_log_open() (CVE-2023-53167)

In the Linux kernel, the following vulnerability has been resolved:

ipv6/addrconf: fix a potential refcount underflow for idev (CVE-2023-53189)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile (CVE-2023-53243)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix wrong setting of max_corr_read_errors (CVE-2023-53313)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one (CVE-2023-53333)

In the Linux kernel, the following vulnerability has been resolved:

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). (CVE-2023-53343)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (CVE-2023-53357)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (CVE-2023-53380)

In the Linux kernel, the following vulnerability has been resolved:

shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs (CVE-2023-53391)

In the Linux kernel, the following vulnerability has been resolved:

ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() (CVE-2023-53420)

In the Linux kernel, the following vulnerability has been resolved:

bpf: cpumap: Fix memory leak in cpu_map_update_elem (CVE-2023-53441)

In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free (CVE-2023-53446)

In the Linux kernel, the following vulnerability has been resolved:

io_uring: wait interruptibly for request completions on exit (CVE-2023-53461)

In the Linux kernel, the following vulnerability has been resolved:

tracing/histograms: Add histograms to hist_vars if they have referenced variables (CVE-2023-53560)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Check for NOT_READY flag state after locking (CVE-2023-53581)

In the Linux kernel, the following vulnerability has been resolved:

bonding: do not assume skb mac_header is set (CVE-2023-53601)

In the Linux kernel, the following vulnerability has been resolved:

dax: Fix dax_mapping_release() use after free (CVE-2023-53613)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (CVE-2023-53619)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix deadloop issue on reading trace_pipe (CVE-2023-53668)

In the Linux kernel, the following vulnerability has been resolved:

clk: Fix memory leak in devm_clk_notifier_register() (CVE-2023-53674)

In the Linux kernel, the following vulnerability has been resolved:

bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (CVE-2023-53681)

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update kernel' or or 'yum update --advisory ALAS2KERNEL-5.15-2023-025' to update your system.

Plugin Details

Severity: High

ID: 179798

File Name: al2_ALASKERNEL-5_15-2023-025.nasl

Version: 1.17

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 8/14/2023

Updated: 10/27/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-44466

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:python-perf-debuginfo, p-cpe:/a:amazon:linux:kernel-livepatch-5.15.122-77.145, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-headers, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:python-perf

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/3/2023

Vulnerability Publication Date: 5/31/2023

Reference Information

CVE: CVE-2022-48502, CVE-2023-20569, CVE-2023-20593, CVE-2023-3611, CVE-2023-3776, CVE-2023-39197, CVE-2023-44466, CVE-2023-51043, CVE-2023-52885, CVE-2023-53167, CVE-2023-53189, CVE-2023-53243, CVE-2023-53313, CVE-2023-53333, CVE-2023-53343, CVE-2023-53357, CVE-2023-53380, CVE-2023-53391, CVE-2023-53420, CVE-2023-53441, CVE-2023-53446, CVE-2023-53461, CVE-2023-53560, CVE-2023-53581, CVE-2023-53601, CVE-2023-53613, CVE-2023-53619, CVE-2023-53668, CVE-2023-53674, CVE-2023-53681, CVE-2024-0639

Detections

Analytics