Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-947)

high Nessus Plugin ID 234942

Language:

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-947 advisory.

In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle errors from btrfs_dec_ref() properly (CVE-2024-46753)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: socket: Lookup orig tuple for IPv6 SNAT (CVE-2025-22021)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: put dl_stid if fail to queue dl_recall (CVE-2025-22025)

In the Linux kernel, the following vulnerability has been resolved:

media: streamzap: fix race between device disconnection and urb callback (CVE-2025-22027)

In the Linux kernel, the following vulnerability has been resolved:

arm64: Don't call NULL in do_compat_alignment_fixup() (CVE-2025-22033)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free in print_graph_function_flags during tracer switching (CVE-2025-22035)

In the Linux kernel, the following vulnerability has been resolved:

acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (CVE-2025-22044)

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (CVE-2025-22045)

In the Linux kernel, the following vulnerability has been resolved:

net: fix geneve_opt length integer overflow (CVE-2025-22055)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)

In the Linux kernel, the following vulnerability has been resolved:

udp: Fix memory accounting leak. (CVE-2025-22058)

In the Linux kernel, the following vulnerability has been resolved:

netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)

In the Linux kernel, the following vulnerability has been resolved:

rtnetlink: Allocate vfinfo size for VF GUIDs when supported (CVE-2025-22075)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix a couple integer overflows on 32bit systems (CVE-2025-22081)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (CVE-2025-22086)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Don't expose hw_counters outside of init net namespace (CVE-2025-22089)

In the Linux kernel, the following vulnerability has been resolved:

thermal: int340x: Add NULL check for adev (CVE-2025-23136)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir (CVE-2025-37785)

In the Linux kernel, the following vulnerability has been resolved:

net_sched: skbprio: Remove overly strict queue assertions (CVE-2025-38637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel --releasever 2023.7.20250428' to update your system.

Plugin Details

Severity: High

ID: 234942

File Name: al2023_ALAS2023-2025-947.nasl

Version: 1.4

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 4/29/2025

Updated: 6/20/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-22056

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:kernel-modules-extra-common, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:kernel-modules-extra, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:python3-perf, p-cpe:/a:amazon:linux:kernel-libbpf-static, p-cpe:/a:amazon:linux:kernel-libbpf-debuginfo, p-cpe:/a:amazon:linux:kernel-livepatch-6.1.134-150.224, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-libbpf, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:kernel-libbpf-devel, p-cpe:/a:amazon:linux:kernel-headers, p-cpe:/a:amazon:linux:kernel-tools-devel, cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:python3-perf-debuginfo, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 4/23/2025

Vulnerability Publication Date: 2/27/2025

Reference Information

CVE: CVE-2024-46753, CVE-2025-21759, CVE-2025-22021, CVE-2025-22025, CVE-2025-22027, CVE-2025-22033, CVE-2025-22035, CVE-2025-22044, CVE-2025-22045, CVE-2025-22055, CVE-2025-22056, CVE-2025-22058, CVE-2025-22063, CVE-2025-22075, CVE-2025-22081, CVE-2025-22086, CVE-2025-22089, CVE-2025-23136, CVE-2025-37785, CVE-2025-38637

Detections

Analytics