Detections
Analytics

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1144)

high Nessus Plugin ID 246924

Language:

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1144 advisory.

 In the Linux kernel, the following vulnerability has been resolved:

 xsk: Fix race condition in AF_XDP generic RX path (CVE-2025-37920)

 In the Linux kernel, the following vulnerability has been resolved:

 virtio: break and reset virtio devices on device_shutdown() (CVE-2025-38064)

 In the Linux kernel, the following vulnerability has been resolved:

 rseq: Fix segfault on registration when rseq_cs is non-zero (CVE-2025-38067)

 In the Linux kernel, the following vulnerability has been resolved:

 smb: client: fix potential deadlock when reconnecting channels (CVE-2025-38244)

 In the Linux kernel, the following vulnerability has been resolved:

 bridge: mcast: Fix use-after-free during router port configuration (CVE-2025-38248)

 In the Linux kernel, the following vulnerability has been resolved:

 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)

 In the Linux kernel, the following vulnerability has been resolved:

 md/raid1: Fix stack memory use after return in raid1_reshape (CVE-2025-38445)

 In the Linux kernel, the following vulnerability has been resolved:

 net/sched: Abort __tc_modify_qdisc if parent class does not exist (CVE-2025-38457)

 In the Linux kernel, the following vulnerability has been resolved:

 vsock: Fix transport_* TOCTOU (CVE-2025-38461)

 In the Linux kernel, the following vulnerability has been resolved:

 vsock: Fix transport_{g2h,h2g} TOCTOU (CVE-2025-38462)

 In the Linux kernel, the following vulnerability has been resolved:

 perf: Revert to requiring CAP_SYS_ADMIN for uprobes (CVE-2025-38466)

 In the Linux kernel, the following vulnerability has been resolved:

 tls: always refresh the queue when reading sock (CVE-2025-38471)

 In the Linux kernel, the following vulnerability has been resolved:

 netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)

 In the Linux kernel, the following vulnerability has been resolved:

 net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)

 In the Linux kernel, the following vulnerability has been resolved:

 smb: client: fix use-after-free in crypt_message when using async crypto (CVE-2025-38488)

 In the Linux kernel, the following vulnerability has been resolved:

 HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494)

 In the Linux kernel, the following vulnerability has been resolved:

 HID: core: ensure the allocated report buffer can contain the reserved report ID (CVE-2025-38495)

 In the Linux kernel, the following vulnerability has been resolved:

 clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499)

 In the Linux kernel, the following vulnerability has been resolved:

 smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)

 In the Linux kernel, the following vulnerability has been resolved:

 ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel --releasever 2023.8.20250808' or or 'dnf update --advisory ALAS2023-2025-1144 --releasever 2023.8.20250808' to update your system.

See Also

https://alas.aws.amazon.com//AL2023/ALAS2023-2025-1144.html

https://alas.aws.amazon.com/faqs.html

https://explore.alas.aws.amazon.com/CVE-2025-37920.html

https://explore.alas.aws.amazon.com/CVE-2025-38064.html

https://explore.alas.aws.amazon.com/CVE-2025-38067.html

https://explore.alas.aws.amazon.com/CVE-2025-38244.html

https://explore.alas.aws.amazon.com/CVE-2025-38248.html

https://explore.alas.aws.amazon.com/CVE-2025-38396.html

https://explore.alas.aws.amazon.com/CVE-2025-38445.html

https://explore.alas.aws.amazon.com/CVE-2025-38457.html

https://explore.alas.aws.amazon.com/CVE-2025-38461.html

https://explore.alas.aws.amazon.com/CVE-2025-38462.html

https://explore.alas.aws.amazon.com/CVE-2025-38466.html

https://explore.alas.aws.amazon.com/CVE-2025-38471.html

https://explore.alas.aws.amazon.com/CVE-2025-38472.html

https://explore.alas.aws.amazon.com/CVE-2025-38477.html

https://explore.alas.aws.amazon.com/CVE-2025-38488.html

https://explore.alas.aws.amazon.com/CVE-2025-38494.html

https://explore.alas.aws.amazon.com/CVE-2025-38495.html

https://explore.alas.aws.amazon.com/CVE-2025-38499.html

https://explore.alas.aws.amazon.com/CVE-2025-38527.html

https://explore.alas.aws.amazon.com/CVE-2025-38550.html

Plugin Details

Severity: High

ID: 246924

File Name: al2023_ALAS2023-2025-1144.nasl

Version: 1.3

Type: local

Agent: unix

Published: 8/9/2025

Updated: 9/11/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

CVSS v2

Risk Factor: High

Base Score: 7.3

Temporal Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:C

CVSS Score Source: CVE-2025-38471

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:kernel-libbpf, cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:python3-perf, p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:kernel-headers, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:kernel-livepatch-6.1.147-172.266, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-modules-extra-common, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:python3-perf-debuginfo, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:kernel-libbpf-static, p-cpe:/a:amazon:linux:kernel-libbpf-debuginfo, p-cpe:/a:amazon:linux:kernel-libbpf-devel, p-cpe:/a:amazon:linux:kernel-modules-extra, p-cpe:/a:amazon:linux:kernel-debuginfo

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/8/2025

Vulnerability Publication Date: 5/20/2025

Reference Information

CVE: CVE-2025-37920, CVE-2025-38064, CVE-2025-38067, CVE-2025-38244, CVE-2025-38248, CVE-2025-38396, CVE-2025-38445, CVE-2025-38457, CVE-2025-38461, CVE-2025-38462, CVE-2025-38466, CVE-2025-38471, CVE-2025-38472, CVE-2025-38477, CVE-2025-38488, CVE-2025-38494, CVE-2025-38495, CVE-2025-38499, CVE-2025-38527, CVE-2025-38550