Amazon Linux 2 Security Advisory: ALASKERNEL-5.4-2023-043
Advisory Release Date: 2023-03-17 16:45 Pacific
Advisory Updated Date: 2023-03-21 21:45 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a (CVE-2022-2196)
It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is dynamically partitioned between non-idle threads. This allows an attacker to control speculative execution on the adjacent thread. (CVE-2022-27672)
kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)
The upstream bug report describes this issue as follows:
A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)
Affected Packages:
kernel
Issue Correction:
Run yum update kernel to update your system.
aarch64:
kernel-5.4.235-144.344.amzn2.aarch64
kernel-headers-5.4.235-144.344.amzn2.aarch64
kernel-debuginfo-common-aarch64-5.4.235-144.344.amzn2.aarch64
perf-5.4.235-144.344.amzn2.aarch64
perf-debuginfo-5.4.235-144.344.amzn2.aarch64
python-perf-5.4.235-144.344.amzn2.aarch64
python-perf-debuginfo-5.4.235-144.344.amzn2.aarch64
kernel-tools-5.4.235-144.344.amzn2.aarch64
kernel-tools-devel-5.4.235-144.344.amzn2.aarch64
kernel-tools-debuginfo-5.4.235-144.344.amzn2.aarch64
bpftool-5.4.235-144.344.amzn2.aarch64
bpftool-debuginfo-5.4.235-144.344.amzn2.aarch64
kernel-devel-5.4.235-144.344.amzn2.aarch64
kernel-debuginfo-5.4.235-144.344.amzn2.aarch64
i686:
kernel-headers-5.4.235-144.344.amzn2.i686
src:
kernel-5.4.235-144.344.amzn2.src
x86_64:
kernel-5.4.235-144.344.amzn2.x86_64
kernel-headers-5.4.235-144.344.amzn2.x86_64
kernel-debuginfo-common-x86_64-5.4.235-144.344.amzn2.x86_64
perf-5.4.235-144.344.amzn2.x86_64
perf-debuginfo-5.4.235-144.344.amzn2.x86_64
python-perf-5.4.235-144.344.amzn2.x86_64
python-perf-debuginfo-5.4.235-144.344.amzn2.x86_64
kernel-tools-5.4.235-144.344.amzn2.x86_64
kernel-tools-devel-5.4.235-144.344.amzn2.x86_64
kernel-tools-debuginfo-5.4.235-144.344.amzn2.x86_64
bpftool-5.4.235-144.344.amzn2.x86_64
bpftool-debuginfo-5.4.235-144.344.amzn2.x86_64
kernel-devel-5.4.235-144.344.amzn2.x86_64
kernel-debuginfo-5.4.235-144.344.amzn2.x86_64