Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS2-2022-1749

Related Vulnerabilities: CVE-2021-28711   CVE-2021-28712   CVE-2021-28713   CVE-2021-28714   CVE-2021-28715   CVE-2021-4083   CVE-2021-4155   CVE-2021-44733   CVE-2022-0492  

A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711) A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712) A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713) Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714) Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2021-4083) A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. (CVE-2021-4155) A use-after-free flaw in the Linux kernel TEE (Trusted Execution Environment) subsystem was found in the way user calls ioctl TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE. A local user could use this flaw to crash the system or escalate their privileges on the system. If the Linux system non configured with the CONFIG_PREEMPT option or CONFIG_CPU_SW_DOMAIN_PAN option enabled, then it is unlikely that a user can trigger this issue. (CVE-2021-44733) The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set of capabilities. Therefore require capabilities when setting the release_agent. (CVE-2022-0492)

Source

ALAS2-2022-1749

Amazon Linux 2 Security Advisory: ALAS-2022-1749
Advisory Release Date: 2022-02-04 23:25 Pacific
Advisory Updated Date: 2022-02-07 23:01 Pacific
Severity: Important
Issue Overview:

A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.
A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711)

A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.
A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712)

A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.
A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713)

Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715)

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2021-4083)

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. (CVE-2021-4155)

A use-after-free flaw in the Linux kernel TEE (Trusted Execution Environment) subsystem was found in the way user calls ioctl TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE. A local user could use this flaw to crash the system or escalate their privileges on the system. If the Linux system non configured with the CONFIG_PREEMPT option or CONFIG_CPU_SW_DOMAIN_PAN option enabled, then it is unlikely that a user can trigger this issue. (CVE-2021-44733)

The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set of capabilities. Therefore require capabilities when setting the release_agent. (CVE-2022-0492)


Affected Packages:

kernel


Issue Correction:
Run yum update kernel to update your system.

New Packages:
aarch64:
    kernel-4.14.262-200.489.amzn2.aarch64
    kernel-headers-4.14.262-200.489.amzn2.aarch64
    kernel-debuginfo-common-aarch64-4.14.262-200.489.amzn2.aarch64
    perf-4.14.262-200.489.amzn2.aarch64
    perf-debuginfo-4.14.262-200.489.amzn2.aarch64
    python-perf-4.14.262-200.489.amzn2.aarch64
    python-perf-debuginfo-4.14.262-200.489.amzn2.aarch64
    kernel-tools-4.14.262-200.489.amzn2.aarch64
    kernel-tools-devel-4.14.262-200.489.amzn2.aarch64
    kernel-tools-debuginfo-4.14.262-200.489.amzn2.aarch64
    kernel-devel-4.14.262-200.489.amzn2.aarch64
    kernel-debuginfo-4.14.262-200.489.amzn2.aarch64

i686:
    kernel-headers-4.14.262-200.489.amzn2.i686

src:
    kernel-4.14.262-200.489.amzn2.src

x86_64:
    kernel-4.14.262-200.489.amzn2.x86_64
    kernel-headers-4.14.262-200.489.amzn2.x86_64
    kernel-debuginfo-common-x86_64-4.14.262-200.489.amzn2.x86_64
    perf-4.14.262-200.489.amzn2.x86_64
    perf-debuginfo-4.14.262-200.489.amzn2.x86_64
    python-perf-4.14.262-200.489.amzn2.x86_64
    python-perf-debuginfo-4.14.262-200.489.amzn2.x86_64
    kernel-tools-4.14.262-200.489.amzn2.x86_64
    kernel-tools-devel-4.14.262-200.489.amzn2.x86_64
    kernel-tools-debuginfo-4.14.262-200.489.amzn2.x86_64
    kernel-devel-4.14.262-200.489.amzn2.x86_64
    kernel-debuginfo-4.14.262-200.489.amzn2.x86_64
    kernel-livepatch-4.14.262-200.489-1.0-0.amzn2.x86_64

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started