ALAS2KERNEL-5.15-2023-023

References: CVE-2021-28951  CVE-2022-0500  CVE-2022-1015  CVE-2022-1016  CVE-2022-1158  CVE-2022-1263  CVE-2022-1353  CVE-2022-1729  CVE-2022-23222  CVE-2022-2639  CVE-2022-28893  CVE-2022-29581  CVE-2022-29582  CVE-2022-30594  CVE-2023-1838  CVE-2023-28410 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25. (CVE-2021-28951)

A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system. (CVE-2022-0500)

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle return with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

When the KVM updates the guest's page table entry, it will first use get_user_pages_fast() to pin the page, and when it fails (e.g. the vma->flags has VM_IO or VM_PFNMAP), it will get corresponding VMA where the page lies in through find_vma_intersection(), calculate the physical address, and map the page to the kernel virtual address through memremap(), and finally, write the update.
The problem is that when we get the vma through find_vma_intersection(), only VM_PFNMAP is checked, not both VM_IO and VM_PFNMAP. In the reproducer below, after the KVM_SET_USER_MEMORY_REGION is completed, we replace the guest's memory mapping with the kernel-user shared region of io_uring and then perform the KVM_TRANSLATE operation, which finally triggers the page table entry update. Now, memremap() will return page_offset_base (direct mapping of all physical memory) + vaddr (the linear address of KVM_TRANSLATE) + vm_pgoff (the offset when io_uring performs mmap(2)), and use the return value as the base address for CMPXCHG (write 0x21 in this case). Since both vaddr and vm_pgoff are controllable by the user-mode process, writing may exceed the previously mapped guest memory space and trigger exceptions such as UAF. The vulnerability shares similarities with CVE-2021-22543. (CVE-2022-1158)

A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. (CVE-2022-1263)

A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information. (CVE-2022-1353)

perf: Fix sys_perf_event_open() race against self (CVE-2022-1729)

A flaw was found in the Linux kernel's adjust_ptr_min_max_vals in the kernel/bpf/verifier.c function. In this flaw, a missing sanity check for *_OR_NULL pointer types that perform pointer arithmetic may cause a kernel information leak issue. (CVE-2022-23222)

An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state. (CVE-2022-28893)

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions. (CVE-2022-29581)

A use-after-free flaw was found in the Linux kernel's io_uring interface subsystem in the way a user triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or escalate their privileges on the system. (CVE-2022-29582)

The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem. (CVE-2023-1838)

Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable escalation of privilege via local access. (CVE-2023-28410)

Issue Correction:
Run yum update kernel to update your system.

New Packages:

aarch64:
    kernel-5.15.43-20.103.amzn2.aarch64
    kernel-headers-5.15.43-20.103.amzn2.aarch64
    kernel-debuginfo-common-aarch64-5.15.43-20.103.amzn2.aarch64
    perf-5.15.43-20.103.amzn2.aarch64
    perf-debuginfo-5.15.43-20.103.amzn2.aarch64
    python-perf-5.15.43-20.103.amzn2.aarch64
    python-perf-debuginfo-5.15.43-20.103.amzn2.aarch64
    kernel-tools-5.15.43-20.103.amzn2.aarch64
    kernel-tools-devel-5.15.43-20.103.amzn2.aarch64
    kernel-tools-debuginfo-5.15.43-20.103.amzn2.aarch64
    bpftool-5.15.43-20.103.amzn2.aarch64
    bpftool-debuginfo-5.15.43-20.103.amzn2.aarch64
    kernel-devel-5.15.43-20.103.amzn2.aarch64
    kernel-debuginfo-5.15.43-20.103.amzn2.aarch64
    kernel-livepatch-5.15.43-20.103-1.0-0.amzn2.aarch64

i686:
    kernel-headers-5.15.43-20.103.amzn2.i686

src:
    kernel-5.15.43-20.103.amzn2.src

x86_64:
    kernel-5.15.43-20.103.amzn2.x86_64
    kernel-headers-5.15.43-20.103.amzn2.x86_64
    kernel-debuginfo-common-x86_64-5.15.43-20.103.amzn2.x86_64
    perf-5.15.43-20.103.amzn2.x86_64
    perf-debuginfo-5.15.43-20.103.amzn2.x86_64
    python-perf-5.15.43-20.103.amzn2.x86_64
    python-perf-debuginfo-5.15.43-20.103.amzn2.x86_64
    kernel-tools-5.15.43-20.103.amzn2.x86_64
    kernel-tools-devel-5.15.43-20.103.amzn2.x86_64
    kernel-tools-debuginfo-5.15.43-20.103.amzn2.x86_64
    bpftool-5.15.43-20.103.amzn2.x86_64
    bpftool-debuginfo-5.15.43-20.103.amzn2.x86_64
    kernel-devel-5.15.43-20.103.amzn2.x86_64
    kernel-debuginfo-5.15.43-20.103.amzn2.x86_64
    kernel-livepatch-5.15.43-20.103-1.0-0.amzn2.x86_64