Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS2KERNEL-5.4-2023-043

Related Vulnerabilities: CVE-2022-2196   CVE-2022-27672   CVE-2023-1077   CVE-2023-1078   CVE-2023-26545  

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a (CVE-2022-2196) It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is dynamically partitioned between non-idle threads. This allows an attacker to control speculative execution on the adjacent thread. (CVE-2022-27672) kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077) The upstream bug report describes this issue as follows: A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an OOB access, and a lock corruption. (CVE-2023-1078) In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

Source

ALAS2KERNEL-5.4-2023-043

Amazon Linux 2 Security Advisory: ALASKERNEL-5.4-2023-043
Advisory Release Date: 2023-03-17 16:45 Pacific
Advisory Updated Date: 2023-03-21 21:45 Pacific
Severity: Important
Issue Overview:

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a (CVE-2022-2196)

It has been discovered that on some AMD CPUs, the RAS (Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology) is dynamically partitioned between non-idle threads. This allows an attacker to control speculative execution on the adjacent thread. (CVE-2022-27672)

kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

The upstream bug report describes this issue as follows:

A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)

In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)


Affected Packages:

kernel


Issue Correction:
Run yum update kernel to update your system.

New Packages:
aarch64:
    kernel-5.4.235-144.344.amzn2.aarch64
    kernel-headers-5.4.235-144.344.amzn2.aarch64
    kernel-debuginfo-common-aarch64-5.4.235-144.344.amzn2.aarch64
    perf-5.4.235-144.344.amzn2.aarch64
    perf-debuginfo-5.4.235-144.344.amzn2.aarch64
    python-perf-5.4.235-144.344.amzn2.aarch64
    python-perf-debuginfo-5.4.235-144.344.amzn2.aarch64
    kernel-tools-5.4.235-144.344.amzn2.aarch64
    kernel-tools-devel-5.4.235-144.344.amzn2.aarch64
    kernel-tools-debuginfo-5.4.235-144.344.amzn2.aarch64
    bpftool-5.4.235-144.344.amzn2.aarch64
    bpftool-debuginfo-5.4.235-144.344.amzn2.aarch64
    kernel-devel-5.4.235-144.344.amzn2.aarch64
    kernel-debuginfo-5.4.235-144.344.amzn2.aarch64

i686:
    kernel-headers-5.4.235-144.344.amzn2.i686

src:
    kernel-5.4.235-144.344.amzn2.src

x86_64:
    kernel-5.4.235-144.344.amzn2.x86_64
    kernel-headers-5.4.235-144.344.amzn2.x86_64
    kernel-debuginfo-common-x86_64-5.4.235-144.344.amzn2.x86_64
    perf-5.4.235-144.344.amzn2.x86_64
    perf-debuginfo-5.4.235-144.344.amzn2.x86_64
    python-perf-5.4.235-144.344.amzn2.x86_64
    python-perf-debuginfo-5.4.235-144.344.amzn2.x86_64
    kernel-tools-5.4.235-144.344.amzn2.x86_64
    kernel-tools-devel-5.4.235-144.344.amzn2.x86_64
    kernel-tools-debuginfo-5.4.235-144.344.amzn2.x86_64
    bpftool-5.4.235-144.344.amzn2.x86_64
    bpftool-debuginfo-5.4.235-144.344.amzn2.x86_64
    kernel-devel-5.4.235-144.344.amzn2.x86_64
    kernel-debuginfo-5.4.235-144.344.amzn2.x86_64

Additional References

Red Hat: CVE-2022-2196, CVE-2022-27672, CVE-2023-1077, CVE-2023-1078, CVE-2023-26545

Mitre: CVE-2022-2196, CVE-2022-27672, CVE-2023-1077, CVE-2023-1078, CVE-2023-26545

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started