Vulmon
Amazon Linux 2 Security Advisory: ALASLIVEPATCH-2023-115
Advisory Release Date: 2023-03-30 22:07 Pacific
Advisory Updated Date: 2023-04-05 20:53 Pacific
The upstream bug report describes this issue as follows:
A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an OOB access, and a lock corruption. (CVE-2023-1078)
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)
Affected Packages:
kernel-livepatch-5.10.165-143.735
Issue Correction:
Please ensure you have live patching enabled.
Run yum update kernel-livepatch-5.10.165-143.735 to update your system.
aarch64:
kernel-livepatch-5.10.165-143.735-1.0-2.amzn2.aarch64
kernel-livepatch-5.10.165-143.735-debuginfo-1.0-2.amzn2.aarch64
src:
kernel-livepatch-5.10.165-143.735-1.0-2.amzn2.src
x86_64:
kernel-livepatch-5.10.165-143.735-1.0-2.amzn2.x86_64
kernel-livepatch-5.10.165-143.735-debuginfo-1.0-2.amzn2.x86_64