Vulmon
Amazon Linux 2022 Security Advisory: ALAS-2022-150
Advisory Release Date: 2022-10-11 21:41 Pacific
Advisory Updated Date: 2022-10-13 18:48 Pacific
A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)
An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory. (CVE-2022-1462)
A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)
A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel lockdown was enabled (CVE-2022-21505)
A use-after-free flaw was found in the Linux kernel's POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2585)
A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation. (CVE-2022-2586)
A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege escalation problem. (CVE-2022-2588)
A firewall flaw that can bypass the Linux kernel's Netfilter functionality was found in how a user handles unencrypted IRC with nf_conntrack_irc configured. This flaw allows a remote user to gain unauthorized access to the system. (CVE-2022-2663)
An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. (CVE-2022-2905)
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. (CVE-2022-3028)
Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error. (CVE-2022-3061)
A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE handling. (CVE-2022-3176)
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition. (CVE-2022-3303)
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)
A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash the system or a remote user to crash the system when the libnetfilter_queue is used by a local user. (CVE-2022-36946)
A flaw was found in the x86 KVM subsystem in kvm_steal_time_set_preempted in arch/x86/kvm/x86.c in the Linux kernel. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations. (CVE-2022-39189)
An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain. (CVE-2022-39190)
An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. (CVE-2022-39842)
A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to crash the system. (CVE-2022-40307)
Affected Packages:
kernel
Issue Correction:
Run dnf update kernel --releasever=2022.0.20221012 to update your system.
aarch64:
kernel-tools-5.15.72-43.134.amzn2022.aarch64
perf-debuginfo-5.15.72-43.134.amzn2022.aarch64
kernel-tools-debuginfo-5.15.72-43.134.amzn2022.aarch64
python3-perf-5.15.72-43.134.amzn2022.aarch64
kernel-libbpf-static-5.15.72-43.134.amzn2022.aarch64
kernel-libbpf-5.15.72-43.134.amzn2022.aarch64
python3-perf-debuginfo-5.15.72-43.134.amzn2022.aarch64
kernel-headers-5.15.72-43.134.amzn2022.aarch64
kernel-tools-devel-5.15.72-43.134.amzn2022.aarch64
bpftool-5.15.72-43.134.amzn2022.aarch64
kernel-livepatch-5.15.72-43.134-1.0-0.amzn2022.aarch64
kernel-libbpf-devel-5.15.72-43.134.amzn2022.aarch64
perf-5.15.72-43.134.amzn2022.aarch64
bpftool-debuginfo-5.15.72-43.134.amzn2022.aarch64
kernel-debuginfo-5.15.72-43.134.amzn2022.aarch64
kernel-5.15.72-43.134.amzn2022.aarch64
kernel-debuginfo-common-aarch64-5.15.72-43.134.amzn2022.aarch64
kernel-devel-5.15.72-43.134.amzn2022.aarch64
i686:
kernel-headers-5.15.72-43.134.amzn2022.i686
src:
kernel-5.15.72-43.134.amzn2022.src
x86_64:
python3-perf-5.15.72-43.134.amzn2022.x86_64
kernel-livepatch-5.15.72-43.134-1.0-0.amzn2022.x86_64
kernel-tools-devel-5.15.72-43.134.amzn2022.x86_64
kernel-libbpf-devel-5.15.72-43.134.amzn2022.x86_64
bpftool-5.15.72-43.134.amzn2022.x86_64
kernel-libbpf-static-5.15.72-43.134.amzn2022.x86_64
kernel-tools-debuginfo-5.15.72-43.134.amzn2022.x86_64
bpftool-debuginfo-5.15.72-43.134.amzn2022.x86_64
python3-perf-debuginfo-5.15.72-43.134.amzn2022.x86_64
kernel-tools-5.15.72-43.134.amzn2022.x86_64
kernel-libbpf-5.15.72-43.134.amzn2022.x86_64
perf-5.15.72-43.134.amzn2022.x86_64
perf-debuginfo-5.15.72-43.134.amzn2022.x86_64
kernel-headers-5.15.72-43.134.amzn2022.x86_64
kernel-debuginfo-5.15.72-43.134.amzn2022.x86_64
kernel-5.15.72-43.134.amzn2022.x86_64
kernel-debuginfo-common-x86_64-5.15.72-43.134.amzn2022.x86_64
kernel-devel-5.15.72-43.134.amzn2022.x86_64