Amazon Linux 2 Security Advisory: ALAS2KERNEL-5.15-2025-068
Advisory Released Date: 2025-03-06
Advisory Updated Date: 2025-05-21
FAQs regarding Amazon Linux ALAS/CVE Severity
A flaw was found in hw. Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type, potentially leading to information disclosure. (CVE-2022-23825)
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)
A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to enable information disclosure via local access. (CVE-2022-28693)
A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-29900)
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-29901)
A memory access flaw was found in the Linux kernel's XEN hypervisor for the virtual machine. This flaw allows a local user to crash the system or potentially escalate their privileges on the system. (CVE-2022-36123)
In the Linux kernel, the following vulnerability has been resolved:
vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)
In the Linux kernel, the following vulnerability has been resolved:
x86/speculation: Fill RSB on vmexit for IBRS (CVE-2022-49611)
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250: Fix PM usage_count for console handover (CVE-2022-49613)
In the Linux kernel, the following vulnerability has been resolved:
net: tipc: fix possible refcount leak in tipc_sk_create() (CVE-2022-49620)
In the Linux kernel, the following vulnerability has been resolved:
ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)
In the Linux kernel, the following vulnerability has been resolved:
nexthop: Fix data-races around nexthop_compat_mode. (CVE-2022-49629)
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix a data-race around sysctl_tcp_ecn_fallback. (CVE-2022-49630)
In the Linux kernel, the following vulnerability has been resolved:
raw: Fix a data-race around sysctl_raw_l3mdev_accept. (CVE-2022-49631)
In the Linux kernel, the following vulnerability has been resolved:
icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. (CVE-2022-49632)
In the Linux kernel, the following vulnerability has been resolved:
icmp: Fix data-races around sysctl_icmp_echo_enable_probe. (CVE-2022-49633)
In the Linux kernel, the following vulnerability has been resolved:
sysctl: Fix data-races in proc_dou8vec_minmax(). (CVE-2022-49634)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: Fix a data-race around sysctl_fib_sync_mem. (CVE-2022-49637)
In the Linux kernel, the following vulnerability has been resolved:
icmp: Fix data-races around sysctl. (CVE-2022-49638)
In the Linux kernel, the following vulnerability has been resolved:
cipso: Fix data-races around sysctl. (CVE-2022-49639)
In the Linux kernel, the following vulnerability has been resolved:
sysctl: Fix data races in proc_douintvec_minmax(). (CVE-2022-49640)
In the Linux kernel, the following vulnerability has been resolved:
sysctl: Fix data races in proc_douintvec(). (CVE-2022-49641)
In the Linux kernel, the following vulnerability has been resolved:
ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() (CVE-2022-49644)
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Use separate src/dst nodes when preloading css_sets for migration (CVE-2022-49647)
In the Linux kernel, the following vulnerability has been resolved:
xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue (CVE-2022-49649)
Affected Packages:
kernel
Note:
This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update kernel to update your system.
aarch64:
kernel-5.15.57-29.131.amzn2.aarch64
kernel-headers-5.15.57-29.131.amzn2.aarch64
kernel-debuginfo-common-aarch64-5.15.57-29.131.amzn2.aarch64
perf-5.15.57-29.131.amzn2.aarch64
perf-debuginfo-5.15.57-29.131.amzn2.aarch64
python-perf-5.15.57-29.131.amzn2.aarch64
python-perf-debuginfo-5.15.57-29.131.amzn2.aarch64
kernel-tools-5.15.57-29.131.amzn2.aarch64
kernel-tools-devel-5.15.57-29.131.amzn2.aarch64
kernel-tools-debuginfo-5.15.57-29.131.amzn2.aarch64
bpftool-5.15.57-29.131.amzn2.aarch64
bpftool-debuginfo-5.15.57-29.131.amzn2.aarch64
kernel-devel-5.15.57-29.131.amzn2.aarch64
kernel-debuginfo-5.15.57-29.131.amzn2.aarch64
kernel-livepatch-5.15.57-29.131-1.0-0.amzn2.aarch64
i686:
kernel-headers-5.15.57-29.131.amzn2.i686
src:
kernel-5.15.57-29.131.amzn2.src
x86_64:
kernel-5.15.57-29.131.amzn2.x86_64
kernel-headers-5.15.57-29.131.amzn2.x86_64
kernel-debuginfo-common-x86_64-5.15.57-29.131.amzn2.x86_64
perf-5.15.57-29.131.amzn2.x86_64
perf-debuginfo-5.15.57-29.131.amzn2.x86_64
python-perf-5.15.57-29.131.amzn2.x86_64
python-perf-debuginfo-5.15.57-29.131.amzn2.x86_64
kernel-tools-5.15.57-29.131.amzn2.x86_64
kernel-tools-devel-5.15.57-29.131.amzn2.x86_64
kernel-tools-debuginfo-5.15.57-29.131.amzn2.x86_64
bpftool-5.15.57-29.131.amzn2.x86_64
bpftool-debuginfo-5.15.57-29.131.amzn2.x86_64
kernel-devel-5.15.57-29.131.amzn2.x86_64
kernel-debuginfo-5.15.57-29.131.amzn2.x86_64
kernel-livepatch-5.15.57-29.131-1.0-0.amzn2.x86_64
2025-05-21: CVE-2022-49632 was added to this advisory.
2025-05-21: CVE-2022-49639 was added to this advisory.
2025-05-21: CVE-2022-49649 was added to this advisory.
2025-05-21: CVE-2022-49641 was added to this advisory.
2025-05-21: CVE-2022-49630 was added to this advisory.
2025-05-21: CVE-2022-49634 was added to this advisory.
2025-05-21: CVE-2022-49620 was added to this advisory.
2025-05-21: CVE-2022-49644 was added to this advisory.
2025-05-21: CVE-2022-49627 was added to this advisory.
2025-05-21: CVE-2022-49637 was added to this advisory.
2025-05-21: CVE-2022-49613 was added to this advisory.
2025-05-21: CVE-2022-49643 was added to this advisory.