Amazon Linux 2 Security Advisory: ALAS2LIVEPATCH-2023-120
Advisory Released Date: 2023-04-17
Advisory Updated Date: 2023-04-17
Severity:
Important
Issue Overview:
kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)
do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)
Affected Packages:
kernel-livepatch-5.10.165-143.735
Issue Correction:
Please ensure you have live patching enabled. Run yum update kernel-livepatch-5.10.165-143.735 or yum update --advisory ALAS2LIVEPATCH-2023-120 to update your system.
New Packages:
aarch64:
kernel-livepatch-5.10.165-143.735-1.0-3.amzn2.aarch64
kernel-livepatch-5.10.165-143.735-debuginfo-1.0-3.amzn2.aarch64
src:
kernel-livepatch-5.10.165-143.735-1.0-3.amzn2.src
x86_64:
kernel-livepatch-5.10.165-143.735-1.0-3.amzn2.x86_64
kernel-livepatch-5.10.165-143.735-debuginfo-1.0-3.amzn2.x86_64