ALAS2LIVEPATCH-2024-187

Amazon Linux 2 Security Advisory: ALAS2LIVEPATCH-2024-187
Advisory Released Date: 2024-08-21
Advisory Updated Date: 2024-08-21

Severity: Important

References: CVE-2022-48666 CVE-2024-41090 CVE-2024-41091
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix a use-after-free (CVE-2022-48666)

kernel: virtio-net: tap: mlx5_core short frame denial of service (CVE-2024-41090)

kernel: virtio-net: tun: mlx5_core short frame denial of service (CVE-2024-41091)

Affected Packages:

kernel-livepatch-5.10.218-206.860

Issue Correction:
Run yum update kernel-livepatch-5.10.218-206.860 to update your system.

New Packages:

aarch64:
    kernel-livepatch-5.10.218-206.860-1.0-2.amzn2.aarch64
    kernel-livepatch-5.10.218-206.860-debuginfo-1.0-2.amzn2.aarch64

src:
    kernel-livepatch-5.10.218-206.860-1.0-2.amzn2.src

x86_64:
    kernel-livepatch-5.10.218-206.860-1.0-2.amzn2.x86_64
    kernel-livepatch-5.10.218-206.860-debuginfo-1.0-2.amzn2.x86_64

Additional References

Release Notes: Amazon Linux 2 Release Notes

Red Hat: CVE-2022-48666, CVE-2024-41090, CVE-2024-41091

Mitre: CVE-2022-48666, CVE-2024-41090, CVE-2024-41091