Amazon Linux 2023 Security Advisory: ALAS2023LIVEPATCH-2024-027
Advisory Released Date: 2024-06-26
Advisory Updated Date: 2024-06-26
Severity:
Important
Issue Overview:
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.
We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. (CVE-2024-1086)
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. (CVE-2024-23849)
Affected Packages:
kernel-livepatch-6.1.72-96.166
Issue Correction:
Please ensure you have live patching enabled. Run dnf update kernel-livepatch-6.1.72-96.166 --releasever latest or dnf update --advisory ALAS2023LIVEPATCH-2024-027 --releasever latest to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
kernel-livepatch-6.1.72-96.166-1.0-1.amzn2023.aarch64
src:
kernel-livepatch-6.1.72-96.166-1.0-1.amzn2023.src
x86_64:
kernel-livepatch-6.1.72-96.166-1.0-1.amzn2023.x86_64