Linux · Amazon Linux · Security advisory · February 17, 2023

ALAS2023-2023-070: Security update for 19 packages

ALAS2023-2023-070, released February 17, 2023, fixes 111 CVEs across 19 products. 4 of them are being exploited (CVE-2022-0847); 4 on CISA KEV. Patch Radar priority: Patch now.

Patch now4 on CISA KEV1 publicly disclosed
CVEs closed
111
None rated Critical
Exploited
4
CVE-2022-0847
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.9280
99th percentile

Priority of the 111 CVEs

Patch now 4 Urgent 0 High 66 Routine 41

Fixed package versions

ProductReleaseFixed in
bpftoolamzn 20236.1.10-15.42.amzn2023
bpftool-debuginfoamzn 20236.1.10-15.42.amzn2023
kernelamzn 20236.1.10-15.42.amzn2023
kernel-debuginfoamzn 20236.1.10-15.42.amzn2023
kernel-debuginfo-common-aarch64amzn 20236.1.10-15.42.amzn2023
kernel-debuginfo-common-x86_64amzn 20236.1.10-15.42.amzn2023
kernel-develamzn 20236.1.10-15.42.amzn2023
kernel-headersamzn 20236.1.10-15.42.amzn2023
kernel-libbpfamzn 20236.1.10-15.42.amzn2023
kernel-libbpf-develamzn 20236.1.10-15.42.amzn2023
kernel-libbpf-staticamzn 20236.1.10-15.42.amzn2023
kernel-livepatch-6.1.10-15.42amzn 20231.0-0.amzn2023
kernel-toolsamzn 20236.1.10-15.42.amzn2023
kernel-tools-debuginfoamzn 20236.1.10-15.42.amzn2023
kernel-tools-develamzn 20236.1.10-15.42.amzn2023
perfamzn 20236.1.10-15.42.amzn2023
perf-debuginfoamzn 20236.1.10-15.42.amzn2023
python3-perfamzn 20236.1.10-15.42.amzn2023
python3-perf-debuginfoamzn 20236.1.10-15.42.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2022-0847 kernel-doc: kernel: improper initialization of the "flags" member of the new pipe_buffer8.8 0.9280 KEVExploited
Patch now CVE-2022-0185 bpftool: vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040585 2040586]8.4 0.2515 KEVExploited
Patch now CVE-2022-2586 bpftool: netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Florian Westphal) [2116356]7.8 0.1020 KEVExploited
Patch now CVE-2022-0492 kernel: kernel: cgroups v1 release_agent feature may allow privilege escalation8.8 0.0553 KEVExploited
High CVE-2022-36946 bpftool: netfilter: nf_queue: do not allow packet truncation below transport header offset (Florian Westphal) [2116159]7.8 0.0887 None reported
High CVE-2022-4379 bpftool: NFSD: fix use-after-free in __nfs42_ssc_open() (Benjamin Coddington) [2152815 2152816]7.8 0.0689 None reported
High CVE-2022-2588 bpftool: net_sched: cls_route: remove from list when handle is 0 (Felix Maurer) [2121817 2116328]7.8 0.0587 None reported
High CVE-2022-43945 bpftool: NFSD: Protect against send buffer overflow in NFSv3 READ (Scott Mayhew) [2143172 2141774]7.8 0.0546 None reported
High CVE-2022-34918 kernel-uek-debug-modules-extra: ELSA-2022-9827: Unbreakable Enterprise kernel security update (IMPORTANT)7.8 0.0545 None reported
High CVE-2022-0742 linux: Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-...7.5 0.0504 None reported
High CVE-2022-29901 bpftool: x86: Disable RET on kexec (Konrad Rzeszutek Wilk) [Orabug: 34335631] {CVE-2022-23816}7.8 0.0501 None reported
High CVE-2022-29900 AMD: CVE-2022-29900 AMD CPU Branch Type Confusion7.8 0.0394 Exploitation Less Likely
High CVE-2022-32250 kernel-cross-headers: netfilter: nf_tables: disallow non-stateful expression in sets earlier (Phil Sutter) [2092986 2092987]7.8 0.0291 None reported
High CVE-2022-25636 kernel-uek: netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso) [Orabug: 33900416]7.8 0.0263 None reported
High CVE-2022-1199 linux: A flaw was found in the Linux kernel7.5 0.0217 None reported
High CVE-2022-27223 linux: In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and mi...8.8 0.0213 None reported
High CVE-2022-23222 kernel-zfcpdump-devel: RHSA-2024:3138: kernel security, bug fix, and enhancement update (Moderate)8.0 0.0203 None reported
High CVE-2023-0179 bpftool: netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (Pablo Neira Ayuso) [Orabug: 34978152]7.8 0.0194 None reported
High CVE-2022-2602 kernel-uek: io_uring/af_unix: defer registered files gc to io_uring release (Pavel Begunkov) [Orabug: 34743499]7.0 0.0143 None reported
High CVE-2022-2585 kernel-uek-debug-modules-extra: posix-cpu-timers: Cleanup CPU timers before freeing them during exec (Thadeu Lima de Souza Cascardo) [Orabug: 34495548]7.8 0.0128 None reported
High CVE-2022-3623 kernel-debug-modules-core: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry7.5 0.0110 None reported
High CVE-2022-2078 bpftool: ELSA-2022-7683: kernel security, bug fix, and enhancement update (MODERATE)7.8 0.0105 None reported
High CVE-2022-32981 linux: An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms7.8 0.0097 None reported
High CVE-2022-3534 libbpf: A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.18.0 0.0096 None reported
High CVE-2022-29581 bpftool: ELSA-2022-7683: kernel security, bug fix, and enhancement update (MODERATE)7.8 0.0093 None reported
Showing 1 to 25 of 111 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.