Linux · Amazon Linux · Security advisory · February 29, 2024

ALAS2023-2024-549: Security update for 21 packages

ALAS2023-2024-549, released February 29, 2024, fixes 38 CVEs across 21 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
38
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.4
Base score, 0 to 10
Highest EPSS
0.0222
82nd percentile

Priority of the 38 CVEs

Patch now 0 Urgent 1 High 11 Routine 26

Fixed package versions

ProductReleaseFixed in
bpftoolamzn 20236.1.79-99.164.amzn2023
bpftool-debuginfoamzn 20236.1.79-99.164.amzn2023
kernelamzn 20236.1.79-99.164.amzn2023
kernel-debuginfoamzn 20236.1.79-99.164.amzn2023
kernel-debuginfo-common-aarch64amzn 20236.1.79-99.164.amzn2023
kernel-debuginfo-common-x86_64amzn 20236.1.79-99.164.amzn2023
kernel-develamzn 20236.1.79-99.164.amzn2023
kernel-headersamzn 20236.1.79-99.164.amzn2023
kernel-libbpfamzn 20236.1.79-99.164.amzn2023
kernel-libbpf-develamzn 20236.1.79-99.164.amzn2023
kernel-libbpf-staticamzn 20236.1.79-99.164.amzn2023
kernel-livepatch-6.1.79-99.164amzn 20231.0-0.amzn2023
kernel-modules-extraamzn 20236.1.79-99.164.amzn2023
kernel-modules-extra-commonamzn 20236.1.79-99.164.amzn2023
kernel-toolsamzn 20236.1.79-99.164.amzn2023
kernel-tools-debuginfoamzn 20236.1.79-99.164.amzn2023
kernel-tools-develamzn 20236.1.79-99.164.amzn2023
perfamzn 20236.1.79-99.164.amzn2023
perf-debuginfoamzn 20236.1.79-99.164.amzn2023
python3-perfamzn 20236.1.79-99.164.amzn2023
python3-perf-debuginfoamzn 20236.1.79-99.164.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2024-26828 linux: In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces()...9.4 0.0075 None reported
High CVE-2024-26581 kernel-64k-modules-core: kernel: nftables: nft_set_rbtree skip end interval element from gc7.8 0.0222 None reported
High CVE-2023-52434 dtb-aarch64: Fixed potential OOBs in smb2_parse_contexts() (bsc#1220148).8.0 0.0102 None reported
High CVE-2024-26582 bpftool: net: tls: fix use-after-free with partial reads and async decrypt (Sabrina Dubroca) [RHEL-26398 RHEL-26401]7.8 0.0072 None reported
High CVE-2024-26689 linux: In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg()...7.8 0.0070 None reported
High CVE-2024-26665 dtb-aarch64: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).7.8 0.0068 None reported
High CVE-2024-26826 kernel-zfcpdump-modules-extra: kernel: mptcp: fix data re-injection from stale subflow7.0 0.0065 None reported
High CVE-2024-26583 bpftool: tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26584 CVE-2024-26585}7.0 0.0055 None reported
High CVE-2024-26602 bpftool: sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430]8.0 0.0032 None reported
High CVE-2024-0841 bpftool: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614]8.0 0.0030 None reported
High CVE-2024-26704 dtb-aarch64: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).7.8 0.0027 None reported
High CVE-2024-26720 linux: In the Linux kernel, the following vulnerability has been resolved: mm/writeback: fix possible divide-by-zero in wb_...7.8 n/a None reported
Routine CVE-2024-2193 xen: A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative executi...5.7 0.0128 None reported
Routine CVE-2024-23850 linux: In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and...5.5 0.0031 None reported
Routine CVE-2024-23851 linux: copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX byte...5.5 0.0030 None reported
Routine CVE-2024-26601 kernel-syms: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).5.5 0.0029 None reported
Routine CVE-2024-26603 bpftool: x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669]5.5 0.0028 None reported
Routine CVE-2024-1151 Kernel: stack overflow problem in open vswitch kernel module leading to dos5.5 0.0027 None reported
Routine CVE-2024-26726 kernel-source-azure: Do not drop extent_map for free space inode on write error (bsc#1222532)5.5 0.0026 None reported
Routine CVE-2024-26920 dtb-aarch64: Security update for the Linux Kernel5.5 0.0026 None reported
Routine CVE-2023-52429 linux: dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate...5.5 0.0025 None reported
Routine CVE-2024-26688 linux: In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in huge...5.5 0.0025 None reported
Routine CVE-2023-52616 dtb-aarch64: Security update for the Linux Kernel5.5 0.0024 None reported
Routine CVE-2024-26820 linux: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DE...5.5 0.0024 None reported
Routine CVE-2024-0340 kernel: vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505]5.5 0.0024 None reported
Showing 1 to 25 of 38 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.