Linux · 
Amazon Linux · Security advisory · January 30, 2025
Amazon Linux · Security advisory · January 30, 2025ALAS2023-2025-836: Security update for 21 packages
ALAS2023-2025-836, released January 30, 2025, fixes 38 CVEs across 21 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
38
None rated Critical
Exploited
0
None reported
Highest CVSS
7.8
Base score, 0 to 10
Highest EPSS
0.0073
54th percentile
Priority of the 38 CVEs
Patch now 0
Urgent 0
High 21
Routine 17
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool | amzn 2023 | 6.1.96-102.177.amzn2023 |
| bpftool-debuginfo | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-debuginfo | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-debuginfo-common-aarch64 | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-debuginfo-common-x86_64 | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-devel | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-headers | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-libbpf | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-libbpf-devel | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-libbpf-static | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-livepatch-6.1.96-102.177 | amzn 2023 | 1.0-0.amzn2023 |
| kernel-modules-extra | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-modules-extra-common | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-tools | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-tools-debuginfo | amzn 2023 | 6.1.96-102.177.amzn2023 |
| kernel-tools-devel | amzn 2023 | 6.1.96-102.177.amzn2023 |
| perf | amzn 2023 | 6.1.96-102.177.amzn2023 |
| perf-debuginfo | amzn 2023 | 6.1.96-102.177.amzn2023 |
| python3-perf | amzn 2023 | 6.1.96-102.177.amzn2023 |
| python3-perf-debuginfo | amzn 2023 | 6.1.96-102.177.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2024-40920 | kernel-default-base: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781). | 7.8 | 0.0041 | None reported |
| High | CVE-2024-40901 | dtb-aarch64: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762). | 7.8 | 0.0031 | None reported |
| High | CVE-2024-40989 | KVM: arm64: Disassociate vcpus from redistributor region on teardown | 7.8 | 0.0030 | None reported |
| High | CVE-2024-41000 | dtb-aarch64: block/ioctl: prefer different overflow check (bsc#1227867). | 7.8 | 0.0030 | None reported |
| High | CVE-2024-39499 | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0030 | None reported |
| High | CVE-2024-40927 | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0029 | None reported |
| High | CVE-2024-40904 | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0029 | None reported |
| High | CVE-2024-39496 | dtb-aarch64: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719). | 7.8 | 0.0029 | None reported |
| High | CVE-2024-40913 | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0029 | None reported |
| High | CVE-2024-40995 | dtb-aarch64: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830). | 7.8 | 0.0029 | None reported |
| High | CVE-2024-40900 | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0028 | None reported |
| High | CVE-2024-36978 | kernel-devel: Important: kernel security update | 7.8 | 0.0028 | None reported |
| High | CVE-2024-40996 | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskb_pull_reason syzkaller... | 7.8 | 0.0028 | None reported |
| High | CVE-2024-40959 | dtb-aarch64: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884). | 7.8 | 0.0028 | None reported |
| High | CVE-2024-40960 | dtb-aarch64: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813). | 7.8 | 0.0027 | None reported |
| High | CVE-2024-40958 | kernel-default-base: netns: Make get_net_ns() handle zero refcount net (bsc#1227812). | 7.8 | 0.0027 | None reported |
| High | CVE-2024-40935 | dtb-aarch64: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797). | 7.8 | 0.0026 | None reported |
| High | CVE-2024-40954 | dtb-aarch64: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808) | 7.8 | 0.0026 | None reported |
| High | CVE-2024-40931 | dtb-aarch64: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780). | 7.8 | 0.0025 | None reported |
| High | CVE-2024-38619 | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0025 | None reported |
| High | CVE-2024-39503 | bpftool: kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type | 7.0 | 0.0022 | None reported |
| Routine | CVE-2024-40957 | kernel-64kb: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (bsc#1227811). | 5.5 | 0.0073 | None reported |
| Routine | CVE-2024-39509 | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0030 | None reported |
| Routine | CVE-2024-40924 | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0030 | None reported |
| Routine | CVE-2024-40984 | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0030 | None reported |
Showing 1 to 25 of 38
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.