Amazon Linux AMI update for glibc

1) Memory corruption

EUVDB-ID: #VU13011

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-11236

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists in the stdlib/canonicalize.c source code in the GNU glibc library due to improper processing of long pathname arguments to the realpath function. A local unauthenticated attacker can send long pathname arguments to a targeted system that is using 32-bit architecture, trigger an integer overflow condition that can lead to stack-based buffer overflow condition and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

i686:
    glibc-2.17-260.175.amzn1.i686
    glibc-common-2.17-260.175.amzn1.i686
    glibc-headers-2.17-260.175.amzn1.i686
    glibc-debuginfo-2.17-260.175.amzn1.i686
    glibc-debuginfo-common-2.17-260.175.amzn1.i686
    glibc-utils-2.17-260.175.amzn1.i686
    glibc-static-2.17-260.175.amzn1.i686
    nscd-2.17-260.175.amzn1.i686
    glibc-devel-2.17-260.175.amzn1.i686

src:
    glibc-2.17-260.175.amzn1.src

x86_64:
    glibc-common-2.17-260.175.amzn1.x86_64
    glibc-debuginfo-common-2.17-260.175.amzn1.x86_64
    glibc-utils-2.17-260.175.amzn1.x86_64
    glibc-2.17-260.175.amzn1.x86_64
    glibc-devel-2.17-260.175.amzn1.x86_64
    nscd-2.17-260.175.amzn1.x86_64
    glibc-static-2.17-260.175.amzn1.x86_64
    glibc-debuginfo-2.17-260.175.amzn1.x86_64
    glibc-headers-2.17-260.175.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

• cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2018-1109.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU11548

Risk: Low

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-6485

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists in the implementation of the posix_memalign in memalign functions due to integer overflow when causing these functions to return a pointer to a heap area that is too small. A remote attacker can trigger memory corruption and gain root privileges.

Mitigation

Update the affected packages.

i686:
    glibc-2.17-260.175.amzn1.i686
    glibc-common-2.17-260.175.amzn1.i686
    glibc-headers-2.17-260.175.amzn1.i686
    glibc-debuginfo-2.17-260.175.amzn1.i686
    glibc-debuginfo-common-2.17-260.175.amzn1.i686
    glibc-utils-2.17-260.175.amzn1.i686
    glibc-static-2.17-260.175.amzn1.i686
    nscd-2.17-260.175.amzn1.i686
    glibc-devel-2.17-260.175.amzn1.i686

src:
    glibc-2.17-260.175.amzn1.src

x86_64:
    glibc-common-2.17-260.175.amzn1.x86_64
    glibc-debuginfo-common-2.17-260.175.amzn1.x86_64
    glibc-utils-2.17-260.175.amzn1.x86_64
    glibc-2.17-260.175.amzn1.x86_64
    glibc-devel-2.17-260.175.amzn1.x86_64
    nscd-2.17-260.175.amzn1.x86_64
    glibc-static-2.17-260.175.amzn1.x86_64
    glibc-debuginfo-2.17-260.175.amzn1.x86_64
    glibc-headers-2.17-260.175.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

• cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2018-1109.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Insecure DLL loading

EUVDB-ID: #VU11547

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-16997

CWE-ID: CWE-427 - Uncontrolled Search Path Element

Exploit availability: No

Description

The vulnerability allows a local attacker to compromise vulnerable system.

The weakness exists in elf/dl-load.c due to insecure .dll loading mechanism when opening files. Alocal attacker can place a file along with specially crafted .dll file on a remote SBM or WebDAV share and execute arbitrary code on the target system with elevated privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

i686:
    glibc-2.17-260.175.amzn1.i686
    glibc-common-2.17-260.175.amzn1.i686
    glibc-headers-2.17-260.175.amzn1.i686
    glibc-debuginfo-2.17-260.175.amzn1.i686
    glibc-debuginfo-common-2.17-260.175.amzn1.i686
    glibc-utils-2.17-260.175.amzn1.i686
    glibc-static-2.17-260.175.amzn1.i686
    nscd-2.17-260.175.amzn1.i686
    glibc-devel-2.17-260.175.amzn1.i686

src:
    glibc-2.17-260.175.amzn1.src

x86_64:
    glibc-common-2.17-260.175.amzn1.x86_64
    glibc-debuginfo-common-2.17-260.175.amzn1.x86_64
    glibc-utils-2.17-260.175.amzn1.x86_64
    glibc-2.17-260.175.amzn1.x86_64
    glibc-devel-2.17-260.175.amzn1.x86_64
    nscd-2.17-260.175.amzn1.x86_64
    glibc-static-2.17-260.175.amzn1.x86_64
    glibc-debuginfo-2.17-260.175.amzn1.x86_64
    glibc-headers-2.17-260.175.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

• cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2018-1109.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU13200

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-11237

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to an AVX-512-optimized implementation of the mempcpy function may write data beyond the target buffer. A local attacker can trigger buffer overflow in __mempcpy_avx512_no_vzeroupper and execute arbitrary code with elevated privileges.

Mitigation

Update the affected packages.

i686:
    glibc-2.17-260.175.amzn1.i686
    glibc-common-2.17-260.175.amzn1.i686
    glibc-headers-2.17-260.175.amzn1.i686
    glibc-debuginfo-2.17-260.175.amzn1.i686
    glibc-debuginfo-common-2.17-260.175.amzn1.i686
    glibc-utils-2.17-260.175.amzn1.i686
    glibc-static-2.17-260.175.amzn1.i686
    nscd-2.17-260.175.amzn1.i686
    glibc-devel-2.17-260.175.amzn1.i686

src:
    glibc-2.17-260.175.amzn1.src

x86_64:
    glibc-common-2.17-260.175.amzn1.x86_64
    glibc-debuginfo-common-2.17-260.175.amzn1.x86_64
    glibc-utils-2.17-260.175.amzn1.x86_64
    glibc-2.17-260.175.amzn1.x86_64
    glibc-devel-2.17-260.175.amzn1.x86_64
    nscd-2.17-260.175.amzn1.x86_64
    glibc-static-2.17-260.175.amzn1.x86_64
    glibc-debuginfo-2.17-260.175.amzn1.x86_64
    glibc-headers-2.17-260.175.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

• cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2018-1109.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.