SB20240806189 - Amazon Linux AMI update for kernel

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2023-52620)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions within the nf_tables_newset() function in net/netfilter/nf_tables_api.c when setting timeouts from userspace. A local user can bypass implemented security restrictions and perform a denial of service attack.

2) Resource exhaustion (CVE-ID: CVE-2024-26621)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to system forces huge page alignment on 32-bit systems in mm/huge_memory.c. A local user can perform a denial of service (DoS) attack.

3) Double free (CVE-ID: CVE-2024-26782)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the mptcp_inet6_sk() and mptcp_sk_clone() functions in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.

4) Information disclosure (CVE-ID: CVE-2024-27417)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the inet6_rtm_getaddr() function in net/ipv6/addrconf.c. A local user can gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://alas.aws.amazon.com/AL2023/ALAS-2024-603.html