Amazon Linux AMI update for kernel

Published: 2018-10-05 | Updated: 2018-10-23

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2018-16658 CVE-2018-14633 CVE-2018-17182
CWE-ID	CWE-125 CWE-121 CWE-416
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Buffer over-read

EUVDB-ID: #VU15486

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-16658

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in cdrom_ioctl_drive_status() function in drivers/cdrom/cdrom.c. A local unprivileged user can create a specially crafted application, trigger out-of-bounds read error and read contents of kernel memory.

Mitigation

Update the affected packages.

i686:
    kernel-debuginfo-common-i686-4.14.72-68.55.amzn1.i686
    kernel-headers-4.14.72-68.55.amzn1.i686
    kernel-tools-devel-4.14.72-68.55.amzn1.i686
    kernel-4.14.72-68.55.amzn1.i686
    kernel-tools-4.14.72-68.55.amzn1.i686
    perf-4.14.72-68.55.amzn1.i686
    kernel-debuginfo-4.14.72-68.55.amzn1.i686
    kernel-tools-debuginfo-4.14.72-68.55.amzn1.i686
    kernel-devel-4.14.72-68.55.amzn1.i686
    perf-debuginfo-4.14.72-68.55.amzn1.i686

src:
    kernel-4.14.72-68.55.amzn1.src

x86_64:
    kernel-debuginfo-4.14.72-68.55.amzn1.x86_64
    perf-debuginfo-4.14.72-68.55.amzn1.x86_64
    perf-4.14.72-68.55.amzn1.x86_64
    kernel-devel-4.14.72-68.55.amzn1.x86_64
    kernel-tools-debuginfo-4.14.72-68.55.amzn1.x86_64
    kernel-tools-4.14.72-68.55.amzn1.x86_64
    kernel-headers-4.14.72-68.55.amzn1.x86_64
    kernel-4.14.72-68.55.amzn1.x86_64
    kernel-tools-devel-4.14.72-68.55.amzn1.x86_64
    kernel-debuginfo-common-x86_64-4.14.72-68.55.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2018-1086.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU14920

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14633

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing client digest packets in chap_server_compute_md5() function when processing authentication request from an ISCSI initiator. A remote attacker can send an overly long value (longer than 32 bytes), trigger stack-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update the affected packages.

i686:
    kernel-debuginfo-common-i686-4.14.72-68.55.amzn1.i686
    kernel-headers-4.14.72-68.55.amzn1.i686
    kernel-tools-devel-4.14.72-68.55.amzn1.i686
    kernel-4.14.72-68.55.amzn1.i686
    kernel-tools-4.14.72-68.55.amzn1.i686
    perf-4.14.72-68.55.amzn1.i686
    kernel-debuginfo-4.14.72-68.55.amzn1.i686
    kernel-tools-debuginfo-4.14.72-68.55.amzn1.i686
    kernel-devel-4.14.72-68.55.amzn1.i686
    perf-debuginfo-4.14.72-68.55.amzn1.i686

src:
    kernel-4.14.72-68.55.amzn1.src

x86_64:
    kernel-debuginfo-4.14.72-68.55.amzn1.x86_64
    perf-debuginfo-4.14.72-68.55.amzn1.x86_64
    perf-4.14.72-68.55.amzn1.x86_64
    kernel-devel-4.14.72-68.55.amzn1.x86_64
    kernel-tools-debuginfo-4.14.72-68.55.amzn1.x86_64
    kernel-tools-4.14.72-68.55.amzn1.x86_64
    kernel-headers-4.14.72-68.55.amzn1.x86_64
    kernel-4.14.72-68.55.amzn1.x86_64
    kernel-tools-devel-4.14.72-68.55.amzn1.x86_64
    kernel-debuginfo-common-x86_64-4.14.72-68.55.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2018-1086.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU14817

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-17182

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in vmacache_flush_all() function in mm/vmacache.c file. A local user can trigger the use-after-free error via certain thread creation, map, unmap, invalidation, and dereference operations and execute arbitrary code on the system with elevated privileges.

Mitigation

Update the affected packages.

i686:
    kernel-debuginfo-common-i686-4.14.72-68.55.amzn1.i686
    kernel-headers-4.14.72-68.55.amzn1.i686
    kernel-tools-devel-4.14.72-68.55.amzn1.i686
    kernel-4.14.72-68.55.amzn1.i686
    kernel-tools-4.14.72-68.55.amzn1.i686
    perf-4.14.72-68.55.amzn1.i686
    kernel-debuginfo-4.14.72-68.55.amzn1.i686
    kernel-tools-debuginfo-4.14.72-68.55.amzn1.i686
    kernel-devel-4.14.72-68.55.amzn1.i686
    perf-debuginfo-4.14.72-68.55.amzn1.i686

src:
    kernel-4.14.72-68.55.amzn1.src

x86_64:
    kernel-debuginfo-4.14.72-68.55.amzn1.x86_64
    perf-debuginfo-4.14.72-68.55.amzn1.x86_64
    perf-4.14.72-68.55.amzn1.x86_64
    kernel-devel-4.14.72-68.55.amzn1.x86_64
    kernel-tools-debuginfo-4.14.72-68.55.amzn1.x86_64
    kernel-tools-4.14.72-68.55.amzn1.x86_64
    kernel-headers-4.14.72-68.55.amzn1.x86_64
    kernel-4.14.72-68.55.amzn1.x86_64
    kernel-tools-devel-4.14.72-68.55.amzn1.x86_64
    kernel-debuginfo-common-x86_64-4.14.72-68.55.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2018-1086.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.