SB2022020864 - Amazon Linux AMI update for kernel
Published: February 8, 2022 Updated: December 13, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Use of insufficiently random values (CVE-ID: CVE-2021-20322)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error when processing received ICMP errors. A remote attacker can effectively bypass the source port UDP randomization to gain access to sensitive information.
2) Resource exhaustion (CVE-ID: CVE-2021-28711)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Resource exhaustion (CVE-ID: CVE-2021-28712)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
4) Resource exhaustion (CVE-ID: CVE-2021-28713)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Improper Resource Shutdown or Release (CVE-ID: CVE-2021-28714)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. A remote user can use a UDP connection on a fast interface to trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Improper Resource Shutdown or Release (CVE-ID: CVE-2021-28715)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. A remote user can use a UDP connection on a fast interface to trigger resource exhaustion and perform a denial of service (DoS) attack.
7) Insufficient verification of data authenticity (CVE-ID: CVE-2021-3772)
The vulnerability allows a remote attacker to perform a denial of service attack (DoS) on the target system.The vulnerability exists due to insufficient verification of data authenticity in the Linux SCTP stack. A remote attacker can exploit this vulnerability to perform a denial of service attack.
8) Memory leak (CVE-ID: CVE-2021-4002)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due memory leak in the Linux kernel's hugetlbfs memory usage. A local user can force the application to leak memory and gain access to sensitive information.
9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-4155)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to the OS kernel does not impose correctly security restrictions. A local user can gain access to sensitive information on the system.
10) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-0492)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a logic error within the cgroup_release_agent_write() function in kernel/cgroup/cgroup-v1.c. A local user can use the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation.
Remediation
Install update from vendor's website.