Amazon Linux AMI update for glib2

Published: 2023-05-04

Risk	Medium
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2018-16428 CVE-2018-16429 CVE-2019-12450 CVE-2019-13012 CVE-2021-28153 CVE-2021-3800 CVE-2023-24593 CVE-2023-25180
CWE-ID	CWE-476 CWE-125 CWE-264 CWE-276 CWE-61 CWE-200 CWE-20
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	Amazon Linux AMI Operating systems & Components / Operating system glib2 Operating systems & Components / Operating system package or component
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU16354

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-16428

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in g_markup_parse_context_end_parse() in gmarkup.c. A local attacker can execute a specially crafted application or file that submits malicious input and cause the service to crash.

Mitigation

Update the affected packages:

i686:
    glib2-fam-2.36.3-5.23.amzn1.i686
    glib2-2.36.3-5.23.amzn1.i686
    glib2-debuginfo-2.36.3-5.23.amzn1.i686
    glib2-devel-2.36.3-5.23.amzn1.i686

noarch:
    glib2-doc-2.36.3-5.23.amzn1.noarch

src:
    glib2-2.36.3-5.23.amzn1.src

x86_64:
    glib2-debuginfo-2.36.3-5.23.amzn1.x86_64
    glib2-fam-2.36.3-5.23.amzn1.x86_64
    glib2-2.36.3-5.23.amzn1.x86_64
    glib2-devel-2.36.3-5.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

glib2: before 2.36.3-5.23

External links

http://alas.aws.amazon.com/ALAS-2023-1742.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Out-of-bounds read

EUVDB-ID: #VU14608

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-16429

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str(). A local attacker can execute a specially crafted application or file that submits malicious input and cause the service to crash.

Mitigation

Update the affected packages:

i686:
    glib2-fam-2.36.3-5.23.amzn1.i686
    glib2-2.36.3-5.23.amzn1.i686
    glib2-debuginfo-2.36.3-5.23.amzn1.i686
    glib2-devel-2.36.3-5.23.amzn1.i686

noarch:
    glib2-doc-2.36.3-5.23.amzn1.noarch

src:
    glib2-2.36.3-5.23.amzn1.src

x86_64:
    glib2-debuginfo-2.36.3-5.23.amzn1.x86_64
    glib2-fam-2.36.3-5.23.amzn1.x86_64
    glib2-2.36.3-5.23.amzn1.x86_64
    glib2-devel-2.36.3-5.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

glib2: before 2.36.3-5.23

External links

http://alas.aws.amazon.com/ALAS-2023-1742.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18658

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12450

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the application applies default directory permissions to files while copying them in file_copy_fallback() function in gio/gfile.c. A local user can interfere with the copying operation and gain access to otherwise restricted files, as the application applies correct access permissions after the file was copied only.

Such application behavior allows a local user to access potentially sensitive data or modify file contents in case directory permissions that were applied to the file allow such operations.

Mitigation

Update the affected packages:

i686:
    glib2-fam-2.36.3-5.23.amzn1.i686
    glib2-2.36.3-5.23.amzn1.i686
    glib2-debuginfo-2.36.3-5.23.amzn1.i686
    glib2-devel-2.36.3-5.23.amzn1.i686

noarch:
    glib2-doc-2.36.3-5.23.amzn1.noarch

src:
    glib2-2.36.3-5.23.amzn1.src

x86_64:
    glib2-debuginfo-2.36.3-5.23.amzn1.x86_64
    glib2-fam-2.36.3-5.23.amzn1.x86_64
    glib2-2.36.3-5.23.amzn1.x86_64
    glib2-devel-2.36.3-5.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

glib2: before 2.36.3-5.23

External links

http://alas.aws.amazon.com/ALAS-2023-1742.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Incorrect default permissions

EUVDB-ID: #VU18944

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13012

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

Mitigation

Update the affected packages:

i686:
    glib2-fam-2.36.3-5.23.amzn1.i686
    glib2-2.36.3-5.23.amzn1.i686
    glib2-debuginfo-2.36.3-5.23.amzn1.i686
    glib2-devel-2.36.3-5.23.amzn1.i686

noarch:
    glib2-doc-2.36.3-5.23.amzn1.noarch

src:
    glib2-2.36.3-5.23.amzn1.src

x86_64:
    glib2-debuginfo-2.36.3-5.23.amzn1.x86_64
    glib2-fam-2.36.3-5.23.amzn1.x86_64
    glib2-2.36.3-5.23.amzn1.x86_64
    glib2-devel-2.36.3-5.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

glib2: before 2.36.3-5.23

External links

http://alas.aws.amazon.com/ALAS-2023-1742.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) UNIX symbolic link following

EUVDB-ID: #VU51454

Risk: Low

CVSSv3.1: 2.2 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28153

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue, when g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

Successful exploitation of this vulnerability may result in privilege escalation.

Mitigation

Update the affected packages:

i686:
    glib2-fam-2.36.3-5.23.amzn1.i686
    glib2-2.36.3-5.23.amzn1.i686
    glib2-debuginfo-2.36.3-5.23.amzn1.i686
    glib2-devel-2.36.3-5.23.amzn1.i686

noarch:
    glib2-doc-2.36.3-5.23.amzn1.noarch

src:
    glib2-2.36.3-5.23.amzn1.src

x86_64:
    glib2-debuginfo-2.36.3-5.23.amzn1.x86_64
    glib2-fam-2.36.3-5.23.amzn1.x86_64
    glib2-2.36.3-5.23.amzn1.x86_64
    glib2-devel-2.36.3-5.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

glib2: before 2.36.3-5.23

External links

http://alas.aws.amazon.com/ALAS-2023-1742.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Information disclosure

EUVDB-ID: #VU65849

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3800

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can trick the victim into opening a specially crafted file to gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected packages:

i686:
    glib2-fam-2.36.3-5.23.amzn1.i686
    glib2-2.36.3-5.23.amzn1.i686
    glib2-debuginfo-2.36.3-5.23.amzn1.i686
    glib2-devel-2.36.3-5.23.amzn1.i686

noarch:
    glib2-doc-2.36.3-5.23.amzn1.noarch

src:
    glib2-2.36.3-5.23.amzn1.src

x86_64:
    glib2-debuginfo-2.36.3-5.23.amzn1.x86_64
    glib2-fam-2.36.3-5.23.amzn1.x86_64
    glib2-2.36.3-5.23.amzn1.x86_64
    glib2-devel-2.36.3-5.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

glib2: before 2.36.3-5.23

External links

http://alas.aws.amazon.com/ALAS-2023-1742.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU75361

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-24593

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling a text-form variant. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    glib2-fam-2.36.3-5.23.amzn1.i686
    glib2-2.36.3-5.23.amzn1.i686
    glib2-debuginfo-2.36.3-5.23.amzn1.i686
    glib2-devel-2.36.3-5.23.amzn1.i686

noarch:
    glib2-doc-2.36.3-5.23.amzn1.noarch

src:
    glib2-2.36.3-5.23.amzn1.src

x86_64:
    glib2-debuginfo-2.36.3-5.23.amzn1.x86_64
    glib2-fam-2.36.3-5.23.amzn1.x86_64
    glib2-2.36.3-5.23.amzn1.x86_64
    glib2-devel-2.36.3-5.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

glib2: before 2.36.3-5.23

External links

http://alas.aws.amazon.com/ALAS-2023-1742.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU75362

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-25180

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling a serialised variant. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    glib2-fam-2.36.3-5.23.amzn1.i686
    glib2-2.36.3-5.23.amzn1.i686
    glib2-debuginfo-2.36.3-5.23.amzn1.i686
    glib2-devel-2.36.3-5.23.amzn1.i686

noarch:
    glib2-doc-2.36.3-5.23.amzn1.noarch

src:
    glib2-2.36.3-5.23.amzn1.src

x86_64:
    glib2-debuginfo-2.36.3-5.23.amzn1.x86_64
    glib2-fam-2.36.3-5.23.amzn1.x86_64
    glib2-2.36.3-5.23.amzn1.x86_64
    glib2-devel-2.36.3-5.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

glib2: before 2.36.3-5.23

External links

http://alas.aws.amazon.com/ALAS-2023-1742.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.