SB2023120461 - Amazon Linux AMI update for kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023120461

SB2023120461 - Amazon Linux AMI update for kernel

Published: December 4, 2023

Security Bulletin ID SB2023120461
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Race condition (CVE-ID: CVE-2023-3397)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition between the lmLogClose() and txEnd() function in JFS. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.


2) Deadlock (CVE-ID: CVE-2023-34324)

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to improper event handling in Linux kernel. A malicious guest can disable paravirtualized device to cause a deadlock in a backend domain (other than dom0).


3) Out-of-bounds write (CVE-ID: CVE-2023-5717)

The vulnerability local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in the Linux kernel's Linux Kernel Performance Events (perf) component. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.


Remediation

Install update from vendor's website.

References