Important: kernel

Issue Overview:

2024-02-01: CVE-2023-0047 was added to this advisory.

2023-10-12: CVE-2021-3923 was added to this advisory.

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. (CVE-2021-20322)

A denial of service flaw for virtual machine guests in the Linux kernel’s Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.
A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711)

A denial of service flaw for virtual machine guests in the Linux kernel’s Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.
A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712)

A denial of service flaw for virtual machine guests in the Linux kernel’s Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.
A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713)

Incoming data packets for a guest in the Linux kernel’s netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

Incoming data packets for a guest in the Linux kernel’s netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715)

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

A flaw was found in the Linux kernel’s implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

A memory leak flaw in the Linux kernel’s hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. (CVE-2021-4155)

A Linux Kernel flaw found in memory management. If allocation failure happens in pagefault_out_of_memory with VM_FAULT_OOM, then it can lead to memory overflow when many tasks trigger this. An issue may cause multi-tenant denial of service (memory overflow). It was reported that a malicious workload may be allowed to OOM-kill random other workloads on the same node. (CVE-2023-0047)

Affected Packages:

kernel

Issue Correction:
Run yum update kernel to update your system.

New Packages:

i686:  
    kernel-tools-debuginfo-4.14.262-135.486.amzn1.i686  
    perf-debuginfo-4.14.262-135.486.amzn1.i686  
    kernel-headers-4.14.262-135.486.amzn1.i686  
    kernel-4.14.262-135.486.amzn1.i686  
    kernel-debuginfo-common-i686-4.14.262-135.486.amzn1.i686  
    kernel-devel-4.14.262-135.486.amzn1.i686  
    kernel-tools-devel-4.14.262-135.486.amzn1.i686  
    kernel-debuginfo-4.14.262-135.486.amzn1.i686  
    perf-4.14.262-135.486.amzn1.i686  
    kernel-tools-4.14.262-135.486.amzn1.i686  
  
src:  
    kernel-4.14.262-135.486.amzn1.src  
  
x86_64:  
    kernel-debuginfo-4.14.262-135.486.amzn1.x86_64  
    kernel-debuginfo-common-x86_64-4.14.262-135.486.amzn1.x86_64  
    perf-debuginfo-4.14.262-135.486.amzn1.x86_64  
    kernel-4.14.262-135.486.amzn1.x86_64  
    kernel-tools-4.14.262-135.486.amzn1.x86_64  
    kernel-headers-4.14.262-135.486.amzn1.x86_64  
    kernel-tools-devel-4.14.262-135.486.amzn1.x86_64  
    perf-4.14.262-135.486.amzn1.x86_64  
    kernel-tools-debuginfo-4.14.262-135.486.amzn1.x86_64  
    kernel-devel-4.14.262-135.486.amzn1.x86_64  

Additional References

Red Hat: CVE-2021-20322, CVE-2021-28711, CVE-2021-28712, CVE-2021-28713, CVE-2021-28714, CVE-2021-28715, CVE-2021-3772, CVE-2021-3923, CVE-2021-4002, CVE-2021-4155, CVE-2023-0047

Mitre: CVE-2021-20322, CVE-2021-28711, CVE-2021-28712, CVE-2021-28713, CVE-2021-28714, CVE-2021-28715, CVE-2021-3772, CVE-2021-3923, CVE-2021-4002, CVE-2021-4155, CVE-2023-0047