Important: kernel

Issue Overview:

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161151868References: N/A (cve-2020-0423)

A flaw was found in the way the Linux kernel’s Bluetooth implementation handled L2CAP (Logical Link Control and Adaptation Protocol) packets with A2MP (Alternate MAC-PHY Manager Protocol) CID (Channel Identifier). This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-12351)

An information leak flaw was found in the way Linux kernel’s Bluetooth stack implementation handled initialization of stack memory when handling certain AMP (Alternate MAC-PHY Manager Protocol) packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-12352)

A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-24490)

A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25211)

Affected Packages:

kernel

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update kernel to update your system.

New Packages:

aarch64:  
    kernel-4.14.203-156.332.amzn2.aarch64  
    kernel-headers-4.14.203-156.332.amzn2.aarch64  
    kernel-debuginfo-common-aarch64-4.14.203-156.332.amzn2.aarch64  
    perf-4.14.203-156.332.amzn2.aarch64  
    perf-debuginfo-4.14.203-156.332.amzn2.aarch64  
    python-perf-4.14.203-156.332.amzn2.aarch64  
    python-perf-debuginfo-4.14.203-156.332.amzn2.aarch64  
    kernel-tools-4.14.203-156.332.amzn2.aarch64  
    kernel-tools-devel-4.14.203-156.332.amzn2.aarch64  
    kernel-tools-debuginfo-4.14.203-156.332.amzn2.aarch64  
    kernel-devel-4.14.203-156.332.amzn2.aarch64  
    kernel-debuginfo-4.14.203-156.332.amzn2.aarch64  
  
i686:  
    kernel-headers-4.14.203-156.332.amzn2.i686  
  
src:  
    kernel-4.14.203-156.332.amzn2.src  
  
x86_64:  
    kernel-4.14.203-156.332.amzn2.x86_64  
    kernel-headers-4.14.203-156.332.amzn2.x86_64  
    kernel-debuginfo-common-x86_64-4.14.203-156.332.amzn2.x86_64  
    perf-4.14.203-156.332.amzn2.x86_64  
    perf-debuginfo-4.14.203-156.332.amzn2.x86_64  
    python-perf-4.14.203-156.332.amzn2.x86_64  
    python-perf-debuginfo-4.14.203-156.332.amzn2.x86_64  
    kernel-tools-4.14.203-156.332.amzn2.x86_64  
    kernel-tools-devel-4.14.203-156.332.amzn2.x86_64  
    kernel-tools-debuginfo-4.14.203-156.332.amzn2.x86_64  
    kernel-devel-4.14.203-156.332.amzn2.x86_64  
    kernel-debuginfo-4.14.203-156.332.amzn2.x86_64  
    kernel-livepatch-4.14.203-156.332-1.0-0.amzn2.x86_64  

Additional References

Red Hat: CVE-2020-0423, CVE-2020-12351, CVE-2020-12352, CVE-2020-24490, CVE-2020-25211

Mitre: CVE-2020-0423, CVE-2020-12351, CVE-2020-12352, CVE-2020-24490, CVE-2020-25211