Medium: util-linux

Issue Overview:

A flaw was found in the Linux kernel’s util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an “INPUTRC” environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. (CVE-2022-0563)

Affected Packages:

util-linux

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update util-linux to update your system.

New Packages:

aarch64:  
    util-linux-2.30.2-2.amzn2.0.10.aarch64  
    libfdisk-2.30.2-2.amzn2.0.10.aarch64  
    libfdisk-devel-2.30.2-2.amzn2.0.10.aarch64  
    libsmartcols-2.30.2-2.amzn2.0.10.aarch64  
    libsmartcols-devel-2.30.2-2.amzn2.0.10.aarch64  
    libmount-2.30.2-2.amzn2.0.10.aarch64  
    libmount-devel-2.30.2-2.amzn2.0.10.aarch64  
    libblkid-2.30.2-2.amzn2.0.10.aarch64  
    libblkid-devel-2.30.2-2.amzn2.0.10.aarch64  
    libuuid-2.30.2-2.amzn2.0.10.aarch64  
    libuuid-devel-2.30.2-2.amzn2.0.10.aarch64  
    uuidd-2.30.2-2.amzn2.0.10.aarch64  
    python-libmount-2.30.2-2.amzn2.0.10.aarch64  
    util-linux-user-2.30.2-2.amzn2.0.10.aarch64  
    util-linux-debuginfo-2.30.2-2.amzn2.0.10.aarch64  
  
i686:  
    util-linux-2.30.2-2.amzn2.0.10.i686  
    libfdisk-2.30.2-2.amzn2.0.10.i686  
    libfdisk-devel-2.30.2-2.amzn2.0.10.i686  
    libsmartcols-2.30.2-2.amzn2.0.10.i686  
    libsmartcols-devel-2.30.2-2.amzn2.0.10.i686  
    libmount-2.30.2-2.amzn2.0.10.i686  
    libmount-devel-2.30.2-2.amzn2.0.10.i686  
    libblkid-2.30.2-2.amzn2.0.10.i686  
    libblkid-devel-2.30.2-2.amzn2.0.10.i686  
    libuuid-2.30.2-2.amzn2.0.10.i686  
    libuuid-devel-2.30.2-2.amzn2.0.10.i686  
    uuidd-2.30.2-2.amzn2.0.10.i686  
    python-libmount-2.30.2-2.amzn2.0.10.i686  
    util-linux-user-2.30.2-2.amzn2.0.10.i686  
    util-linux-debuginfo-2.30.2-2.amzn2.0.10.i686  
  
src:  
    util-linux-2.30.2-2.amzn2.0.10.src  
  
x86_64:  
    util-linux-2.30.2-2.amzn2.0.10.x86_64  
    libfdisk-2.30.2-2.amzn2.0.10.x86_64  
    libfdisk-devel-2.30.2-2.amzn2.0.10.x86_64  
    libsmartcols-2.30.2-2.amzn2.0.10.x86_64  
    libsmartcols-devel-2.30.2-2.amzn2.0.10.x86_64  
    libmount-2.30.2-2.amzn2.0.10.x86_64  
    libmount-devel-2.30.2-2.amzn2.0.10.x86_64  
    libblkid-2.30.2-2.amzn2.0.10.x86_64  
    libblkid-devel-2.30.2-2.amzn2.0.10.x86_64  
    libuuid-2.30.2-2.amzn2.0.10.x86_64  
    libuuid-devel-2.30.2-2.amzn2.0.10.x86_64  
    uuidd-2.30.2-2.amzn2.0.10.x86_64  
    python-libmount-2.30.2-2.amzn2.0.10.x86_64  
    util-linux-user-2.30.2-2.amzn2.0.10.x86_64  
    util-linux-debuginfo-2.30.2-2.amzn2.0.10.x86_64  

Additional References

Red Hat: CVE-2022-0563

Mitre: CVE-2022-0563