Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-009)

high Nessus Plugin ID 160451

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of kernel installed on the remote host is prior to 5.10.93-87.444. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-009 advisory.

2024-12-05: CVE-2021-47542 was added to this advisory.

2024-12-05: CVE-2021-47538 was added to this advisory.

2024-12-05: CVE-2021-47560 was added to this advisory.

2024-12-05: CVE-2021-47566 was added to this advisory.

2024-12-05: CVE-2021-47507 was added to this advisory.

2024-11-08: CVE-2021-47550 was added to this advisory.

2024-11-08: CVE-2021-47548 was added to this advisory.

2024-08-01: CVE-2021-47585 was added to this advisory.

2024-08-01: CVE-2021-47603 was added to this advisory.

2024-08-01: CVE-2021-47609 was added to this advisory.

2024-08-01: CVE-2021-47578 was added to this advisory.

2024-08-01: CVE-2021-47606 was added to this advisory.

2024-08-01: CVE-2021-47584 was added to this advisory.

2024-08-01: CVE-2021-47579 was added to this advisory.

2024-08-01: CVE-2021-47589 was added to this advisory.

2024-08-01: CVE-2021-47597 was added to this advisory.

2024-08-01: CVE-2021-47580 was added to this advisory.

2024-08-01: CVE-2021-47593 was added to this advisory.

2024-08-01: CVE-2021-47588 was added to this advisory.

2024-08-01: CVE-2021-47090 was added to this advisory.

2024-08-01: CVE-2021-47598 was added to this advisory.

2024-08-01: CVE-2021-47576 was added to this advisory.

2024-08-01: CVE-2021-47600 was added to this advisory.

2024-08-01: CVE-2021-47097 was added to this advisory.

2024-07-03: CVE-2021-47541 was added to this advisory.

2024-04-25: CVE-2021-46936 was added to this advisory.

2024-04-25: CVE-2021-46929 was added to this advisory.

2024-04-25: CVE-2021-46934 was added to this advisory.

2024-04-25: CVE-2021-46931 was added to this advisory.

2023-10-12: CVE-2021-3923 was added to this advisory.

A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711)

A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712)

A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests.A local user could use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713)

Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
(CVE-2021-28715)

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

A flaw memory leak in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4135)

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. (CVE-2021-4155)

An out-of-bounds write flaw was found in the Linux kernel's Aquantia AQtion Ethernet card Atlantic driver in the way the ethernet card provides malicious input to the driver. This flaw allows a local user to emulate the networking device and crash the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-43975)

In the Linux kernel, the following vulnerability has been resolved:

sctp: use call_rcu to free endpoint (CVE-2021-46929)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Wrap the tx reporter dump callback to extract the sq (CVE-2021-46931)

In the Linux kernel, the following vulnerability has been resolved:

i2c: validate user data in compat ioctl

Wrong user data may cause warning in i2c_transfer(), ex: zero msgs.Userspace should not be able to trigger warnings, so this patch addsvalidation checks for user data in compact ioctl to prevent reportedwarnings (CVE-2021-46934)

In the Linux kernel, the following vulnerability has been resolved:

net: fix use-after-free in tw_timer_handler (CVE-2021-46936)

In the Linux kernel, the following vulnerability has been resolved:

mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() (CVE-2021-47090)

In the Linux kernel, the following vulnerability has been resolved:

Input: elantech - fix stack out of bound access in elantech_change_report_id() (CVE-2021-47097)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Fix nsfd startup race (again) (CVE-2021-47507)

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (CVE-2021-47538)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (CVE-2021-47541)

In the Linux kernel, the following vulnerability has been resolved:

net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() (CVE-2021-47542)

In the Linux kernel, the following vulnerability has been resolved:

ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (CVE-2021-47548)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/amdgpu: fix potential memleak (CVE-2021-47550)

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum: Protect driver from buggy firmware (CVE-2021-47560)

In the Linux kernel, the following vulnerability has been resolved:

proc/vmcore: fix clearing user buffer by properly using clear_user() (CVE-2021-47566)

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() (CVE-2021-47576)

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_debug: Don't call kcalloc() if size arg is zero (CVE-2021-47578)

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix warning in ovl_create_real() (CVE-2021-47579)

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_debug: Fix type in min_t to avoid stack OOB (CVE-2021-47580)

In the Linux kernel, the following vulnerability has been resolved:

iocost: Fix divide-by-zero on donation from low hweight cgroup (CVE-2021-47584)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix memory leak in __add_inode_ref() (CVE-2021-47585)

In the Linux kernel, the following vulnerability has been resolved:

sit: do not call ipip6_dev_free() from sit_init_net() (CVE-2021-47588)

In the Linux kernel, the following vulnerability has been resolved:

igbvf: fix double free in `igbvf_probe` (CVE-2021-47589)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: clear 'kern' flag from fallback sockets (CVE-2021-47593)

In the Linux kernel, the following vulnerability has been resolved:

inet_diag: fix kernel-infoleak for UDP sockets (CVE-2021-47597)

In the Linux kernel, the following vulnerability has been resolved:

sch_cake: do not call cake_destroy() from cake_init() (CVE-2021-47598)

In the Linux kernel, the following vulnerability has been resolved:

dm btree remove: fix use after free in rebalance_children() (CVE-2021-47600)

In the Linux kernel, the following vulnerability has been resolved:

audit: improve robustness of the audit queue handling (CVE-2021-47603)

In the Linux kernel, the following vulnerability has been resolved:

net: netlink: af_netlink: Prevent empty skb by adding a check on len. (CVE-2021-47606)

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scpi: Fix string overflow in SCPI genpd driver (CVE-2021-47609)

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. (CVE-2022-0185)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update kernel' to update your system.

Plugin Details

Severity: High

ID: 160451

File Name: al2_ALASKERNEL-5_10-2022-009.nasl

Version: 1.16

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 5/2/2022

Updated: 12/17/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-0185

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:python-perf-debuginfo, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-headers, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:kernel-livepatch-5.10.93-87.444, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:python-perf

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/26/2022

Vulnerability Publication Date: 1/11/2021

CISA Known Exploited Vulnerability Due Dates: 9/11/2024

Exploitable With

Core Impact

Reference Information

CVE: CVE-2021-28711, CVE-2021-28712, CVE-2021-28713, CVE-2021-28714, CVE-2021-28715, CVE-2021-3923, CVE-2021-4135, CVE-2021-4155, CVE-2021-43975, CVE-2021-46929, CVE-2021-46931, CVE-2021-46934, CVE-2021-46936, CVE-2021-47090, CVE-2021-47097, CVE-2021-47507, CVE-2021-47538, CVE-2021-47541, CVE-2021-47542, CVE-2021-47548, CVE-2021-47550, CVE-2021-47560, CVE-2021-47566, CVE-2021-47576, CVE-2021-47578, CVE-2021-47579, CVE-2021-47580, CVE-2021-47584, CVE-2021-47585, CVE-2021-47588, CVE-2021-47589, CVE-2021-47593, CVE-2021-47597, CVE-2021-47598, CVE-2021-47600, CVE-2021-47603, CVE-2021-47606, CVE-2021-47609, CVE-2022-0185

Detections

Analytics

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-009)

high Nessus Plugin ID 160451

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

Vulnerability Information

Exploitable With

Reference Information