Amazon Linux 2023 Security Advisory: ALAS2023-2023-330
Advisory Released Date: 2023-09-07
Advisory Updated Date: 2025-10-18
FAQs regarding Amazon Linux ALAS/CVE Severity
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. (CVE-2023-20588)
The fix for XSA-423 added logic to Linux'es netback driver to deal with
a frontend splitting a packet in a way such that not all of the headers
would come in one piece. Unfortunately the logic introduced there
didn't account for the extreme case of the entire packet being split
into as many pieces as permitted by the protocol, yet still being
smaller than the area that's specially dealt with to keep all (possible)
headers together. Such an unusual packet would therefore trigger a
buffer overrun in the driver. (CVE-2023-34319)
A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)
A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace. (CVE-2023-3773)
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.
We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777)
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure. (CVE-2023-39194)
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.
We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)
A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)
netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147)
A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate. (CVE-2023-4194)
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.
When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.
When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.
When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)
A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack. (CVE-2023-4273)
A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak. (CVE-2023-4569)
A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation.
The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.
We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)
In the Linux kernel, the following vulnerability has been resolved:
igb: Fix igb_down hung on surprise removal (CVE-2023-53148)
In the Linux kernel, the following vulnerability has been resolved:
udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)
In the Linux kernel, the following vulnerability has been resolved:
dma-buf/dma-resv: Stop leaking on krealloc() failure (CVE-2023-53181)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: exit gracefully if reloc roots don't match (CVE-2023-53183)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix nexthop hash size (CVE-2023-53192)
In the Linux kernel, the following vulnerability has been resolved:
sched/fair: Don't balance task to its current running CPU (CVE-2023-53215)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix warning in cifs_smb3_do_mount() (CVE-2023-53230)
In the Linux kernel, the following vulnerability has been resolved:
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand (CVE-2023-53247)
In the Linux kernel, the following vulnerability has been resolved:
ovl: fix null pointer dereference in ovl_permission() (CVE-2023-53260)
In the Linux kernel, the following vulnerability has been resolved:
drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: fix overlap expiration walk (CVE-2023-53304)
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Enhance sanity check while generating attr_list (CVE-2023-53328)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)
In the Linux kernel, the following vulnerability has been resolved:
ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)
In the Linux kernel, the following vulnerability has been resolved:
net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)
In the Linux kernel, the following vulnerability has been resolved:
mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (CVE-2023-53401)
In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: fix bulk_move corruption when adding a entry (CVE-2023-53444)
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)
In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix disconnect vs accept race (CVE-2023-53490)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)
In the Linux kernel, the following vulnerability has been resolved:
virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)
In the Linux kernel, the following vulnerability has been resolved:
rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() (CVE-2023-53558)
In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)
In the Linux kernel, the following vulnerability has been resolved:
bpf, cpumap: Make sure kthread is running before map update returns (CVE-2023-53577)
In the Linux kernel, the following vulnerability has been resolved:
cifs: Release folio lock on fscache read hit. (CVE-2023-53593)
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix mid leak during reconnection after timeout threshold (CVE-2023-53597)
In the Linux kernel, the following vulnerability has been resolved:
tunnels: fix kasan splat when generating ipv4 pmtu error (CVE-2023-53600)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject invalid reloc tree root keys with stack dump (CVE-2023-53618)
In the Linux kernel, the following vulnerability has been resolved:
bpf, cpumap: Handle skb as well when clean up ptr_ring (CVE-2023-53660)
Affected Packages:
kernel
Issue Correction:
Run dnf update kernel --releasever 2023.1.20230906 or dnf update --advisory ALAS2023-2023-330 --releasever 2023.1.20230906 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
kernel-libbpf-devel-6.1.49-69.116.amzn2023.aarch64
python3-perf-6.1.49-69.116.amzn2023.aarch64
kernel-livepatch-6.1.49-69.116-1.0-0.amzn2023.aarch64
bpftool-debuginfo-6.1.49-69.116.amzn2023.aarch64
kernel-headers-6.1.49-69.116.amzn2023.aarch64
bpftool-6.1.49-69.116.amzn2023.aarch64
kernel-tools-debuginfo-6.1.49-69.116.amzn2023.aarch64
perf-6.1.49-69.116.amzn2023.aarch64
python3-perf-debuginfo-6.1.49-69.116.amzn2023.aarch64
perf-debuginfo-6.1.49-69.116.amzn2023.aarch64
kernel-tools-6.1.49-69.116.amzn2023.aarch64
kernel-libbpf-6.1.49-69.116.amzn2023.aarch64
kernel-tools-devel-6.1.49-69.116.amzn2023.aarch64
kernel-libbpf-static-6.1.49-69.116.amzn2023.aarch64
kernel-debuginfo-6.1.49-69.116.amzn2023.aarch64
kernel-6.1.49-69.116.amzn2023.aarch64
kernel-debuginfo-common-aarch64-6.1.49-69.116.amzn2023.aarch64
kernel-devel-6.1.49-69.116.amzn2023.aarch64
src:
kernel-6.1.49-69.116.amzn2023.src
x86_64:
kernel-livepatch-6.1.49-69.116-1.0-0.amzn2023.x86_64
perf-6.1.49-69.116.amzn2023.x86_64
kernel-tools-devel-6.1.49-69.116.amzn2023.x86_64
perf-debuginfo-6.1.49-69.116.amzn2023.x86_64
kernel-tools-debuginfo-6.1.49-69.116.amzn2023.x86_64
kernel-libbpf-static-6.1.49-69.116.amzn2023.x86_64
kernel-headers-6.1.49-69.116.amzn2023.x86_64
python3-perf-debuginfo-6.1.49-69.116.amzn2023.x86_64
kernel-libbpf-devel-6.1.49-69.116.amzn2023.x86_64
bpftool-debuginfo-6.1.49-69.116.amzn2023.x86_64
python3-perf-6.1.49-69.116.amzn2023.x86_64
bpftool-6.1.49-69.116.amzn2023.x86_64
kernel-libbpf-6.1.49-69.116.amzn2023.x86_64
kernel-tools-6.1.49-69.116.amzn2023.x86_64
kernel-debuginfo-6.1.49-69.116.amzn2023.x86_64
kernel-6.1.49-69.116.amzn2023.x86_64
kernel-debuginfo-common-x86_64-6.1.49-69.116.amzn2023.x86_64
kernel-devel-6.1.49-69.116.amzn2023.x86_64
2025-10-18: CVE-2023-53577 was added to this advisory.
2025-10-18: CVE-2023-53600 was added to this advisory.
2025-10-18: CVE-2023-53559 was added to this advisory.
2025-10-18: CVE-2023-53558 was added to this advisory.
2025-10-18: CVE-2023-53597 was added to this advisory.
2025-10-18: CVE-2023-53593 was added to this advisory.
2025-10-18: CVE-2023-53618 was added to this advisory.
2025-10-18: CVE-2023-53660 was added to this advisory.
2025-10-08: CVE-2023-53469 was added to this advisory.
2025-10-08: CVE-2023-53500 was added to this advisory.
2025-10-08: CVE-2023-53490 was added to this advisory.
2025-10-08: CVE-2023-53515 was added to this advisory.
2025-10-08: CVE-2023-53487 was added to this advisory.
2025-10-02: CVE-2023-53215 was added to this advisory.
2025-10-02: CVE-2023-53401 was added to this advisory.
2025-10-02: CVE-2023-53444 was added to this advisory.
2025-10-02: CVE-2023-53288 was added to this advisory.
2025-10-02: CVE-2023-53230 was added to this advisory.
2025-10-02: CVE-2023-53247 was added to this advisory.
2025-10-02: CVE-2023-53174 was added to this advisory.
2025-10-02: CVE-2023-53245 was added to this advisory.
2025-10-02: CVE-2023-53304 was added to this advisory.
2025-10-02: CVE-2023-53339 was added to this advisory.
2025-10-02: CVE-2023-53183 was added to this advisory.
2025-10-02: CVE-2023-53369 was added to this advisory.
2025-10-02: CVE-2023-53311 was added to this advisory.
2025-10-02: CVE-2023-53328 was added to this advisory.
2025-09-22: CVE-2023-53165 was added to this advisory.
2025-09-22: CVE-2023-53260 was added to this advisory.
2025-09-22: CVE-2023-53181 was added to this advisory.
2025-09-22: CVE-2023-53192 was added to this advisory.
2025-09-22: CVE-2023-53148 was added to this advisory.
2025-09-22: CVE-2023-53147 was added to this advisory.
2025-09-22: CVE-2023-53365 was added to this advisory.
2023-10-12: CVE-2023-39194 was added to this advisory.
2023-09-27: CVE-2023-4208 was added to this advisory.
2023-09-27: CVE-2023-4206 was added to this advisory.
2023-09-27: CVE-2023-4622 was added to this advisory.
2023-09-27: CVE-2023-4207 was added to this advisory.
2023-09-14: CVE-2023-3777 was added to this advisory.
2023-09-14: CVE-2023-4015 was added to this advisory.
2023-09-14: CVE-2023-4569 was added to this advisory.