Linux · Amazon Linux · Security advisory · February 17, 2023

ALAS2023-2023-070: Security update for 19 packages

ALAS2023-2023-070, released February 17, 2023, fixes 111 CVEs across 19 products. 4 of them are being exploited (CVE-2022-0847); 4 on CISA KEV. Patch Radar priority: Patch now.

Patch now4 on CISA KEV1 publicly disclosed
CVEs closed
111
None rated Critical
Exploited
4
CVE-2022-0847
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.9280
99th percentile

Priority of the 111 CVEs

Patch now 4 Urgent 0 High 66 Routine 41

Fixed package versions

ProductReleaseFixed in
bpftoolamzn 20236.1.10-15.42.amzn2023
bpftool-debuginfoamzn 20236.1.10-15.42.amzn2023
kernelamzn 20236.1.10-15.42.amzn2023
kernel-debuginfoamzn 20236.1.10-15.42.amzn2023
kernel-debuginfo-common-aarch64amzn 20236.1.10-15.42.amzn2023
kernel-debuginfo-common-x86_64amzn 20236.1.10-15.42.amzn2023
kernel-develamzn 20236.1.10-15.42.amzn2023
kernel-headersamzn 20236.1.10-15.42.amzn2023
kernel-libbpfamzn 20236.1.10-15.42.amzn2023
kernel-libbpf-develamzn 20236.1.10-15.42.amzn2023
kernel-libbpf-staticamzn 20236.1.10-15.42.amzn2023
kernel-livepatch-6.1.10-15.42amzn 20231.0-0.amzn2023
kernel-toolsamzn 20236.1.10-15.42.amzn2023
kernel-tools-debuginfoamzn 20236.1.10-15.42.amzn2023
kernel-tools-develamzn 20236.1.10-15.42.amzn2023
perfamzn 20236.1.10-15.42.amzn2023
perf-debuginfoamzn 20236.1.10-15.42.amzn2023
python3-perfamzn 20236.1.10-15.42.amzn2023
python3-perf-debuginfoamzn 20236.1.10-15.42.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2022-0847 kernel-doc: The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have be...8.8 0.9280 KEVExploited
Patch now CVE-2022-0185 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: x...8.4 0.2515 KEVExploited
Patch now CVE-2022-2586 kernel-rt: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...7.8 0.1020 KEVExploited
Patch now CVE-2022-0492 kernel-tools-libs-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have be...8.8 0.0553 KEVExploited
High CVE-2022-36946 kernel-rt: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...7.8 0.0887 None reported
High CVE-2022-4379 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: u...7.8 0.0663 None reported
High CVE-2022-2588 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-aft...7.8 0.0587 None reported
High CVE-2022-43945 kernel-zfcpdump: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: m...7.8 0.0546 None reported
High CVE-2022-34918 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: h...7.8 0.0545 None reported
High CVE-2022-0742 linux: Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-...7.5 0.0504 None reported
High CVE-2022-29901 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-aft...7.8 0.0501 None reported
High CVE-2022-29900 AMD: CVE-2022-29900 AMD CPU Branch Type Confusion7.8 0.0394 Exploitation Less Likely
High CVE-2022-32250 kernel-rt-core: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...7.8 0.0291 None reported
High CVE-2022-25636 kernel-rt-core: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...7.8 0.0263 None reported
High CVE-2022-1199 linux: A flaw was found in the Linux kernel7.5 0.0217 None reported
High CVE-2022-27223 linux: In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and mi...8.8 0.0213 None reported
High CVE-2022-23222 kernel-zfcpdump-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): For more de...8.0 0.0203 None reported
High CVE-2023-0179 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: u...7.8 0.0194 None reported
High CVE-2022-2602 linux: io_uring UAF, Unix SCM garbage collection7.0 0.0143 None reported
High CVE-2022-2585 kernel-rt-debug-core: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...7.8 0.0128 None reported
High CVE-2022-3623 kernel-debug-modules-core: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * use-after...7.5 0.0110 None reported
High CVE-2022-2078 kernel-core: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * off-path...7.8 0.0105 None reported
High CVE-2022-32981 linux: An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms7.8 0.0097 None reported
High CVE-2022-3534 libbpf: A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.18.0 0.0096 None reported
High CVE-2022-29581 kernel-rt-devel: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...7.8 0.0093 None reported
Showing 1 to 25 of 111 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.