Linux · Amazon Linux · Security advisory · February 29, 2024

ALAS2023-2024-549: Security update for 21 packages

ALAS2023-2024-549, released February 29, 2024, fixes 38 CVEs across 21 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
38
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.4
Base score, 0 to 10
Highest EPSS
0.0222
82nd percentile

Priority of the 38 CVEs

Patch now 0 Urgent 1 High 11 Routine 26

Fixed package versions

ProductReleaseFixed in
bpftoolamzn 20236.1.79-99.164.amzn2023
bpftool-debuginfoamzn 20236.1.79-99.164.amzn2023
kernelamzn 20236.1.79-99.164.amzn2023
kernel-debuginfoamzn 20236.1.79-99.164.amzn2023
kernel-debuginfo-common-aarch64amzn 20236.1.79-99.164.amzn2023
kernel-debuginfo-common-x86_64amzn 20236.1.79-99.164.amzn2023
kernel-develamzn 20236.1.79-99.164.amzn2023
kernel-headersamzn 20236.1.79-99.164.amzn2023
kernel-libbpfamzn 20236.1.79-99.164.amzn2023
kernel-libbpf-develamzn 20236.1.79-99.164.amzn2023
kernel-libbpf-staticamzn 20236.1.79-99.164.amzn2023
kernel-livepatch-6.1.79-99.164amzn 20231.0-0.amzn2023
kernel-modules-extraamzn 20236.1.79-99.164.amzn2023
kernel-modules-extra-commonamzn 20236.1.79-99.164.amzn2023
kernel-toolsamzn 20236.1.79-99.164.amzn2023
kernel-tools-debuginfoamzn 20236.1.79-99.164.amzn2023
kernel-tools-develamzn 20236.1.79-99.164.amzn2023
perfamzn 20236.1.79-99.164.amzn2023
perf-debuginfoamzn 20236.1.79-99.164.amzn2023
python3-perfamzn 20236.1.79-99.164.amzn2023
python3-perf-debuginfoamzn 20236.1.79-99.164.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2024-26828 kernel-azure: The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following securi...9.4 0.0075 None reported
High CVE-2024-26581 kernel-64k-modules-core: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: n...7.8 0.0222 None reported
High CVE-2023-52434 kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...8.0 0.0102 None reported
High CVE-2024-26582 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: G...7.8 0.0072 None reported
High CVE-2024-26689 linux: In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg()...7.8 0.0070 None reported
High CVE-2024-26665 kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...7.8 0.0068 None reported
High CVE-2024-26826 kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...7.0 0.0065 None reported
High CVE-2024-26583 kernel-rt: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...7.0 0.0055 None reported
High CVE-2024-26602 kernel-rt: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...8.0 0.0032 None reported
High CVE-2024-0841 kernel-core: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): For more de...8.0 0.0030 None reported
High CVE-2024-26704 kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...7.8 0.0027 None reported
High CVE-2024-26720 linux: In the Linux kernel, the following vulnerability has been resolved: mm/writeback: fix possible divide-by-zero in wb_...7.8 n/a None reported
Routine CVE-2024-2193 xen: A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative executi...5.7 0.0128 None reported
Routine CVE-2024-23850 linux: In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and...5.5 0.0031 None reported
Routine CVE-2024-23851 linux: copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX byte...5.5 0.0030 None reported
Routine CVE-2024-26601 kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...5.5 0.0029 None reported
Routine CVE-2024-26603 kernel-tools: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: M...5.5 0.0028 None reported
Routine CVE-2024-1151 Kernel: stack overflow problem in open vswitch kernel module leading to dos5.5 0.0027 None reported
Routine CVE-2024-26726 kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...5.5 0.0026 None reported
Routine CVE-2024-26920 kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...5.5 0.0026 None reported
Routine CVE-2023-52429 linux: dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate...5.5 0.0025 None reported
Routine CVE-2024-26688 linux: In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in huge...5.5 0.0025 None reported
Routine CVE-2023-52616 kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...5.5 0.0024 None reported
Routine CVE-2024-26820 linux: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DE...5.5 0.0024 None reported
Routine CVE-2024-0340 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: M...5.5 0.0024 None reported
Showing 1 to 25 of 38 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.