QID 354024

Date Published: 2022-07-25

QID 354024: Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.15-2022-004

a use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the linux kernels filesystem sub-component.
This flaw allows a local attacker with a user privilege to cause a denial of service. (
( CVE-2022-1184) a flaw was found in kvm.
With shadow paging enabled if invpcid is executed with cr0.pg=0, the invlpg callback is not set, and the result is a null pointer dereference.
This flaw allows a guest user to cause a kernel oops condition on the host, resulting in a denial of service. (
( CVE-2022-1789) a null pointer dereference flaw was found in the linux kernels kvm module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c.
This flaw occurs while executing an illegal instruction in guest in the intel cpu. (
( CVE-2022-1852) a use-after-free vulnerability was found in the linux kernels netfilter subsystem in net/netfilter/nf_tables_api.c.
This flaw allows a local attacker with user access to cause a privilege escalation issue. (
( CVE-2022-1966) no description is available for this( CVE. (
( CVE-2022-1972) a use-after-free flaw was found in the linux kernel in log_replay in fs/ntfs3/fslog.c in the ntfs journal.
This flaw allows a local attacker to crash the system and leads to a kernel information leak problem. (
( CVE-2022-1973) a vulnerability was found in the linux kernels nft_set_desc_concat_parse() function .this flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and possibly to run code. (
( CVE-2022-32250) an issue was discovered in the linux kernel through 5.18.3 on powerpc 32-bit platforms.
( CVE-2022-34495)



Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.

  • CVSS V3 rated as High - 7.8 severity.
  • CVSS V2 rated as High - 7.2 severity.
  • Solution
    Please refer to Amazon advisory: ALAS2KERNEL-5.15-2022-004 for affected packages and patching details, or update with your package manager.
    Vendor References
    Software Advisories
    Advisory ID Software Component Link
    ALAS2KERNEL-5.15-2022-004 Amazon Linux 2 URL Logo alas.aws.amazon.com/AL2/ALASKERNEL-5.15-2022-004.html