Improper Update of Reference Count Affecting kernel-debuginfo package, versions <0:4.14.336-257.562.amzn2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-KERNELDEBUGINFO-6371067
- published 5 Mar 2024
- disclosed 4 Jan 2024
How to fix?
Upgrade Amazon-Linux:2 kernel-debuginfo to version 0:4.14.336-257.562.amzn2 or higher.
This issue was patched in ALAS2-2024-2475.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-debuginfo package and not the kernel-debuginfo package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2 relevant fixed versions and status.
A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on struct net_device, and a use-after-free can be triggered by racing between the free on the struct and the access through the skbtxq global queue. This could lead to a denial of service condition or potential code execution.