Information Exposure Affecting kernel-tools-devel package, versions <0:4.14.262-200.489.amzn2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-KERNELTOOLSDEVEL-6016308
- published 20 Oct 2023
- disclosed 27 Mar 2023
Introduced: 27 Mar 2023
CVE-2021-3923 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2 kernel-tools-devel to version 0:4.14.262-200.489.amzn2 or higher.
This issue was patched in ALAS2-2022-1749.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-tools-devel package and not the kernel-tools-devel package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2 relevant fixed versions and status.
A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.