CVE-2023-31315 Affecting linux-firmware package, versions <0:20200421-82.git78c0348.amzn2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-LINUXFIRMWARE-7725275
- published 21 Aug 2024
- disclosed 12 Aug 2024
Introduced: 12 Aug 2024
CVE-2023-31315 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2
linux-firmware
to version 0:20200421-82.git78c0348.amzn2 or higher.
This issue was patched in ALAS2-2024-2626
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream linux-firmware
package and not the linux-firmware
package as distributed by Amazon-Linux
.
See How to fix?
for Amazon-Linux:2
relevant fixed versions and status.
Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.