NULL Pointer Dereference Affecting kernel-headers package, versions <0:6.1.15-28.43.amzn2023


Severity

Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.04% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-AMZN2023-KERNELHEADERS-7642772
  • published7 Aug 2024
  • disclosed26 Apr 2024

Introduced: 26 Apr 2024

CVE-2023-52646  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 kernel-headers to version 0:6.1.15-28.43.amzn2023 or higher.
This issue was patched in ALAS2023-2023-127.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-headers package and not the kernel-headers package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

aio: fix mremap after fork null-deref

Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced a null-deref if mremap is called on an old aio mapping after fork as mm->ioctx_table will be set to NULL.

[jmoyer@redhat.com: fix 80 column issue]

CVSS Scores

version 3.1