Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux AWS kernel could allow system takeover
published 1 year ago
Summary
The Linux kernel used in Amazon Web Services (AWS) environments has several flaws that could let an attacker gain control of the system. The problems affect many parts of the kernel, including core networking, file systems, drivers and security modules. Install the latest kernel update from Canonical for linux‑aws‑5.4 (or the newer linux‑aws package) as soon as possible to close the gaps.
What to do
- Update canonical linux-aws-5.4 to version 5.4.0-1136.146~18.04.1.
- Update canonical linux-aws to version 5.4.0-1136.146.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:18.04:LTS | canonical | linux-aws-5.4 |
< 5.4.0-1136.146~18.04.1 Fix: upgrade to 5.4.0-1136.146~18.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-aws |
< 5.4.0-1136.146 Fix: upgrade to 5.4.0-1136.146
|
Original advisory text
linux-aws, linux-aws-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- S390 architecture;
- x86 architecture;
- Power management core;
- GPU drivers;
- InfiniBand drivers;
- Network drivers;
- S/390 drivers;
- TTY drivers;
- BTRFS file system;
- EROFS file system;
- F2FS file system;
- File systems infrastructure;
- BPF subsystem;
- Socket messages infrastructure;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- SELinux security module;
(CVE-2022-48938, CVE-2024-42156, CVE-2024-36953, CVE-2024-38538,
CVE-2021-47501, CVE-2024-42068, CVE-2024-26947, CVE-2024-46724,
CVE-2024-36968, CVE-2023-52497, CVE-2024-35951, CVE-2023-52488,
CVE-2024-44940, CVE-2022-48733, CVE-2023-52498, CVE-2022-48943,
CVE-2024-35904, CVE-2024-42077, CVE-2024-36938, CVE-2023-52639,
CVE-2024-42240, CVE-2024-44942, CVE-2021-47076)
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- S390 architecture;
- x86 architecture;
- Power management core;
- GPU drivers;
- InfiniBand drivers;
- Network drivers;
- S/390 drivers;
- TTY drivers;
- BTRFS file system;
- EROFS file system;
- F2FS file system;
- File systems infrastructure;
- BPF subsystem;
- Socket messages infrastructure;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- SELinux security module;
(CVE-2022-48938, CVE-2024-42156, CVE-2024-36953, CVE-2024-38538,
CVE-2021-47501, CVE-2024-42068, CVE-2024-26947, CVE-2024-46724,
CVE-2024-36968, CVE-2023-52497, CVE-2024-35951, CVE-2023-52488,
CVE-2024-44940, CVE-2022-48733, CVE-2023-52498, CVE-2022-48943,
CVE-2024-35904, CVE-2024-42077, CVE-2024-36938, CVE-2023-52639,
CVE-2024-42240, CVE-2024-44942, CVE-2021-47076)
References
- https://ubuntu.com/security/notices/USN-7159-2 Vendor Advisory
- https://ubuntu.com/security/CVE-2021-47076 Third Party Advisory
- https://ubuntu.com/security/CVE-2021-47501 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-48733 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-48938 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-48943 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-52488 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-52497 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-52498 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-52639 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-26947 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-35904 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-35951 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-36938 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-36953 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-36968 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-38538 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-42068 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-42077 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-42156 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-42240 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-44940 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-44942 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-46724 Third Party Advisory
Timeline
Published17 Dec 2024
Updated22 Oct 2026
First seen22 Oct 2026
Sources
USN-7159-2 · OSV
Track software like this
Free during beta