Critical Bluetooth and CIFS Vulnerabilities in linux-aws Package
Summary
USN-7591-4: linux-aws vulnerabilities. Affects linux-aws versions < 5.15.0-1086.93. Fixed in 5.15.0-1086.93. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-aws package is a specialized version of the Linux kernel tailored for Amazon Web Services (AWS) environments. It provides essential functionalities for managing AWS resources, including support for various hardware and network configurations. This package is crucial for users operating in cloud environments, ensuring optimal performance and security. However, recent vulnerabilities have raised concerns about its security posture, particularly regarding Bluetooth connectivity and CIFS network file system handling.
Vulnerability Detail
Michael Randrianantenaina discovered an improper access control vulnerability in the Bluetooth driver of the Linux Kernel, allowing nearby attackers to connect rogue devices and potentially execute arbitrary code (CVE-2024-8805). Additionally, the CIFS network file system implementation failed to verify the target namespace during upcalls, which could expose sensitive information to attackers (CVE-2025-2312). These vulnerabilities could lead to unauthorized access and system compromise, affecting the integrity and confidentiality of user data.
How To Fix
Minimum fixed version
5.15.0-1086.93
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-awsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable Bluetooth functionality to prevent unauthorized connections until the package is updated. This can be done by executing the command:
sudo systemctl stop bluetooth.service' and 'sudo systemctl disable bluetooth.service'.
Conclusion
The linux-aws package has critical vulnerabilities that require immediate attention. Users should update to the latest patched version to mitigate risks associated with unauthorized access and data exposure. Regular updates and monitoring are essential for maintaining system security.
See every vulnerability recorded for linux-aws →
FAQ
The linux-aws package is a version of the Linux kernel optimized for use in Amazon Web Services environments, providing necessary drivers and functionalities for AWS hardware.
The vulnerabilities include an improper access control issue in the Bluetooth driver and a namespace verification flaw in the CIFS network file system implementation.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit the Vulert playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
These vulnerabilities could allow attackers to execute arbitrary code or expose sensitive information, leading to unauthorized access and potential system compromise.
It is recommended to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux-aws.
