Amazon Linux 2023 Patches Critical Kernel Privilege Escalation Flaw

Amazon Web Services (AWS) has issued an important security advisory, ALAS2023LIVEPATCH-2026-190, for its Amazon Linux 2023 distribution. The advisory highlights a critical local privilege escalation vulnerability, identified as 'PinTheft,' affecting the kernel-livepatch-6.18.15-14.217 package. This flaw stems from an RDS zerocopy double-free exploit that can be leveraged to perform a page-cache overwrite via io_uring fixed buffers. The successful exploitation of this vulnerability could allow a local attacker to gain elevated privileges on affected Amazon Linux 2023 systems. AWS strongly recommends that users ensure live patching is enabled and update their systems immediately to the corrected package version. The update can be applied by running `dnf update kernel-livepatch-6.18.15-14.217 --releasever latest` or `dnf update --advisory ALAS2023LIVEPATCH-2026-190 --releasever latest`. This proactive measure is essential to protect against potential security breaches and maintain the integrity of Amazon Linux environments.