Summary
[4.14.35-1902.303.4.1]
- x86/speculation: Add SRBDS vulnerability and mitigation documentation (Mark Gross) [Orabug: 31422209] {CVE-2020-0543}
- x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Mark Gross) [Orabug: 31422209] {CVE-2020-0543}
- x86/cpu: Add 'table' argument to cpu_matches() (Mark Gross) [Orabug: 31422209] {CVE-2020-0543}
- x86/cpu: Add a steppings field to struct x86_cpu_id (Mark Gross) [Orabug: 31422209] {CVE-2020-0543}
[4.14.35-1902.303.4]
- net/rds: suppress memory allocation failure reports (Manjunath Patil) [Orabug: 31422157]
- rds: Do not cancel RDMAs that have been posted to the HCA (Hakon Bugge) [Orabug: 31422151]
- rds: Introduce rds_conn_to_path helper (Hakon Bugge) [Orabug: 31422151]
- xen/manage: enable C_A_D to force reboot (Dongli Zhang) [Orabug: 31422147]
[4.14.35-1902.303.3]
- scsi: target: fix hang when multiple threads try to destroy the same iscsi session (Maurizio Lombardi) [Orabug: 31374726]
- scsi: target: remove boilerplate code (Maurizio Lombardi) [Orabug: 31374726]
- KSPLICE: mips: clear the stack before going in the freezer. (Quentin Casasnovas) [Orabug: 31352999]
- KSPLICE: mips: signals the freezer when were coming from the entry code. (Quentin Casasnovas) [Orabug: 31352999]
- libertas: Fix two buffer overflows at parsing bss descriptor (Wen Huang) [Orabug: 31351306] {CVE-2019-14896} {CVE-2019-14897} {CVE-2019-14897}
- KVM: SVM: Fix potential memory leak in svm_cpu_init() (Miaohe Lin) [Orabug: 31350457] {CVE-2020-12768}
- Fix up usage of cfg_enable_fc4_TYPE for backport to UEK5 (Dick Kennedy) [Orabug: 31344936]
- scsi: lpfc: Fix unexpected error messages during RSCN handling (James Smart) [Orabug: 31344936]
- scsi: lpfc: Fix devices that dont return after devloss followed by rediscovery (James Smart) [Orabug: 31344936]
- scsi: lpfc: Fix port relogin failure due to GID_FT interaction (James Smart) [Orabug: 31344936]
- scsi: lpfc: Fix discovery failures when target device connectivity bounces (James Smart) [Orabug: 31344936]
- NFSv4.0: Remove transport protocol name from non-UCS client ID (Chuck Lever) [Orabug: 31357279]
- NFSv4.0: Remove cl_ipaddr from non-UCS client ID (Chuck Lever) [Orabug: 31357279]
- slcan: not call free_netdev before rtnl_unlock in slcan_open (Oliver Hartkopp) [Orabug: 31314977]
- can, slip: Protect tty->disc_data in write_wakeup and close with RCU (Richard Palethorpe) [Orabug: 31314977]
- can: slcan: Fix use-after-free Read in slcan_open (Jouni Hogander) [Orabug: 31314977]
- slcan: Fix memory leak in error path (Jouni Hogander) [Orabug: 31314977]
- uek-rpm: aarch64 make olddefconfig after inline spinlocks (Tom Saeger) [Orabug: 31314977]
- config-aarch64: enable CONFIG_MPLS_IPTUNNEL and CONFIG_BPF_JIT_ALWAYS_ON (Thomas Tai) [Orabug: 31314977]
- config-aarch64: enable ISCSI_IBFT (Thomas Tai) [Orabug: 31314977]
- iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND (Thomas Tai) [Orabug: 31314977]
- config-aarch64: change CONFIG_HZ and CONFIG_FRAME_WARN (Thomas Tai) [Orabug: 31314977]
- iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE (Will Deacon) [Orabug: 31314977]
- iommu/arm-smmu-v3: Prevent any devices access to memory without registration (Zhen Lei) [Orabug: 31314977]
- iommu/arm-smmu-v3: Disable default event queue logging (Rick Farrington) [Orabug: 31314977]
- iommu/arm-smmu-v3: Dont disable SMMU in kdump kernel (Will Deacon) [Orabug: 31314977]
- iommu/arm-smmu-v3: Abort all transactions if SMMU is enabled in kdump kernel (Will Deacon) [Orabug: 31314977]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads on SMMU for 96xx and 95xx silicons (Geetha sowjanya) [Orabug: 31314977]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads on CN96XX SMMU (Linu Cherian) [Orabug: 31314977]
- iommu/arm-smmu-v3: Use burst-polling for sync completion (Robin Murphy) [Orabug: 31314977]
- iommu/arm-smmu-v3: Consolidate identical timeouts (Will Deacon) [Orabug: 31314977]
- iommu/arm-smmu-v3: Split arm_smmu_cmdq_issue_sync in half (Will Deacon) [Orabug: 31314977]
- iommu/arm-smmu-v3: Use CMD_SYNC completion MSI (Robin Murphy) [Orabug: 31314977]
- iommu/arm-smmu-v3: Forget about cmdq-sync interrupt (Robin Murphy) [Orabug: 31314977]
- iommu/arm-smmu-v3: Specialise CMD_SYNC handling (Robin Murphy) [Orabug: 31314977]
- iommu/arm-smmu-v3: Correct COHACC override message (Robin Murphy) [Orabug: 31314977]
- iommu/arm-smmu-v3: Avoid ILLEGAL setting of STE.S1STALLD and CD.S (Yisheng Xie) [Orabug: 31314977]
- iommu/arm-smmu-v3: Ensure we sync STE when only changing config field (Will Deacon) [Orabug: 31314977]
- iommu/arm-smmu: Remove ACPICA workarounds (Robin Murphy) [Orabug: 31314977]
- Revert 'iommu/arm-smmu-v3: Force 32 byte command queue memory reads on CN96XX SMMU' (Eric Snowberg) [Orabug: 31314977]
- Revert 'iommu/arm-smmu-v3: Force 32 byte command queue memory reads on SMMU for 96xx and 95xx silicons' (Eric Snowberg) [Orabug: 31314977]
- Revert 'iommu/arm-smmu-v3: Abort all transactions if SMMU is enabled in kdump kernel' (Eric Snowberg) [Orabug: 31314977]
- Revert 'iommu/arm-smmu-v3: Dont disable SMMU in kdump kernel' (Eric Snowberg) [Orabug: 31314977]
- Revert 'iommu/arm-smmu-v3: Disable default event queue logging' (Eric Snowberg) [Orabug: 31314977]
- Revert 'iommu/arm-smmu-v3: Prevent any devices access to memory without registration' (Eric Snowberg) [Orabug: 31314977]
- lib/list_sort: optimize number of calls to comparison function (George Spelvin) [Orabug: 31314977]
- lib/list_sort: simplify and remove MAX_LIST_LENGTH_BITS (George Spelvin) [Orabug: 31314977]
- lib/sort: avoid indirect calls to built-in swap (George Spelvin) [Orabug: 31314977]
- lib/sort: use more efficient bottom-up heapsort variant (George Spelvin) [Orabug: 31314977]
- lib/sort: make swap functions more generic (George Spelvin) [Orabug: 31314977]
- KVM: arm/arm64: Only skip MMIO insn once (Andrew Jones) [Orabug: 31314977]
- arm64: t
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | kernel-uek-headers | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | kernel-uek-tools | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | kernel-uek-tools-libs | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | kernel-uek-tools-libs-devel | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | perf | 0:4.14.35-1902.303.4.1.el7uek |
| Oracle Linux · 7 | python-perf | 0:4.14.35-1902.303.4.1.el7uek |
Vulnerabilities 20
-
High 7.9
Broadcom brcmfmac driver is vulnerable to a heap buffer overflow
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffe…
-
High 7.9
Broadcom brcmfmac driver is vulnerable to a frame validation bypass
The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this…
-
High 7.8
A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip d…
-
Medium 6.6
A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An att…
-
Unscored —CVE-2019-11599 Public exploit
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma l…
-
Unscored —
An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c…
-
Unscored —
drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB …
-
Unscored —
The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka C…
-
Unscored —
A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the …
-
Unscored —
A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Lin…
-
Unscored —
Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Lin…
-
Unscored —
A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel throug…
-
Unscored —
In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the dr…
-
Unscored —
In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the US…
-
Unscored —
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_ex…
-
Unscored —
In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demon…
-
Unscored —
Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticate…
-
Unscored —
An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv0…
-
Unscored —
In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles …
-
Unscored —
An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c has a memory leak, aka CID…