Summary
[4.1.12-124.43.4]
- kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn) [Orabug: 29434845] {CVE-2019-6974}
- KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier) [Orabug: 29434898] {CVE-2019-7221}
- KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini) [Orabug: 29434924] {CVE-2019-7222}
- net: arc_emac: fix koops caused by sk_buff free (Alexander Kochetkov) [Orabug: 30254239] {CVE-2016-10906}
- GFS2: don't set rgrp gl_object until it's inserted into rgrp tree (Bob Peterson) [Orabug: 30254251] {CVE-2016-10905}
- GFS2: Fix rgrp end rounding problem for bsize < page size (Bob Peterson) [Orabug: 30254251] {CVE-2016-10905}
- x86/apic/msi: update address_hi on set msi affinity (Joe Jin) [Orabug: 31477035]
- x86/apic/msi: check and sync apic IRR on msi_set_affinity (Joe Jin) [Orabug: 31477035]
- net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup (Sabrina Dubroca) [Orabug: 31872821] {CVE-2020-1749}
- nfs: Fix getxattr kernel panic and memory overflow (Jeffrey Mitchell) [Orabug: 31872910] {CVE-2020-25212}
- rbd: require global CAP_SYS_ADMIN for mapping and unmapping (Ilya Dryomov) [Orabug: 31884169] {CVE-2020-25284}
- mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song) [Orabug: 31884239] {CVE-2020-25285}
- ext4: fix potential negative array index in do_split() (Eric Sandeen) [Orabug: 31895331] {CVE-2020-14314}
[4.1.12-124.43.3]
- ARM: amba: Fix race condition with driver_override (Geert Uytterhoeven) [Orabug: 29671212] {CVE-2018-9415}
- block: blk_init_allocated_queue() set q->fq as NULL in the fail case (xiao jin) [Orabug: 30120513] {CVE-2018-20856}
- USB: serial: omninet: fix reference leaks at open (Johan Hovold) [Orabug: 30484761] {CVE-2017-8925}
- nl80211: validate beacon head (Johannes Berg) [Orabug: 30556264] {CVE-2019-16746}
- cfg80211: Use const more consistently in for_each_element macros (Jouni Malinen) [Orabug: 30556264] {CVE-2019-16746}
- cfg80211: add and use strongly typed element iteration macros (Johannes Berg) [Orabug: 30556264] {CVE-2019-16746}
- cfg80211: add helper to find an IE that matches a byte-array (Luca Coelho) [Orabug: 30556264] {CVE-2019-16746}
- cfg80211: allow finding vendor with OUI without specifying the OUI type (Emmanuel Grumbach) [Orabug: 30556264] {CVE-2019-16746}
- dccp: Fix memleak in __feat_register_sp (YueHaibing) [Orabug: 30732821] {CVE-2019-20096}
- fs/proc/proc_sysctl.c: Fix a NULL pointer dereference (YueHaibing) [Orabug: 30732938] {CVE-2019-20054}
- fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links (YueHaibing) [Orabug: 30732938] {CVE-2019-20054}
- scsi: libsas: stop discovering if oob mode is disconnected (Jason Yan) [Orabug: 30770913] {CVE-2019-19965}
- kernel/sysctl.c: fix out-of-bounds access when setting file-max (Will Deacon) [Orabug: 31350720] {CVE-2019-14898}
- sysctl: handle overflow for file-max (Christian Brauner) [Orabug: 31350720] {CVE-2019-14898}
- ath9k_htc: release allocated buffer if timed out (Navid Emamdoost) [Orabug: 31351572] {CVE-2019-19073}
- can: gs_usb: gs_can_open(): prevent memory leak (Navid Emamdoost) [Orabug: 31351682] {CVE-2019-19052}
- ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() (Takashi Iwai) [Orabug: 31351837] {CVE-2019-15927}
- media: usb: siano: Fix general protection fault in smsusb (Alan Stern) [Orabug: 31351875] {CVE-2019-15218}
- crypto: vmac - separate tfm and request context (Eric Biggers) [Orabug: 31584410]
- SUNRPC: Fix a race with XPRT_CONNECTING (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: Fix disconnection races (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: Add a helper to wake up a sleeping rpc_task and set its status (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: Reduce latency when send queue is congested (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: RPC transport queue must be low latency (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: Fix a potential race in xprt_connect() (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() (NeilBrown) [Orabug: 31796770]
- SUNRPC: Fix races between socket connection and destroy code (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: Prevent SYN+SYNACK+RST storms (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: Report TCP errors to the caller (Trond Myklebust) [Orabug: 31796770]
- SUNRPC: Ensure we release the TCP socket once it has been closed (Trond Myklebust) [Orabug: 31796770]
- net-gro: fix use-after-free read in napi_gro_frags() (Eric Dumazet) [Orabug: 31856195] {CVE-2020-10720}
- PCI: Probe bridge window attributes once at enumeration-time (Bjorn Helgaas) [Orabug: 31867577]
[4.1.12-124.43.2]
- ALSA: seq: Cancel pending autoload work at unbinding device (Takashi Iwai) [Orabug: 31352045] {CVE-2017-16528}
- USB: serial: io_ti: fix information leak in completion handler (Johan Hovold) [Orabug: 31352084] {CVE-2017-8924}
- sample-trace-array: Fix sleeping function called from invalid context (Kefeng Wang) [Orabug: 31543032]
- sample-trace-array: Remove trace_array 'sample-instance' (Kefeng Wang) [Orabug: 31543032]
- tracing: Sample module to demonstrate kernel access to Ftrace instances. (Divya Indi) [Orabug: 31543032]
- tracing: Adding new functions for kernel access to Ftrace instances (Aruna Ramakrishna) [Orabug: 31543032]
- tracing: Adding NULL checks for trace_array descriptor pointer (Divya Indi) [Orabug: 31543032]
- tracing: Verify if trace array exists before destroying it. (Divya Indi) [Orabug: 31543032]
- tracing: Declare newly exported APIs in include/linux/trace.h (Divya Indi) [Orabug: 31543032]
- tracing: Kernel access to Ftrace instances (Divya Indi) [Orabug: 31543032]
[4.1.12-124.43.1]
- blktrace: Protect q->blk_trace with RCU (Jan Kara) [Orabug: 31123576] {CVE-2019-19768}
- media: technisat-usb2: break out of loop at end of buffer (Sean Young) [Orabug: 31224554] {CVE-2019-15505}
- btrfs: mer
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:4.1.12-124.43.4.el7uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:4.1.12-124.43.4.el7uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:4.1.12-124.43.4.el7uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:4.1.12-124.43.4.el7uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:4.1.12-124.43.4.el7uek |
| Oracle Linux · 7 | kernel-uek-firmware | 0:4.1.12-124.43.4.el7uek |
Vulnerabilities 38
-
High 8.0
A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel modu…
-
High 7.5
A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE t…
-
High 7.4CVE-2019-5108 EPSS 10%
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could expl…
-
High 7.0
The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw…
-
Medium 6.5
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the s…
-
Medium 6.1
A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed …
-
Medium 5.5
A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the wa…
-
Medium 5.3
The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use t…
-
Unscored —
An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions g…
-
Unscored —
An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is cau…
-
Unscored —
sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service (snd_rawmidi_…
-
Unscored —
The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users t…
-
Unscored —
The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause…
-
Unscored —
An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-aft…
-
Unscored —
In driver_override_store and driver_override_show of bus.c, there is a possible double free due to improper locking. Th…
-
Unscored —
The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, …
-
Unscored —
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB…
-
Unscored —
drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB …
-
Unscored —
An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_p…
-
Unscored —
An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of v…
-
Unscored —
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The …
-
Unscored —CVE-2019-18885 Public exploit
fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a craf…
-
Unscored —
A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows at…
-
Unscored —
Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a …
-
Unscored —
In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrac…
-
Unscored —
In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of…
-
Unscored —
In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, …
-
Unscored —
In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause deni…
-
Unscored —
An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packe…
-
Unscored —
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because…
-
Unscored —
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
-
Unscored —
The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.
-
Unscored —
A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with …
-
Unscored —
A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in…
-
Unscored —
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker at…
-
Unscored —
A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt m…
-
Unscored —
The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checkin…
-
Unscored —
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by loca…