Summary
[4.18.0-305.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15-11.0.5
[4.18.0-305]
- perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3 (Michael Petlan) [1950388]
[4.18.0-304]
- mm: Revert 'remove the account_page_dirtied export' (Waiman Long) [1941257]
- Revert '[netdrv] net/broadcom: Clean broadcom code from driver versions' (Jonathan Toppins) [1940842]
[4.18.0-303]
- redhat: switch secureboot kernel image signing to release keys (Jan Stancek)
- Revert '[md] md/raid5: add a new member of offset into r5dev' (Nigel Croxon) [1936903]
- Revert '[md] md/raid5: make async_copy_data() to support different page offset' (Nigel Croxon) [1936903]
- Revert '[crypto] md/raid5: add new xor function to support different page offset' (Nigel Croxon) [1936903]
- Revert '[md] md/raid5: convert to new xor compution interface' (Nigel Croxon) [1936903]
- Revert '[crypto] md/raid6: let syndrome computor support different page offset' (Nigel Croxon) [1936903]
- Revert '[crypto] md/raid6: let async recovery function support different page offset' (Nigel Croxon) [1936903]
- Revert '[md] md/raid5: let multiple devices of stripe_head share page' (Nigel Croxon) [1936903]
- Revert '[md] md/raid5: resize stripe_head when reshape array' (Nigel Croxon) [1936903]
- Revert '[md] md/raid5: reallocate page array after setting new stripe_size' (Nigel Croxon) [1936903]
- ACPI: PNP: compare the string length in the matching_id() (Mark Langsdorf) [1933702]
- ceph: add missing break when parsing 'nowsync' mount option (Jeff Layton) [1932753]
- get_maintainer.conf: Update with new location of RHMAINTAINERS (Prarit Bhargava)
- redhat: make pathspec exclusion compatible with old git versions (Herton R. Krzesinski)
- redhat/scripts: Update merge-subtrees.sh with new subtree location (Prarit Bhargava)
- tree: Add RHMAINTAINERS soft link in 8.4 (Prarit Bhargava)
- tree: remove existing redhat/rhdocs subtree in 8.4 (Prarit Bhargava)
[4.18.0-302]
- PCI: rpadlpar: Fix potential drc_name corruption in store functions (Gustavo Luiz Duarte) [1938116]
- selftests: kvm: Add basic Hyper-V clocksources tests (Vitaly Kuznetsov) [1931782]
- KVM: x86: hyper-v: Dont touch TSC page values when guest opted for re-enlightenment (Vitaly Kuznetsov) [1931782]
- KVM: x86: hyper-v: Track Hyper-V TSC page status (Vitaly Kuznetsov) [1931782]
- KVM: x86: hyper-v: Prevent using not-yet-updated TSC page by secondary CPUs (Vitaly Kuznetsov) [1931782]
- KVM: x86: hyper-v: Limit guest to writing zero to HV_X64_MSR_TSC_EMULATION_STATUS (Vitaly Kuznetsov) [1931782]
- drm/i915/guc: Update to use firmware v49.0.1 (Dave Airlie) [1935281] {CVE-2020-12362}
- time: Enable __kernel_timespec for 32-bit vdso build (Waiman Long) [1936282]
- lib/idr.c: document calling context for IDA APIs mustnt use locks (Chris von Recklinghausen) [1917764]
- ida: Free allocated bitmap in error path (Chris von Recklinghausen) [1917764]
- radix tree test suite: Fix compilation (Chris von Recklinghausen) [1917764]
- vmalloc: convert to XArray (Chris von Recklinghausen) [1917764]
- mm: pass addr as unsigned long to vb_free (Chris von Recklinghausen) [1917764]
- radix tree: Remove multiorder support (Chris von Recklinghausen) [1917764]
- radix tree test: Convert multiorder tests to XArray (Chris von Recklinghausen) [1917764]
- radix tree tests: Convert item_delete_rcu to XArray (Chris von Recklinghausen) [1917764]
- radix tree tests: Convert item_kill_tree to XArray (Chris von Recklinghausen) [1917764]
- radix tree tests: Move item_insert_order (Chris von Recklinghausen) [1917764]
- radix tree test suite: Remove multiorder benchmarking (Chris von Recklinghausen) [1917764]
- radix tree test suite: Remove __item_insert (Chris von Recklinghausen) [1917764]
- radix tree: Remove radix_tree_clear_tags (Chris von Recklinghausen) [1917764]
- radix tree: Remove split/join code (Chris von Recklinghausen) [1917764]
- radix tree: Remove radix_tree_update_node_t (Chris von Recklinghausen) [1917764]
- mm: Convert truncate to XArray (Chris von Recklinghausen) [1917764]
- copy rh_kabi.h to tools/testing/radix-tree/linux (Chris von Recklinghausen) [1917764]
[4.18.0-301]
- ibmvnic: fix a race between open and reset (Diego Domingos) [1940042]
- ibmvnic: Set to CLOSED state even on error (Diego Domingos) [1940042]
- ibmvnic: device remove has higher precedence over reset (Diego Domingos) [1940042]
- ibmvnic: merge do_change_param_reset into do_reset (Diego Domingos) [1940042]
- ibmvfc: disable MQ channelization by default (Gustavo Luiz Duarte) [1939359]
- pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() (Steve Dickson) [1926945]
- scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930833] {CVE-2021-27365}
- scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930856] {CVE-2021-27363}
- scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930809] {CVE-2021-27364}
- futex: Handle faults correctly for PI futexes (Waiman Long) [1924635]
- futex: Simplify fixup_pi_state_owner() (Waiman Long) [1924635]
- futex: Use pi_state_update_owner() in put_pi_state() (Waiman Long) [1924635]
- rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Waiman Long) [1924635]
- futex: Provide and use pi_state_update_owner() (Waiman Long) [1924635]
- futex: Replace pointless printk in fixup_owner() (Waiman Long) [1924635]
- futex: Ensure the correct return value from futex_lock_pi() (Waiman Long) [1924635]
- futex: Dont enable IRQs unconditionally in put_pi_state() (Waiman Long) [1924635]
- futex: Fix incorrect should_fail_futex() handling (Waiman Long) [1924635]
- futex: Consistently use fshared as boolean (Waiman Long) [1924635]
- futex: Remove needless gotos (Waiman Long) [192
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | perf | 0:4.18.0-305.el8 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-305.el8 |
Vulnerabilities 23
-
Medium 5.5
A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the wa…
-
Unscored —
A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 al…
-
Unscored —
In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the dri…
-
Unscored —
In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the dri…
-
Unscored —
In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to…
-
Unscored —
An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferen…
-
Unscored —
A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x be…
-
Unscored —
Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and bef…
-
Unscored —
usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer oc…
-
Unscored —CVE-2020-14356 Public exploit
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way w…
-
Unscored —
The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:…
-
Unscored —
In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem obj…
-
Unscored —
A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt m…
-
Unscored —
The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checkin…
-
Unscored —
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by loca…
-
Unscored —
A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read ov…
-
Unscored —
A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SE…
-
Unscored —CVE-2020-27786 Public exploit
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissio…
-
Unscored —
A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user cal…
-
Unscored —
A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged…
-
Unscored —
A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child…
-
Unscored —
An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. …
-
Unscored —
In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalat…