Skip to content
OpenAdvisories
High ELSA-2021-9140 8 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

Published Mar 31, 2021 · Updated Mar 31, 2021

Summary

[5.4.17-2102.200.13]
- bpf, selftests: Fix up some test_verifier cases for unprivileged (Piotr Krysiuk) [Orabug: 32656761] {CVE-2020-27170} {CVE-2020-27171}
- bpf: Add sanity check for upper ptr_limit (Piotr Krysiuk) [Orabug: 32656761] {CVE-2020-27170} {CVE-2020-27171}
- bpf: Simplify alu_limit masking for pointer arithmetic (Piotr Krysiuk) [Orabug: 32656761] {CVE-2020-27170} {CVE-2020-27171}
- bpf: Fix off-by-one for area size in creating mask to left (Piotr Krysiuk) [Orabug: 32656761] {CVE-2020-27170} {CVE-2020-27171}
- bpf: Prohibit alu ops for pointer types not defining ptr_limit (Piotr Krysiuk) [Orabug: 32656761] {CVE-2020-27170} {CVE-2020-27171}
- selftests/bpf: Test access to bpf map pointer (Andrey Ignatov) [Orabug: 32656761] {CVE-2020-27170} {CVE-2020-27171}
- bpf: Fix truncation handling for mod32 dst reg wrt zero (Daniel Borkmann) [Orabug: 32673813] {CVE-2021-3444}
- bpf: Fix 32 bit src register truncation on div/mod (Daniel Borkmann) [Orabug: 32673813] {CVE-2021-3444}

[5.4.17-2102.200.12]
- Revert x86/platform/uv: Update UV MMRs for UV5 (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Add UV5 direct references (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Add and decode Arch Type in UVsystab (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Update MMIOH references based on new UV5 MMRs (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Adjust GAM MMR references affected by UV5 updates (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Update UV5 MMR references in UV GRU (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Update node present counting (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Update UV5 TSC checking (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Update for UV5 NMI MMR changes (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Update Copyrights to conform to HPE standards (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Fix missing OEM_TABLE_ID (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Remove spaces from OEM IDs (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Recognize UV5 hubless system identifier (Jack Vogel) [Orabug: 32651197]
- Revert x86/tlb/uv: Add a forward declaration for struct flush_tlb_info (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Drop last traces of uv_flush_tlb_others (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Fix copied UV5 output archtype (Jack Vogel) [Orabug: 32651197]
- Revert x86/platform/uv: Fix UV4 hub revision adjustment (Jack Vogel) [Orabug: 32651197]

[5.4.17-2102.200.11]
- mm/vmscan: fix infinite loop in drop_slab_node (Chunxin Zang) [Orabug: 32620155]
- scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [Orabug: 32603378] {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
- scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [Orabug: 32603378] {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
- scsi: iscsi: Report connection state in sysfs (Gabriel Krisman Bertazi) [Orabug: 32603378] {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
- sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output (Joe Perches) [Orabug: 32603378] {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
- scsi: iscsi: Restrict sessions and handles to admin capabilities (Lee Duncan) [Orabug: 32603378] {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
- drm/nouveau: bail out of nouveau_channel_new if channel init fails (Frantisek Hrbata) [Orabug: 32591559] {CVE-2020-25639}
- mm: support memblock alloc on the exact node for sparse_buffer_init() (Yunfeng Ye) [Orabug: 32613823]
- mm/sparse.c: do not waste pre allocated memmap space (Michal Hocko) [Orabug: 32613823]
- mm/sparse: consistently do not zero memmap (Vincent Whitchurch) [Orabug: 32613823]

[5.4.17-2102.200.10]
- scsi: target: core: Make completion affinity configurable (Mike Christie) [Orabug: 32403502]
- target: flush submission work during TMR processing (Mike Christie) [Orabug: 32403502]
- target iblock: add backend plug/unplug callouts (Mike Christie) [Orabug: 32403502]
- target: fix backend plugging (Mike Christie) [Orabug: 32403502]
- target: cleanup cmd flag bits (Mike Christie) [Orabug: 32403502]
- tcm loop: use lio wq cmd submission helper (Mike Christie) [Orabug: 32403502]
- tcm loop: use blk cmd allocator for se_cmds (Mike Christie) [Orabug: 32403502]
- vhost scsi: use lio wq cmd submission helper (Mike Christie) [Orabug: 32403502]
- target: add workqueue based cmd submission (Mike Christie) [Orabug: 32403502]
- target: add gfp_t arg to target_cmd_init_cdb (Mike Christie) [Orabug: 32403502]
- target: remove target_submit_cmd_map_sgls (Mike Christie) [Orabug: 32403502]
- tcm_fc: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- xen-scsiback: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- vhost-scsi: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- usb gadget: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- sbp_target: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- tcm_loop: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- qla2xxx: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- ibmvscsi_tgt: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- srpt: Convert to new submission API (Mike Christie) [Orabug: 32403502]
- target: break up target_submit_cmd_map_sgls (Mike Christie) [Orabug: 32403502]
- target: rename transport_init_se_cmd (Mike Christie) [Orabug: 32403502]
- target: drop kref_get_unless_zero in target_get_sess_cmd (Mike Christie) [Orabug: 32403502]
- target: move t_task_cdb initialization (Mike Christie) [Orabug: 32403502]
- scsi: tcm_loop: Allow queues, can_queue and cmd_per_lun to be settable (Mike Christie) [Orabug: 32403502]
- scsi: target: Make state_list per CPU (Mike Christie) [Orabug: 32403502]
- scsi: target

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 7 kernel-uek 0:5.4.17-2102.200.13.el8uek
Oracle Linux · 7 kernel-uek-debug 0:5.4.17-2102.200.13.el8uek
Oracle Linux · 7 kernel-uek-debug-devel 0:5.4.17-2102.200.13.el8uek
Oracle Linux · 7 kernel-uek-devel 0:5.4.17-2102.200.13.el8uek
Oracle Linux · 7 kernel-uek-doc 0:5.4.17-2102.200.13.el8uek
Oracle Linux · 7 kernel-uek-tools 0:5.4.17-2102.200.13.el7uek
Oracle Linux · 7 kernel-uek-tools-libs 0:5.4.17-2102.200.13.el7uek
Oracle Linux · 7 perf 0:5.4.17-2102.200.13.el7uek
Oracle Linux · 7 python-perf 0:5.4.17-2102.200.13.el7uek

Vulnerabilities 8