Summary
[4.14.35-2047.507.7.5]
- Bluetooth: defer cleanup of resources in hci_unregister_dev() (Tetsuo Handa) [Orabug: 33369947] {CVE-2021-3573}
- Bluetooth: use correct lock to prevent UAF of hdev object (Lin Ma) [Orabug: 33369947]
- Bluetooth: fix the erroneous flush_work() order (Lin Ma) [Orabug: 33369947] {CVE-2021-3564}
- ext4: fix race writing to an inline_data file while its xattrs are changing (Theodore Ts'o) [Orabug: 33369956] {CVE-2021-40490}
- fuse: fix bad inode (Miklos Szeredi) [Orabug: 33369955] {CVE-2020-36322}
- tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. (Haoran Luo) [Orabug: 33369954] {CVE-2021-3679}
- virtio_console: Assure used length from device is limited (Xie Yongji) [Orabug: 33369953] {CVE-2021-38160}
- sctp: validate from_addr_param return (Marcelo Ricardo Leitner) [Orabug: 33369952] {CVE-2021-3655}
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | kernel-uek-headers | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | kernel-uek-tools | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | kernel-uek-tools-libs | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | kernel-uek-tools-libs-devel | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | perf | 0:4.14.35-2047.507.7.5.el7uek |
| Oracle Linux · 7 | python-perf | 0:4.14.35-2047.507.7.5.el7uek |
Vulnerabilities 7
-
Unscored —
An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. …
-
Unscored —
A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user …
-
Unscored —
A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls i…
-
Unscored —
A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP …
-
Unscored —CVE-2021-3679 Public exploit
A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the …
-
Unscored —
In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untr…
-
Unscored —
A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux ke…