Skip to content
OpenAdvisories
High ELSA-2022-10079 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

Published Dec 12, 2022 · Updated Dec 12, 2022

Summary

[5.4.17-2136.314.6.2]
- proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds) [Orabug: 34883034] {CVE-2022-4378}
- proc: avoid integer type confusion in get_proc_long (Linus Torvalds) [Orabug: 34883034] {CVE-2022-4378}

[5.4.17-2136.314.6.1]
- RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj (Jason Gunthorpe) [Orabug: 34859614]
- RDMA/uverbs: Do not discard the IB_EVENT_DEVICE_FATAL event (Jason Gunthorpe) [Orabug: 34859614]
- Adding a new sysfs entry point -- forcepower -- to /sys/bus/pci/slots/X. (James Puthukattukaran) [Orabug: 34859609]
- nvme: paring quiesce/unquiesce (Ming Lei) [Orabug: 34859609]
- nvme: prepare for pairing quiescing and unquiescing (Ming Lei) [Orabug: 34859609]
- nvme: apply nvme API to quiesce/unquiesce admin queue (Ming Lei) [Orabug: 34859609]
- nvme: add APIs for stopping/starting admin queue (Ming Lei) [Orabug: 34859609]
- nvme-fc: remove freeze/unfreeze around update_nr_hw_queues (James Smart) [Orabug: 34859609]
- nvme-fc: avoid race between time out and tear down (James Smart) [Orabug: 34859609]
- nvme-fc: update hardware queues before using them (Daniel Wagner) [Orabug: 34859609]
- nvme-fabrics: reject I/O to offline device (Victor Gladkov) [Orabug: 34859609]
- nvme-fc: wait for queues to freeze before calling update_hr_hw_queues (James Smart) [Orabug: 34859609]

[5.4.17-2136.314.6]
- RDMA/mlx5: Change debug log level for remote access error syndromes (Arumugam Kolappan) [Orabug: 34798452]
- KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID (Sean Christopherson) [Orabug: 34160613]
- KVM: x86: Track xAPIC ID only on userspace SET, _after_ vAPIC is updated (Sean Christopherson) [Orabug: 34160613]
- KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target (Sean Christopherson) [Orabug: 34160613]
- KVM: SVM: Flush the 'current' TLB when activating AVIC (Sean Christopherson) [Orabug: 34160613]
- KVM: x86: Purge 'highest ISR' cache when updating APICv state (Sean Christopherson) [Orabug: 34160613]
- KVM: SVM: Add AVIC doorbell tracepoint (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: x86: Warning APICv inconsistency only when vcpu APIC mode is valid (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Introduce hybrid-AVIC mode (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Do not throw warning when calling avic_vcpu_load on a running vcpu (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Introduce logic to (de)activate x2AVIC mode (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Refresh AVIC configuration when changing APIC mode (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: x86: Deactivate APICv on vCPU with APIC disabled (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Do not virtualize MSR accesses for APIC LVTT register (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Fix x2APIC MSRs interception (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Adding support for configuring x2APIC MSRs interception (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Do not support updating APIC ID when in x2APIC mode (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Compute dest based on sender's x2APIC status for AVIC kick (Sean Christopherson) [Orabug: 34160613]
- KVM: SVM: Update avic_kick_target_vcpus to support 32-bit APIC ID (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Update max number of vCPUs supported for x2AVIC mode (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Detect X2APIC virtualization (x2AVIC) support (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: x86: lapic: Rename [GET/SET]_APIC_DEST_FIELD to [GET/SET]_XAPIC_DEST_FIELD (Suravee Suthikulpanit) [Orabug: 34160613]
- x86/cpufeatures: Introduce x2AVIC CPUID bit (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: x86: Blindly get current x2APIC reg value on 'nodecode write' traps (Sean Christopherson) [Orabug: 34160613]
- KVM: x86: Bug the VM if an accelerated x2APIC trap occurs on a 'bad' reg (Sean Christopherson) [Orabug: 34160613]
- KVM: x86: Do not block APIC write for non ICR registers (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: x86: Add support for vICR APIC-write VM-Exits in x2APIC mode (Zeng Guang) [Orabug: 34160613]
- KVM: x86: disable preemption while updating apicv inhibition (Maxim Levitsky) [Orabug: 34160613]
- KVM: SVM: Fix x2APIC Logical ID calculation for avic_kick_target_vcpus_fast (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: x86: SVM: fix avic_kick_target_vcpus_fast (Maxim Levitsky) [Orabug: 34160613]
- KVM: x86: SVM: remove avic's broken code that updated APIC ID (Maxim Levitsky) [Orabug: 34160613]
- KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID 'change' if APIC is disabled (Sean Christopherson) [Orabug: 34160613]
- KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base (Maxim Levitsky) [Orabug: 34160613]
- KVM: x86: document AVIC/APICv inhibit reasons (Maxim Levitsky) [Orabug: 34160613]
- KVM: x86: SVM: allow to force AVIC to be enabled (Maxim Levitsky) [Orabug: 34160613]
- KVM: SVM: Introduce trace point for the slow-path of avic_kic_target_vcpus (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Use target APIC ID to complete AVIC IRQs when possible (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: SVM: Do not activate AVIC for SEV-enabled guest (Suravee Suthikulpanit) [Orabug: 34160613]
- KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race (Sean Christopherson) [Orabug: 34160613]
- KVM: x86: Trace all APICv inhibit changes and capture overall status (Sean Christopherson) [Orabug: 34160613]
- KVM: x86: Add wrappers for setting/clearing APICv inhibits (Sean Christopherson) [Orabug: 34160613]
- KVM: x86: Make APICv inhibit reasons an enum and cleanup naming (Sean Christopherson) [Orabug: 34160613]
- KVM: SVM: fix panic on out-of-bounds guest IRQ (Yi Wang) [Orabug: 34160613]
- KVM: SVM: Allow AVIC support on system w/ physical APIC ID > 255 (Surav

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 7 kernel-uek 0:5.4.17-2136.314.6.2.el8uek
Oracle Linux · 7 kernel-uek-debug 0:5.4.17-2136.314.6.2.el8uek
Oracle Linux · 7 kernel-uek-debug-devel 0:5.4.17-2136.314.6.2.el8uek
Oracle Linux · 7 kernel-uek-devel 0:5.4.17-2136.314.6.2.el8uek
Oracle Linux · 7 kernel-uek-doc 0:5.4.17-2136.314.6.2.el8uek
Oracle Linux · 7 kernel-uek-tools 0:5.4.17-2136.314.6.2.el7uek
Oracle Linux · 7 kernel-uek-tools-libs 0:5.4.17-2136.314.6.2.el7uek
Oracle Linux · 7 perf 0:5.4.17-2136.314.6.2.el7uek
Oracle Linux · 7 python-perf 0:5.4.17-2136.314.6.2.el7uek

Vulnerabilities 3