High ELSA-2022-9425 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

Published May 24, 2022 · Updated May 24, 2022

Ecosystem: Oracle Linux

Summary

[5.4.17-2136.307.3.4]
- io_uring: always use original task when preparing req identity (Jens Axboe) [Orabug: 34186552] {CVE-2022-1786}

[5.4.17-2136.307.3.3]
- debug: Lock down kgdb (Stephen Brennan) [Orabug: 34152699] {CVE-2022-21499}

Fixed packages 9

Release	Package	Fixed in
Oracle Linux · 7	kernel-uek	0:5.4.17-2136.307.3.4.el8uek
Oracle Linux · 7	kernel-uek-debug	0:5.4.17-2136.307.3.4.el8uek
Oracle Linux · 7	kernel-uek-debug-devel	0:5.4.17-2136.307.3.4.el8uek
Oracle Linux · 7	kernel-uek-devel	0:5.4.17-2136.307.3.4.el8uek
Oracle Linux · 7	kernel-uek-doc	0:5.4.17-2136.307.3.4.el8uek
Oracle Linux · 7	kernel-uek-tools	0:5.4.17-2136.307.3.4.el7uek
Oracle Linux · 7	kernel-uek-tools-libs	0:5.4.17-2136.307.3.4.el7uek
Oracle Linux · 7	perf	0:5.4.17-2136.307.3.4.el7uek
Oracle Linux · 7	python-perf	0:5.4.17-2136.307.3.4.el7uek

Vulnerabilities 2

Medium 6.7

CVE-2022-21499

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…

Oracle Oracle Linux Oracle VM linux-raspi2 Linux Debian Ubuntu

Jun 9, 2022
Unscored —

CVE-2022-1786

A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_S…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 31, 2022