Summary
[4.14.35-2047.522.3]
- ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC (Sasha Levin) [Orabug: 34653896] {CVE-2022-3303}
- net/rds: Fill in rds_exthdr_size gaps (Gerd Rausch) [Orabug: 34979172]
- net/rds: Trigger rds_send_hs_ping() more than once (Gerd Rausch) [Orabug: 34607787]
- Revert 'RDS: TCP: Track peer's connection generation number' (Gerd Rausch) [Orabug: 34700111]
- net/rds: Use the first lane until RDS_EXTHDR_NPATHS arrives (Gerd Rausch) [Orabug: 28720880]
- net/rds: Kick-start TCP receiver after accept (Gerd Rausch) [Orabug: 34600821]
- net/rds: rds_tcp_conn_path_shutdown must not discard messages (Gerd Rausch) [Orabug: 34560682]
- net/rds: Encode cp_index in TCP source port (Gerd Rausch) [Orabug: 34556027]
[4.14.35-2047.522.2]
- tcp: fix ambiguity for SACKed TLP retransmits with RTT < min_rtt (Neal Cardwell) [Orabug: 34961109]
- vhost-scsi: Fix max number of virtqueues (Mike Christie) [Orabug: 34915131]
- net/rds: drop rs_transport module reference count on error (Gerd Rausch) [Orabug: 34500808]
- scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (Gulam Mohamed) [Orabug: 34306796]
- IB/mlx5: Add a signature check to received EQEs and CQEs (Rohit Nair) [Orabug: 34105979]
- net/rds: rds_tcp_accept_one ought to not discard messages (Gerd Rausch) [Orabug: 34488377]
- net/rds: No shortcut out of RDS_CONN_ERROR (Gerd Rausch) [Orabug: 34276065]
- net/rds: Don't force state RDS_CONN_RESETTING (Gerd Rausch) [Orabug: 34276065]
- net/rds: Preserve essential connection state flags (Gerd Rausch) [Orabug: 34276065]
[4.14.35-2047.522.1]
- uek-rpm: ol7: Add enhanced kABI diagnostics (Stephen Brennan) [Orabug: 34879138]
- uek-rpm: ol7: Add Symtypes files (Stephen Brennan) [Orabug: 34879138]
- uek-rpm: ol7: Enable creation of Symtypes files (Stephen Brennan) [Orabug: 34879138]
- uek-rpm: Add kabi tool and documentation (Stephen Brennan) [Orabug: 34879138]
- xfs: don't reuse busy extents on extent trim (Brian Foster) [Orabug: 34605583]
- RDMA/ucma: Put a lock around every call to the rdma_cm layer (Jason Gunthorpe) [Orabug: 34106064]
- LTS version: v4.14.302 (Saeed Mirzamohammadi)
- net: mvneta: Fix an out of bounds check (Dan Carpenter)
- ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet)
- net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() (Yang Yingliang)
- ethernet: aeroflex: fix potential skb leak in greth_init_rings() (Zhang Changzhong)
- tipc: Fix potential OOB in tipc_link_proto_rcv() (YueHaibing)
- net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (Liu Jian)
- net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (Liu Jian)
- net: stmmac: fix 'snps,axi-config' node property parsing (Jisheng Zhang)
- NFC: nci: Bounds check struct nfc_target arrays (Kees Cook)
- net: mvneta: Prevent out of bounds read in mvneta_config_rss() (Dan Carpenter)
- net: encx24j600: Fix invalid logic in reading of MISTAT register (Valentina Goncharenko)
- net: encx24j600: Add parentheses to fix precedence (Valentina Goncharenko)
- mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun)
- Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() (Wang ShaoBo)
- igb: Allocate MSI-X vector when testing (Akihiko Odaki)
- e1000e: Fix TX dispatch condition (Akihiko Odaki)
- gpio: amd8111: Fix PCI device reference count leak (Xiongfeng Wang)
- ca8210: Fix crash by zero initializing data (Hauke Mehrtens)
- ieee802154: cc2520: Fix error return code in cc2520_hw_init() (Ziyang Xuan)
- HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng)
- HID: hid-lg4ff: Add check for empty lbuf (Anastasia Belova)
- KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth)
- memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo)
- media: v4l2-dv-timings.c: fix too strict blanking sanity checks (Hans Verkuil)
- xen/netback: do some code cleanup (Juergen Gross)
- net: usb: qmi_wwan: add u-blox 0x1342 composition (Davide Tronchin)
- regulator: twl6030: fix get status of twl6032 regulators (Andreas Kemnade)
- ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu)
- ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook)
- ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 (Johan Jonker)
- ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation (Giulio Benetti)
- ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels (Tomislav Novak)
- ARM: dts: rockchip: fix ir-receiver node names (Johan Jonker)
- arm: dts: rockchip: fix node name for hym8563 rtc (Sebastian Reichel)
- LTS version: v4.14.301 (Saeed Mirzamohammadi)
- ipc/sem: Fix dangling sem_array access in semtimedop race (Jann Horn)
- v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails (Linus Torvalds)
- mmc: sdhci: Fix voltage switch delay (Adrian Hunter)
- mmc: sdhci: use FIELD_GET for preset value bit masks (Masahiro Yamada)
- x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (Michael Kelley)
- Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz) {CVE-2022-42896}
- x86/pm: Add enumeration check before spec MSRs save/restore setup (Saeed Mirzamohammadi)
- nvme: restrict management ioctls to admin (Keith Busch)
- tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima) [Orabug: 34719346] {CVE-2022-3524}
- iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang)
- pinctrl: single: Fix potential division by zero (Maxim Korotkov)
- ASoC: ops: Fix bounds check for _sx controls (Mark Brown)
- efi: random: Properly limit the size of the random seed (Ben Hutchings)
- nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng)
- tools/vm/slabinfo-gnuplot: use 'grep -E' instead of 'egrep' (Tiezhu Yang)
- btrfs: qgroup: fix sleep from invalid context bug
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek-container | 0:4.14.35-2047.522.3.el7 |
Vulnerabilities 5
-
High 8.0CVE-2022-42896 Public exploit
Info Leak in l2cap_core in the Linux Kernel
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker coul…
-
Medium 5.5
Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free
A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a pat…
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
Medium 4.7
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL po…
-
Medium 4.3
Linux Kernel IPv6 ipv6_renew_options memory leak
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is …