Summary
[4.1.12-124.81.2]
- rebuild bumping release
[4.1.12-124.81.1]
- netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [Orabug: 35923500] {CVE-2023-39193}
- USB: ene_usb6250: Allocate enough memory for full object (Kees Cook) [Orabug: 35924058] {CVE-2023-45862}
- netfilter: xt_u32: validate user space input (Wander Lairson Costa) [Orabug: 35923470] {CVE-2023-39192}
- net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35707466] {CVE-2023-4207}
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:4.1.12-124.81.2.el7uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:4.1.12-124.81.2.el7uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:4.1.12-124.81.2.el7uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:4.1.12-124.81.2.el7uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:4.1.12-124.81.2.el7uek |
| Oracle Linux · 7 | kernel-uek-firmware | 0:4.1.12-124.81.2.el7uek |
Vulnerabilities 4
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of th…
-
Medium 6.7
Kernel: netfilter: xtables out-of-bounds read in u32_match_it()
A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyon…
-
Medium 6.1
Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosu…
-
Unscored —
An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before…