Summary
[5.15.0-201.135.6]
- Revert ncsi: Propagate carrier gain/loss events to the NCSI controller (Johnathan Mantey)
- netfilter: nf_tables: split async and sync catchall in two functions (Pablo Neira Ayuso)
- netfilter: nf_tables: remove catchall element in GC sync path (Pablo Neira Ayuso)
- scsi: mpt3sas: Fix loop logic (Ranjan Kumar)
- Revert 'md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d' (Junxiao Bi) [Orabug: 36050011]
- md: bypass block throttle for superblock update (Junxiao Bi) [Orabug: 36050011]
- tracing: Have trace_event_file have ref counters (Steven Rostedt (Google)) [Orabug: 36059972]
- Revert 'PCI: acpiphp: Reassign resources on bridge if necessary' (Dongli Zhang) [Orabug: 36039006]
- Revert 'PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus' (Dongli Zhang) [Orabug: 36039006]
- audit: Apply special optimizations (Hakon Bugge) [Orabug: 36038149]
- audit: Vary struct audit_entry alignment (Hakon Bugge) [Orabug: 36038149]
- Revert 'Revert 'printk: Consolidate console deferred printing'' (Hakon Bugge) [Orabug: 36038149]
[5.15.0-201.135.5]
- media: dvb-usb-v2: af9035: fix missing unlock (Hans Verkuil)
- i2c: aspeed: Fix i2c bus hang in slave read (Jian Zhang)
- i40e: Fix I40E_FLAG_VF_VLAN_PRUNING value (Ivan Vecera)
- firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() (Hao Ge)
- virtio-mmio: fix memory leak of vm_dev (Maximilian Heyne)
- NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Olga Kornievskaia)
- net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Pedro Tammela)
- Revert 'kernel/sched: Modify initial boot task idle setup' (Greg Kroah-Hartman)
- usb: cdns3: Modify the return value of cdns_set_active () to void when CONFIG_PM_SLEEP is disabled (Xiaolei Wang)
- quota: Fix slow quotaoff (Jan Kara)
- lib/test_meminit: fix off-by-one error in test_pages() (Greg Kroah-Hartman)
- nvmet-tcp: Fix a possible UAF in queue intialization setup (Sagi Grimberg) [Orabug: 36028025] {CVE-2023-5178}
[5.15.0-201.135.4]
- uek-rpm: Enable PDS_CORE and PDS_VFIO drivers (Joao Martins) [Orabug: 35424097]
- pds_core: use correct index to mask irq (Shannon Nelson) [Orabug: 35424097]
- amd/pds_core: core: No need for Null pointer check before kfree (Bragatheswaran Manickavel) [Orabug: 35424097]
- pds_core: add an error code check in pdsc_dl_info_get (Su Hui) [Orabug: 35424097]
- pds_core: devlink health: use retained error fmsg API (Przemek Kitszel) [Orabug: 35424097]
- pds_core: add attempts to fix broken PCI (Shannon Nelson) [Orabug: 35424097]
- pds_core: implement pci reset handlers (Shannon Nelson) [Orabug: 35424097]
- pds_core: keep viftypes table across reset (Shannon Nelson) [Orabug: 35424097]
- pds_core: check health in devcmd wait (Shannon Nelson) [Orabug: 35424097]
- vfio/pds: Use proper PF device access helper (Shixiong Ou) [Orabug: 35424097]
- vfio/pds: Add missing PCI_IOV depends (Shixiong Ou) [Orabug: 35424097]
- pds_core: pass opcode to devcmd_wait (Shannon Nelson) [Orabug: 35424097]
- pds_core: check for work queue before use (Shannon Nelson) [Orabug: 35424097]
- pds_core: no reset command for VF (Shannon Nelson) [Orabug: 35424097]
- pds_core: no health reporter in VF (Shannon Nelson) [Orabug: 35424097]
- pds_core: protect devlink callbacks from fw_down state (Shannon Nelson) [Orabug: 35424097]
- vfio/pds: Send type for SUSPEND_STATUS command (Brett Creeley) [Orabug: 35424097]
- Revert 'pds_core: Fix some kernel-doc comments' (Jakub Kicinski) [Orabug: 35424097]
- pds_core: Fix some kernel-doc comments (Yang Li) [Orabug: 35424097]
- pds_core: remove redundant pci_clear_master() (Yu Liao) [Orabug: 35424097]
- vfio/pds: fix return value in pds_vfio_get_lm_file() (Yang Yingliang) [Orabug: 35424097]
- pds_core: Fix function header descriptions (Brett Creeley) [Orabug: 35424097]
- vfio/pds: Add Kconfig and documentation (Brett Creeley) [Orabug: 35424097]
- vfio/pds: Add support for firmware recovery (Brett Creeley) [Orabug: 35424097]
- vfio/pds: Add support for dirty page tracking (Brett Creeley) [Orabug: 35424097]
- vfio/pds: Add VFIO live migration support (Brett Creeley) [Orabug: 35424097]
- vfio/pds: register with the pds_core PF (Brett Creeley) [Orabug: 35424097]
- pds_core: Require callers of register/unregister to pass PF drvdata (Brett Creeley) [Orabug: 35424097]
- vfio/pds: Initial support for pds VFIO driver (Brett Creeley) [Orabug: 35424097]
- vfio: Commonize combine_ranges for use in other VFIO drivers (Brett Creeley) [Orabug: 35424097]
- pds_core: Fix documentation for pds_client_register (Brett Creeley) [Orabug: 35424097]
- pds_core: Fix FW recovery detection (Brett Creeley) [Orabug: 35424097]
- pds_core: fix mutex double unlock in error path (Shannon Nelson) [Orabug: 35424097]
- pds_core: add AUXILIARY_BUS and NET_DEVLINK to Kconfig (Shannon Nelson) [Orabug: 35424097]
- pds_core: remove CONFIG_DEBUG_FS from makefile (Shannon Nelson) [Orabug: 35424097]
- pds_core: Kconfig and pds_core.rst (Shannon Nelson) [Orabug: 35424097]
- pds_core: publish events to the clients (Shannon Nelson) [Orabug: 35424097]
- pds_core: add the aux client API (Shannon Nelson) [Orabug: 35424097]
- pds_core: devlink params for enabling VIF support (Shannon Nelson) [Orabug: 35424097]
- pds_core: add auxiliary_bus devices (Shannon Nelson) [Orabug: 35424097]
- pds_core: add initial VF device handling (Shannon Nelson) [Orabug: 35424097]
- pds_core: set up the VIF definitions and defaults (Shannon Nelson) [Orabug: 35424097]
- pds_core: add FW update feature to devlink (Shannon Nelson) [Orabug: 35424097]
- pds_core: Add adminq processing and commands (Shannon Nelson) [Orabug: 35424097]
- pds_core: set up device and adminq (Shannon Nelson) [Orabug: 35424097]
- pds_core: add devlink health facilities (Shannon Nelson) [Orabug: 35424097]
- pds_core: health timer and workqueue (Shannon Nelson) [Orabug: 35424097]
- pds_core: add devcmd device interfaces (Shannon Nelso
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-container | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-container-debug | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-core | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-debug | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-core | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-devel | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules-extra | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-devel | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-doc | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-modules | 0:5.15.0-201.135.6.el9uek |
| Oracle Linux · 8 | kernel-uek-modules-extra | 0:5.15.0-201.135.6.el9uek |
Vulnerabilities 10
-
High 8.8CVE-2023-5178 Public exploit
Kernel: use after free in nvmet_tcp_free_crypto in nvme
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it …
-
High 7.8
Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component
A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…
-
High 7.8
Use-after-free in Linux kernel's net/sched: sch_qfq component
A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue()…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recomm…
-
Medium 6.7
A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this f…
-
Medium 6.0
Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs
A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.
-
Medium 5.5
Kernel: integer overflow in igmpv3_newpack leading to exploitable memory access
An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.
-
Medium 4.4
Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap
A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the syst…
-
Unscored —
An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3…