Summary
[4.18.0-513.5.1_9.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Drop not needed patch
[4.18.0-513.5.1_9]
- redhat: list Z-Jiras in the changelog before Y-Jiras (Herton R. Krzesinski)
- Revert 'mm, meminit: recalculate pcpu batch and high limits after init completes' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm,memory_hotplug: factor out adjusting present pages into adjust_present_page_count()' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: move free_the_page' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: allow high-order pages to be stored on the per-cpu lists' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: fetch the correct pcp buddy during bulk free' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: track range of active PCP lists during bulk free' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: simplify how many pages are selected per pcp list during bulk free' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: drain the requested list first during bulk free' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: free pages in a single pass during bulk free' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: do not prefetch buddies during bulk free' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: check high-order pages for corruption during PCP operations' (Chris von Recklinghausen) [RHEL-8539]
- Revert 'mm/page_alloc: fix incorrect PGFREE and PGALLOC for high-order page' (Chris von Recklinghausen) [RHEL-8539]
[4.18.0-513.4.1_9]
- Revert 'cnic: Use the bitmap API to allocate bitmaps' (Chris Leech) [RHEL-1950]
- Revert 'cnic: don't pass bogus GFP_ flags to dma_alloc_coherent' (Chris Leech) [RHEL-1950]
- scsi: lpfc: Prevent use-after-free during rmmod with mapped NVMe rports (Paul Ely) [RHEL-2602]
- scsi: lpfc: Early return after marking final NLP_DROPPED flag in dev_loss_tmo (Paul Ely) [RHEL-2602]
- gfs2: Add quota_change type (Bob Peterson) [2224075]
[4.18.0-513.3.1_9]
- drm/amd/display: fix the white screen issue when >= 64GB DRAM (Mika Penttila) [2231934]
- gfs2: conversion deadlock do_promote bypass (Bob Peterson) [2225228]
- gfs2: do_promote cleanup (Andreas Gruenbacher) [2225228]
- gfs2: Make use of list_is_first (Andreas Gruenbacher) [2225228]
[4.18.0-513.2.1_9]
- x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled (Waiman Long) [2227916]
- Documentation/hw-vuln: Document the interaction between IBRS and STIBP (Waiman Long) [2227916]
- x86/CPU/AMD: Make sure EFER[AIBRSE] is set (Waiman Long) [2227916]
- fs: don't audit the capability check in simple_xattr_list() (Andrey Albershteyn) [RHEL-863]
[4.18.0-513.1.1_9]
- thunderbolt: Fix Thunderbolt 3 display flickering issue on 2nd hot plug onwards (Desnes Nunes) [2233974]
- mm/userfaultfd: don't consider uffd-wp bit of writable migration entries (Rafael Aquini) [2231554]
- mm/userfaultfd: fix uffd-wp handling for THP migration entries (Rafael Aquini) [2231554]
- mm/userfaultfd: fix uffd-wp special cases for fork() (Rafael Aquini) [2231554]
- mm/thp: simplify copying of huge zero page pmd when fork (Rafael Aquini) [2231554]
[4.18.0-513]
- redhat/configs: enable CONFIG_INET_DIAG_DESTROY (Andrea Claudi) [2230213]
- net/sched: cls_u32: Fix reference counter leak leading to overflow (Davide Caratti) [2225202] {CVE-2023-3609}
- cifs: fix bogus cifs_mount error handling in RHEL8 (Jeffrey Layton) [2215018]
- KVM: nVMX: add missing consistency checks for CR0 and CR4 (Ricardo Robaina) [2190257] {CVE-2023-30456}
- netfilter: snat: evict closing tcp entries on reply tuple collision (Florian Westphal) [2196717]
- tun: avoid double free in tun_free_netdev (Jon Maloy) [2156366 2156371] {CVE-2022-4744}
- net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225103] {CVE-2023-3776}
- net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Davide Caratti) [2225196] {CVE-2023-3611}
- net/sched: sch_qfq: reintroduce lmax bound check for MTU (Davide Caratti) [2225196]
- net/sched: sch_qfq: refactor parsing of netlink parameters (Davide Caratti) [2225196]
- net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128}
- net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128}
- net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128}
- scsi: lpfc: Remove reftag check in DIF paths (Paul Ely) [2229152]
- scsi: lpfc: Modify when a node should be put in device recovery mode during RSCN (Paul Ely) [2229152]
- scsi: lpfc: Make fabric zone discovery more robust when handling unsolicited LOGO (Paul Ely) [2229152]
- scsi: lpfc: Set Establish Image Pair service parameter only for Target Functions (Paul Ely) [2229152]
- scsi: lpfc: Revise ndlp kref handling for dev_loss_tmo_callbk and lpfc_drop_node (Paul Ely) [2229152]
- scsi: lpfc: Qualify ndlp discovery state when processing RSCN (Paul Ely) [2229152]
- gfs2: Fix freeze consistency check in gfs2_trans_add_meta (Andreas Gruenbacher) [2095340]
- gfs2: gfs2_freeze_lock_shared cleanup (Andreas Gruenbacher) [2095340]
- gfs2: Replace sd_freeze_state with SDF_FROZEN flag (Andreas Gruenbacher) [2095340]
- gfs2: Rework freeze / thaw logic (Andreas Gruenbacher) [2095340]
- gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} (Andreas Gruenbacher) [2095340]
- gfs2: Reconfiguring frozen filesystem already rejected (Andreas Gruenbacher) [2095340]
- gfs2: Rename gfs2_freeze_lock{ => _shared } (Andreas Gruenbache
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | perf | 0:4.18.0-513.5.1.el8_9 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-513.5.1.el8_9 |
Vulnerabilities 53
-
High 7.8
A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the devi…
-
High 7.8
A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user det…
-
High 7.8
A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations s…
-
High 7.8
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax ca…
-
High 7.8CVE-2023-3609 Public exploit
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the refe…
-
High 7.8
Out-of-bounds write in Linux kernel's net/sched: sch_qfq component
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated accordin…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_route component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instanc…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of th…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of …
-
High 7.1
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…
-
High 7.1
An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c …
-
High 7.0
Kernel: use after free bug in btsdio_remove due to race condition
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/medi…
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/…
-
Medium 6.8
A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconn…
-
Medium 6.7
A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode si…
-
Medium 6.7CVE-2023-28772 Public exploit
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
-
Medium 6.7
Kernel: vmwgfx: race condition leading to information disclosure vulnerability
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to…
-
Medium 6.7
Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which m…
-
Medium 6.6
A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…
-
Medium 6.5
Information exposure through microarchitectural state after transient execution in certain vector execution units for s…
-
Medium 6.5
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency…
-
Medium 6.4
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/e…
-
Medium 6.3
There is an UAF vulnerability in vmwgfx driver
A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…
-
Medium 6.3
There is an UAF vulnerability in vmwgfx driver
A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account …
-
Medium 6.3
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 5.5
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
-
Medium 5.5
Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free
A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a pat…
-
Medium 5.5
A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial o…
-
Medium 5.5
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the…
-
Medium 5.5
A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a us…
-
Medium 5.5
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service b…
-
Medium 5.5
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kerne…
-
Medium 5.5
An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation…
-
Medium 5.5
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height gr…
-
Medium 5.5
Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …
-
Medium 5.5
Kernel: smsusb: use-after-free caused by do_submit_urb()
A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.
-
Medium 5.3
Linux Kernel BPF r8152.c intr_callback logging of excessive data
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The att…
-
Medium 5.3
Spectre V1 Gadget in do_prlimit in the Linux Kernel
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…
-
Medium 5.3
Sev-es / sev-snp vmgexit double fetch vulnerability
A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker…
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
Medium 4.7
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak be…
-
Medium 4.7
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads t…
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
-
Medium 4.7
Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h
A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.
-
Low 3.3
A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessin…
-
Unscored —
In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_ut…
-
Unscored —
A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This f…
-
Unscored —CVE-2023-1206 Public exploit
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a use…
-
Unscored —
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file …
-
Unscored —CVE-2023-35825 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3141. Reason: This candidate is a reservation duplicate of CVE-2…
-
Unscored —
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…