Skip to content
OpenAdvisories
High ELSA-2023-7423 7 CVEs

Important: kernel security update (Oracle Linux 7)

Published Nov 22, 2023 · Updated Nov 22, 2023

Ecosystem: Oracle Linux

Summary

[3.10.0-1160.105.1.0.1.OL7]
- debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499}

[3.10.0-1160.105.1.OL7]
- Update Oracle Linux certificates (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15-2.0.9
- Update oracle(kernel-sig-key) value to match new certificate (Ilya Okomin)

[3.10.0-1160.105.1]
- net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}
- net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}
- net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}

[3.10.0-1160.104.1]
- CI: Remove unused kpet_tree_family (Nikolai Kondrashov)
- xen/x86: don't lose event interrupts (Vitaly Kuznetsov) [RHEL-1534]
- Documentation/x86: Fix backwards on/off logic about YMM support (Waiman Long) [2229893] {CVE-2022-40982}
- KVM: Add GDS_NO support to KVM (Waiman Long) [2229893] {CVE-2022-40982}
- x86/speculation: Add Kconfig option for GDS (Waiman Long) [2229893] {CVE-2022-40982}
- x86/speculation: Add force option to GDS mitigation (Waiman Long) [2229893] {CVE-2022-40982}
- x86/speculation: Add Gather Data Sampling mitigation (Waiman Long) [2229893] {CVE-2022-40982}
- Documentation/ABI: Mention retbleed vulnerability info file for sysfs (Waiman Long) [2229893]
- docs/kernel-parameters: Update descriptions for 'mitigations=' param with retbleed (Waiman Long) [2229893]
- x86/speculation: Add missing srbds=off to the mitigations= help text (Waiman Long) [2229893]
- x86: Sync Intel family names & cpu_vuln_blacklist[] with upstream (Waiman Long) [2229893]

[3.10.0-1160.103.1]
- net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Davide Caratti) [2225555] {CVE-2023-3611}
- net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Davide Caratti) [2225555]
- net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225639] {CVE-2023-3776}
- redhat: fix to be able to build with rpm 4.19.0 (Denys Vlasenko)

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 7 bpftool 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-abi-whitelists 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-debug 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-debug-devel 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-devel 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-doc 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-headers 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-tools 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-tools-libs 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 kernel-tools-libs-devel 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 perf 0:3.10.0-1160.105.1.0.1.el7
Oracle Linux · 7 python-perf 0:3.10.0-1160.105.1.0.1.el7

Vulnerabilities 7

  • High 7.8
    CVE-2023-3611

    Out-of-bounds write in Linux kernel's net/sched: sch_qfq component

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated accordin…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-3776 Public exploit

    Use-after-free in Linux kernel's net/sched: cls_fw component

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the refere…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-4206

    Use-after-free in Linux kernel's net/sched: cls_route component

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instanc…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-4207

    Use-after-free in Linux kernel's net/sched: cls_fw component

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of th…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-4208

    Use-after-free in Linux kernel's net/sched: cls_u32 component

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of …

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2022-40982

    Information exposure through microarchitectural state after transient execution in certain vector execution units for s…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Alpine
  • Unscored —
    CVE-2023-4128 Public exploit Rejected

    ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu