Summary
[4.18.0-513.9.1_9.OL8]
- media: dvb-core: Fix use-after-free due to race at dvb_register_device() (Mauro Carvalho Chehab) {CVE-2022-45884}
- cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) {CVE-2023-1192}
- nvmet-tcp: Fix a possible UAF in queue intialization setup (Sagi Grimberg) {CVE-2023-5178}
- net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
- bpf: Fix incorrect verifier pruning due to missing register precision taints (Daniel Borkmann) (Andrii Nakryiko) {CVE-2023-2163}
- media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (Hyunwoo Kim) {CVE-2022-45919}
- media: dvbdev: fix error logic at dvb_register_device() (Mauro Carvalho Chehab)
- media: dvbdev: Fix memleak in dvb_register_device (Dinghao Liu)
- media: dvb-core: Fix use-after-free due on race condition at dvb_net (Hyunwoo Kim} {CVE-2022-45886}
[4.18.0-513.5.1_9.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Drop not needed patch
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | perf | 0:4.18.0-513.9.1.el8_9 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-513.9.1.el8_9 |
Vulnerabilities 7
-
Critical 10.0CVE-2023-2163 Public exploit
Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation
Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.
-
High 8.8CVE-2023-5178 Public exploit
Kernel: use after free in nvmet_tcp_free_crypto in nvme
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…
-
High 7.8
Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags
An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate …
-
Medium 6.5
Use-after-free in smb2_is_status_io_timeout()
A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses …
-
Unscored —
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, relate…
-
Unscored —
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dv…
-
Unscored —
An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-fre…