Summary
[5.14.0-503.19.1_5.OL9]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
[5.14.0-503.19.1_5]
- xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66462 RHEL-66461] {CVE-2024-50142}
- xfrm: fix one more kernel-infoleak in algo dumping (CKI Backport Bot) [RHEL-65960] {CVE-2024-50110}
- Revert 'Merge: [qed] softlockup triggered by ethtool -d [rhel-9.5.z]' (Lucas Zampieri) [RHEL-61705]
- tracing/hwlat: Fix a race during cpuhp processing (Tomas Glozar) [RHEL-69468]
- tracing/timerlat: Fix a race during cpuhp processing (Tomas Glozar) [RHEL-69468] {CVE-2024-49866}
- tracing/timerlat: Drop interface_lock in stop_kthread() (Tomas Glozar) [RHEL-69468]
- tracing/timerlat: Fix duplicated kthread creation due to CPU online/offline (Tomas Glozar) [RHEL-69468]
- ceph: remove the incorrect Fw reference check when dirtying pages (Xiubo Li) [RHEL-61416 RHEL-60255]
[5.14.0-503.18.1_5]
- bpf: Fix a kernel verifier crash in stacksafe() (CKI Backport Bot) [RHEL-66097 RHEL-66098] {CVE-2024-45020}
- bpf: Fix a sdiv overflow issue (CKI Backport Bot) [RHEL-64598 RHEL-64597] {CVE-2024-49888}
- bpf: Fix out-of-bounds write in trie_get_next_key() (CKI Backport Bot) [RHEL-66877] {CVE-2024-50262}
- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() (CKI Backport Bot) [RHEL-63331] {CVE-2024-47675}
- nfsd: ensure that nfsd4_fattr_args.context is zeroed out (Jay Shin) [RHEL-58884 RHEL-58883] {CVE-2024-46697}
- KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (Jon Maloy) [RHEL-65872] {CVE-2024-50115}
- net: tighten bad gso csum offset check in virtio_net_hdr (Guillaume Nault) [RHEL-67683]
- udp: fix receiving fraglist GSO packets (Guillaume Nault) [RHEL-67683]
- Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs (CKI Backport Bot) [RHEL-66804] {CVE-2024-50255}
- Bluetooth: ISO: Fix UAF on iso_sock_timeout (Bastien Nocera) [RHEL-66321] {CVE-2024-50124}
- Bluetooth: SCO: Fix UAF on sco_sock_timeout (Bastien Nocera) [RHEL-65928] {CVE-2024-50125}
- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (Bastien Nocera) [RHEL-65928] {CVE-2024-27398}
- bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CKI Backport Bot) [RHEL-44173] {CVE-2024-38564}
- Bluetooth: bnep: fix wild-memory-access in proto_unregister (CKI Backport Bot) [RHEL-66365] {CVE-2024-50148}
- Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CKI Backport Bot) [RHEL-57716 RHEL-36374] {CVE-2024-27399}
[5.14.0-503.17.1_5]
- arm64: probes: Remove broken LDR (literal) uprobe support (CKI Backport Bot) [RHEL-66046] {CVE-2024-50099}
- qed: put cond_resched() in qed_dmae_operation_wait() (Michal Schmidt) [RHEL-61705 RHEL-6372]
- qed: allow the callee of qed_mcp_nvm_read() to sleep (Michal Schmidt) [RHEL-61705 RHEL-6372]
- qed: put cond_resched() in qed_grc_dump_ctx_data() (Michal Schmidt) [RHEL-61705 RHEL-6372]
- qed: make 'ethtool -d' 10 times faster (Michal Schmidt) [RHEL-61705 RHEL-6372]
- qed: allow sleep in qed_mcp_trace_dump() (Michal Schmidt) [RHEL-61705 RHEL-6372]
- sched/numa: Fix the potential null pointer dereference in task_numa_work() (CKI Backport Bot) [RHEL-66810] {CVE-2024-50223}
- irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66969] {CVE-2024-50192}
- irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66969] {CVE-2024-50192}
- perf/x86/intel/uncore: Support HBM and CXL PMON counters (Michael Petlan) [RHEL-65856]
- perf/x86/uncore: Cleanup unused unit structure (Michael Petlan) [RHEL-65856]
- perf/x86/uncore: Apply the unit control RB tree to PCI uncore units (Michael Petlan) [RHEL-65856]
- perf/x86/uncore: Apply the unit control RB tree to MSR uncore units (Michael Petlan) [RHEL-65856]
- perf/x86/uncore: Apply the unit control RB tree to MMIO uncore units (Michael Petlan) [RHEL-65856]
- perf/x86/uncore: Retrieve the unit ID from the unit control RB tree (Michael Petlan) [RHEL-65856]
- perf/x86/uncore: Support per PMU cpumask (Michael Petlan) [RHEL-65856]
- perf/x86/uncore: Save the unit control address of all units (Michael Petlan) [RHEL-65856]
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bpftool | 0:7.4.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | kernel-uki-virt-addons | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | libperf | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | perf | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | rtla | 0:5.14.0-503.19.1.el9_5 |
| Oracle Linux · 9 | rv | 0:5.14.0-503.19.1.el9_5 |
Vulnerabilities 17
-
Critical 9.8
nfsd: ensure that nfsd4_fattr_args.context is zeroed out
In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.context will be set to u…
-
High 8.4
KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Ignore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus V…
-
High 8.0
Bluetooth: ISO: Fix UAF on iso_sock_timeout
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix UAF on iso_sock_timeout conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock so this checks if the conn->sk is still valid by checking if it part of iso…
-
High 8.0
Bluetooth: SCO: Fix UAF on sco_sock_timeout
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_sock_timeout conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sco…
-
High 7.8
bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_cre…
-
High 7.8
bpf: Fix a kernel verifier crash in stacksafe()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory…
-
High 7.8
bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() If bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the error_free label and frees the array of bpf_uprobe's without ca…
-
High 7.8
bpf: Fix out-of-bounds write in trie_get_next_key()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when…
-
High 7.3
arm64: probes: Remove broken LDR (literal) uprobe support
In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR (literal) uprobe support The simulate_ldr_literal() and simulate_ldrsw_literal() functions are unsafe to use for uprobes. Both functions were originally writt…
-
Medium 5.5
xfrm: fix one more kernel-infoleak in algo dumping
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _copy_to_iter+0x598/0x2a3…
-
Medium 5.5
xfrm: validate new SA's prefixlen using SA family when sel.family is unset
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm se…
-
Medium 5.5
Bluetooth: bnep: fix wild-memory-access in proto_unregister
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in proto_unregister There's issue as follows: KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f] CPU: 3 UID: 0 PID: 2805 Comm: rmmod …
-
Medium 5.5
sched/numa: Fix the potential null pointer dereference in task_numa_work()
In the Linux kernel, the following vulnerability has been resolved: sched/numa: Fix the potential null pointer dereference in task_numa_work() When running stress-ng-vm-segv test, we found a null pointer dereference error in task_numa_work(). Here is the back…
-
Medium 5.5
Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. __hci_cmd_sync_sk() returns NULL if a command returns a status …
-
Medium 4.7
irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has al…
-
Unscored —
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the…
-
Unscored —
bpf: Fix a sdiv overflow issue
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a sdiv overflow issue Zac Ecob reported a problem where a bpf program may cause kernel crash due to the following error: Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI The failu…