Skip to content
OpenAdvisories
High ELSA-2024-12208 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

Published Mar 11, 2024 · Updated Mar 11, 2024

Summary

[5.15.0-204.147.6.2]
- smb3: Replace smb2pdu 1-element arrays with flex-arrays (Kees Cook) [Orabug: 36353543]
- hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Shradha Gupta) [Orabug: 36358874]
- hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Souradeep Chakrabarti)
- hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Michael Kelley)
- netfilter: ipset: Missing gc cancellations fixed (Jozsef Kadlecsik)
- netfilter: ipset: fix performance regression in swap operation (Jozsef Kadlecsik)
- netfilter: nft_set_rbtree: skip end interval element from gc (Pablo Neira Ayuso)
- netfilter: nf_tables: set dormant flag on hook register failure (Florian Westphal)

[5.15.0-204.147.6.1]
- arm64: Minimize tlb flush due to vttbr writes on AmpereOne (Ganapatrao Kulkarni) [Orabug: 36359078]

[5.15.0-204.147.6]
- keys, dns: Fix size check of V1 server-list header (David Howells)
- net/rds: Supporting SIOCOUTQ to read pending sends (Devesh Sharma) [Orabug: 34460809]
- KVM: x86: smm: preserve interrupt shadow in SMRAM (Maxim Levitsky) [Orabug: 36171472]

[5.15.0-204.147.5]
- tcp: fix excessive TLP and RACK timeouts from HZ rounding (Neal Cardwell) [Orabug: 36289786]
- uek-rpm: Make few builtin options to modules back -- hardening (Harshit Mogalapalli) [Orabug: 36196579]
- iommufd/iova_bitmap: Consider page offset for the pages to be pinned (Joao Martins) [Orabug: 36197723]
- iommufd/iova_bitmap: Handle recording beyond the mapped pages (Joao Martins) [Orabug: 36197723]
- iommufd/iova_bitmap: Switch iova_bitmap::bitmap to an u8 array (Joao Martins) [Orabug: 36197723]
- iommufd/iova_bitmap: Bounds check mapped::pages access (Joao Martins) [Orabug: 36197723]
- Revert 'iommu/amd: Improve dirty read io-pgtable walker' (Joao Martins) [Orabug: 36197723]

[5.15.0-204.147.4]
- uek-rpm: Disable MCORE2 in container kernel configs (Harshit Mogalapalli) [Orabug: 36267828]
- md: fix regression for null-ptr-deference in __md_stop() (Yu Kuai) [Orabug: 36230125]
- md: Free resources in __md_stop (Xiao Ni) [Orabug: 36230125]
- md: Change active_io to percpu (Xiao Ni) [Orabug: 36230125]
- md: Factor out is_md_suspended helper (Xiao Ni) [Orabug: 36230125]
- hwmon: (opbmc) E6/AST2600 platform enabled (Jan Zdarek) [Orabug: 36222931]

[5.15.0-204.147.3]
- Revert 'tcp: fix excessive TLP and RACK timeouts from HZ rounding' (Sherry Yang) [Orabug: 36241828]
- mm: avoid heavy swap lock contention when unmapping with padata (Anthony Yznaga) [Orabug: 36073084]
- mm: use less threads when unmapping some large VMAs (Anthony Yznaga) [Orabug: 36073084]
- crypto: qat - add NULL pointer check (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - fix mutex ordering in adf_rl (Damian Muszynski) [Orabug: 36156923]
- crypto: qat - fix error path in add_update_sla() (Damian Muszynski) [Orabug: 36156923]
- crypto: qat - add sysfs_added flag for rate limiting (Damian Muszynski) [Orabug: 36156923]
- crypto: qat - add sysfs_added flag for ras (Damian Muszynski) [Orabug: 36156923]
- crypto: qat - prevent underflow in rp2srv_store() (Dan Carpenter) [Orabug: 36156923]
- Documentation: ABI: debugfs-driver-qat: fix fw_counters path (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - move adf_cfg_services (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - add num_rps sysfs attribute (Ciunas Bennett) [Orabug: 36156923]
- crypto: qat - add rp2svc sysfs attribute (Ciunas Bennett) [Orabug: 36156923]
- crypto: qat - add rate limiting sysfs interface (Ciunas Bennett) [Orabug: 36156923]
- crypto: qat - add rate limiting feature to qat_4xxx (Damian Muszynski) [Orabug: 36156923]
- units: add missing header (Andy Shevchenko) [Orabug: 36156923]
- units: Add BYTES_PER_*BIT (Damian Muszynski) [Orabug: 36156923]
- crypto: qat - add retrieval of fw capabilities (Damian Muszynski) [Orabug: 36156923]
- crypto: qat - add bits.h to icp_qat_hw.h (Damian Muszynski) [Orabug: 36156923]
- crypto: qat - move admin api (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - fix ring to service map for QAT GEN4 (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - use masks for AE groups (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - refactor fw config related functions (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - count QAT GEN4 errors (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - add error counters (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - add handling of errors from ERRSOU3 for QAT GEN4 (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - add adf_get_aram_base() helper function (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - add handling of compression related errors for QAT GEN4 (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - add handling of errors from ERRSOU2 for QAT GEN4 (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - add reporting of errors from ERRSOU1 for QAT GEN4 (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - add reporting of correctable errors for QAT GEN4 (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - add infrastructure for error reporting (Shashank Gupta) [Orabug: 36156923]
- crypto: qat - fix double free during reset (Svyatoslav Pankratov) [Orabug: 36156923]
- crypto: qat - add cnv_errors debugfs file (Lucas Segarra Fernandez) [Orabug: 36156923]
- crypto: qat - add pm_status debugfs file (Lucas Segarra Fernandez) [Orabug: 36156923]
- crypto: qat - refactor included headers (Lucas Segarra Fernandez) [Orabug: 36156923]
- crypto: qat - add namespace to driver (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - Remove zlib-deflate (Herbert Xu) [Orabug: 36156923]
- crypto: qat - enable dc chaining service (Adam Guerin) [Orabug: 36156923]
- crypto: qat - consolidate services structure (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - fix unregistration of compression algorithms (Giovanni Cabiddu) [Orabug: 36156923]
- crypto: qat - fix unregistration of crypto algorithms (Giovanni Cabiddu) [Orabu

Fixed packages 14

ReleasePackageFixed in
Oracle Linux · 8 bpftool 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-container 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-container-debug 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-core 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-debug 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-debug-core 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-debug-devel 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-debug-modules 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-debug-modules-extra 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-devel 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-doc 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-modules 0:5.15.0-204.147.6.2.el9uek
Oracle Linux · 8 kernel-uek-modules-extra 0:5.15.0-204.147.6.2.el9uek

Vulnerabilities 1

  • High 7.8

    Use-after-free in Linux kernel's netfilter: nf_tables component

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current genera…