Summary
[4.1.12-124.91.3]
- nfs_atomic_open(): prevent parallel nfs_lookup() on a negative hashed (Al Viro) [Orabug: 37006239]
[4.1.12-124.91.2]
- vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() (Haoran Zhang) [Orabug: 37035560]
[4.1.12-124.91.1]
- vt_ioctl: fix array_index_nospec in vt_setactivate (Jakob Koschel) [Orabug: 37101899] {CVE-2022-48804}
- tty: vt_ioctl: fix potential Spectre v1 (Gustavo A. R. Silva) [Orabug: 37101899] {CVE-2022-48804}
- USB: core: Fix hang in usb_kill_urb by adding memory barriers (Alan Stern) [Orabug: 37101883] {CVE-2022-48760}
- smb: client: fix OOB in smbCalcSize() (Paulo Alcantara) [Orabug: 36165420] {CVE-2023-6606}
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:4.1.12-124.91.3.el7uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:4.1.12-124.91.3.el7uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:4.1.12-124.91.3.el7uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:4.1.12-124.91.3.el7uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:4.1.12-124.91.3.el7uek |
| Oracle Linux · 7 | kernel-uek-firmware | 0:4.1.12-124.91.3.el7uek |
Vulnerabilities 3
-
High 7.1
Kernel: out-of-bounds read vulnerability in smbcalcsize
An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
-
Unscored —
USB: core: Fix hang in usb_kill_urb by adding memory barriers
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix hang in usb_kill_urb by adding memory barriers The syzbot fuzzer has identified a bug in which processes hang waiting for usb_kill_urb() to return. It turns out the issue is no…
-
Unscored —
vt_ioctl: fix array_index_nospec in vt_setactivate
In the Linux kernel, the following vulnerability has been resolved: vt_ioctl: fix array_index_nospec in vt_setactivate array_index_nospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a…