Summary
[4.1.12-124.92.3]
- memcg_write_event_control(): fix a user-triggerable oops (Al Viro) [Orabug: 37070674] {CVE-2024-45021}
- ocfs2: fix races between hole punching and AIO+DIO (Su Yue) [Orabug: 36835819] {CVE-2024-40943}
[4.1.12-124.92.2]
- fbdev: savage: Handle err return when savagefb_check_var failed (Cai Xinchen) [Orabug: 36984058] {CVE-2024-39475}
- bnx2x: Fix multiple UBSAN array-index-out-of-bounds (Ghadi Elie Rahme) [Orabug: 36897888] {CVE-2024-42148}
- vmci: prevent speculation leaks by sanitizing event in event_deliver() (Hagar Gamal Halim Hemdan) [Orabug: 36835584] {CVE-2024-39499}
- aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts (Chun-Yi Lee) [Orabug: 36544953] {CVE-2024-26898}
[4.1.12-124.92.1]
- Input: MT - limit max slots (Tetsuo Handa) [Orabug: 37029139] {CVE-2024-45008}
- drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes (Ma Ke) [Orabug: 36897642] {CVE-2024-42101}
- wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (Remi Pommarel) [Orabug: 36835737] {CVE-2024-40912}
- USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (Alan Stern) [Orabug: 36835711] {CVE-2024-40904}
- bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (Sam Sun) [Orabug: 36825250] {CVE-2024-39487}
- jffs2: prevent xattr node from overflowing the eraseblock (Ilya Denisyev) [Orabug: 36753653] {CVE-2024-38599}
- scsi: bfa: Ensure the copied buf is NUL terminated (Bui Quang Minh) [Orabug: 36753475] {CVE-2024-38560}
- ALSA: usb-audio: Stop parsing channels bits when all channels are found. (Johan Carlsson) [Orabug: 36642150] {CVE-2024-27436}
- USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Alan Stern) [Orabug: 36598221] {CVE-2024-27059}
- fat: fix uninitialized field in nostale filehandles (Jan Kara) [Orabug: 36597870] {CVE-2024-26973}
- ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Armin Wolf) [Orabug: 36544941] {CVE-2024-26894}
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:4.1.12-124.92.3.el7uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:4.1.12-124.92.3.el7uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:4.1.12-124.92.3.el7uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:4.1.12-124.92.3.el7uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:4.1.12-124.92.3.el7uek |
| Oracle Linux · 7 | kernel-uek-firmware | 0:4.1.12-124.92.3.el7uek |
Vulnerabilities 17
-
High 7.8
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the …
-
High 7.8
jffs2: prevent xattr node from overflowing the eraseblock
In the Linux kernel, the following vulnerability has been resolved: jffs2: prevent xattr node from overflowing the eraseblock Add a check to make sure that the requested xattr node size is no larger than the eraseblock minus the cleanmarker. Unlike the usual …
-
High 7.8
ocfs2: fix races between hole punching and AIO+DIO
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix races between hole punching and AIO+DIO After commit "ocfs2: return real error code in ocfs2_dio_wr_get_block", fstests/generic/300 become from always failed to sometimes failed: =…
-
High 7.1
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte…
-
High 7.1
memcg_write_event_control(): fix a user-triggerable oops
In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).
-
Medium 6.0
ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() After unregistering the CPU idle device, the memory associated with it is not freed, leading to a memory leak: unreference…
-
Medium 5.3
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.
-
Unscored —
fat: fix uninitialized field in nostale filehandles
In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of t…
-
Unscored —
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and he…
-
Unscored —
scsi: bfa: Ensure the copied buf is NUL terminated
In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Ensure the copied buf is NUL terminated Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but w…
-
Unscored —
fbdev: savage: Handle err return when savagefb_check_var failed
In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_check_var failed The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zer…
-
Unscored —
vmci: prevent speculation leaks by sanitizing event in event_deliver()
In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() an…
-
Unscored —
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driv…
-
Unscored —
wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() The ieee80211_sta_ps_deliver_wakeup() function takes sta->ps_lock to synchronizes with ieee80211_tx_h_unicast_ps_buf() which …
-
Unscored —
drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes In nouveau_connector_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a p…
-
Unscored —
bnx2x: Fix multiple UBSAN array-index-out-of-bounds
In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues …
-
Unscored —
Input: MT - limit max slots
In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible…