Summary
[4.18.0-553.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Drop not needed patch
[4.18.0-553]
- cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-35784]
[4.18.0-552]
- i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248]
- i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248]
[4.18.0-551]
- x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742}
- i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992]
- i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992]
[4.18.0-550]
- mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489}
- mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489}
[4.18.0-549]
- dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678]
- dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678]
- RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934]
- RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934]
- RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934]
- net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934]
- net: mana: Fix spelling mistake 'enforecement' -> 'enforcement' (Maxim Levitsky) [RHEL-23934]
- net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934]
- net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934]
- net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934]
- net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934]
- net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934]
- net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934]
- RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934]
[4.18.0-548]
- gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann)
- arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005]
- [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214]
- drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214]
[4.18.0-547]
- x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505]
- x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505]
- x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505]
- x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505]
- efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505]
- x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505]
- efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505]
- efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505]
- efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505]
- x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505]
- x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505]
- x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505]
- x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505]
- x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505]
- efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505]
- arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505]
- efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505]
- arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505]
- efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505]
- x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505]
- x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505]
- decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505]
- x86/efistub: Prefer EFI memory attributes pro
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | perf | 0:4.18.0-553.el8_10 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-553.el8_10 |
Vulnerabilities 48
-
High 8.1
smb: client: fix potential OOBs in smb2_parse_contexts()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing i…
-
High 7.8CVE-2022-45934 Public exploit
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integ…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it …
-
High 7.8
team: fix null-ptr-deref when team device type is changed
In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 001…
-
High 7.8
netfilter: nf_tables: disallow timeout for anonymous sets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.
-
High 7.8
Use-after-free in Linux kernel's ipv4: igmp component
A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another…
-
High 7.5
Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()
A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an atta…
-
High 7.5
The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed e…
-
High 7.1
Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
-
High 7.1
In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time an…
-
High 7.0
bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_…
-
Medium 6.7
Kernel: netfilter: xtables out-of-bounds read in u32_match_it()
A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyon…
-
Medium 6.6
Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function
A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
-
Medium 6.5
Kernel: rsvp: out-of-bounds read in rsvp_classify()
A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to…
-
Medium 6.5
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and …
-
Medium 6.4
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …
-
Medium 6.3
netfilter: nf_tables: fix memleak when more than 255 elements expired
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type…
-
Medium 6.2
Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c
A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.
-
Medium 6.1
Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosu…
-
Medium 5.6
Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an un…
-
Medium 5.5
Kernel: cxgb4: use-after-free in ch_flower_stats_cb()
A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, ca…
-
Medium 5.5
Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allo…
-
Medium 5.5
Kernel: null pointer dereference vulnerability in nft_dynset_init()
A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.
-
Medium 5.1
Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()
A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading…
-
Medium 4.7
Kernel: local dos vulnerability in scatterwalk_copychunks
A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to cras…
-
Medium 4.6
Linux Kernel Bluetooth l1oip_core.c del_timer use after free
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recomme…
-
Medium 4.6
An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in …
-
Medium 4.3
Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get
An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potenti…
-
Low 3.3
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized…
-
Low 3.2
Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigge…
-
Unscored —
In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device…
-
Unscored —
drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB …
-
Unscored —
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGK…
-
Unscored —
A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of b…
-
Unscored —CVE-2021-4204 Public exploit
An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. Thi…
-
Unscored —
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in th…
-
Unscored —CVE-2022-23222 Public exploit
kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availabi…
-
Unscored —
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_co…
-
Unscored —
An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a rac…
-
Unscored —
An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Becaus…
-
Unscored —
An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a …
-
Unscored —
An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because …
-
Unscored —
gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd…
-
Unscored —
mm/sparsemem: fix race in accessing memory_section->usage
In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are su…
-
Unscored —
net/core: Fix ETH_P_1588 flow dissector
In the Linux kernel, the following vulnerability has been resolved: net/core: Fix ETH_P_1588 flow dissector When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is w…
-
Unscored —
sched/membarrier: reduce the ability to hammer on sys_membarrier
In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in …
-
Unscored —CVE-2024-26609 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
blk-mq: fix IO hang from sbitmap wakeup race
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. …