Summary
[257-23.0.1.el10_2.2]
- Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877]
- Avoid udevadm warnings when using udev valid configs [Orabug: 37503197]
- allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469]
- set 'RemoveIPC=no' in logind.conf as default [Orabug: 22224874]
- Fix missing netdev for iscsi entry in fstab [Orabug: 25897792]
- udev rules: fix memory hot add and remove [Orabug: 31310273]
- Disable unprivileged BPF by default [Orabug: 32870980]
- Remove upstream references [Orabug: 33995357]
- Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407]
- Removed unneeded patches from the systemd.spec
- 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490]
- 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490]
- 1006-orabug34467234-shutdown-get-only-active-md-arrays.patch [Orabug: 34467234]
- 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110]
- 1008-path-drop-IN_ATTRIB-from-parent-directory-watches.patch [Orabug: 36780432]
[257-23.2]
- nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163873)
- nspawn: normalize pivot_root paths (RHEL-163873)
- udev: check for invalid chars in various fields received from the kernel (RHEL-163879)
- udev: ensure there is space for trailing NUL before calling sprintf (RHEL-163879)
- udev: ensure tag parsing stays within bounds (RHEL-163879)
- udev: fix review mixup (RHEL-163879)
- udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163879)
- udev-builtin-net-id: print cescaped bad attributes (RHEL-163879)
[257-23.1]
- ci: re-enable bpf-framework option for build and unit test jobs (RHEL-152080)
- ci: add bpftool workaround to codeql job too (RHEL-152080)
- ci: fix workaround about bpftool for codeql (RHEL-152080)
- ci: add bpftool workaround to coverity too (RHEL-152080)
- path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-152080)
- cgroup: port some code over to path_startswith_full() (RHEL-152080)
- path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-152080)
- sd-json: fix off-by-one issue when updating parent for array elements (RHEL-152080)
- core/cgroup: avoid one unnecessary strjoina() (RHEL-152080)
- core: validate input cgroup path more prudently (RHEL-152080)
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | systemd | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-boot-unsigned | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-container | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-devel | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-journal-remote | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-libs | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-oomd | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-pam | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-resolved | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-rpm-macros | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-udev | 0:257-23.0.1.el10_2.2 |
| Oracle Linux · 10 | systemd-ukify | 0:257-23.0.1.el10_2.2 |
Vulnerabilities 1
-
Medium 4.7
Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc…