[ELSA-2023-1566] kernel security, bug fix, and enhancement update
[4.18.0-425.19.2_7.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
[4.18.0-425.19.2_7.gf5e8]
- ovl: fail on invalid uid/gid mapping at copy up (Miklos Szeredi) [2165341 2165342] {CVE-2023-0386}
[4.18.0-425.19.1_7]
- s390/dasd: fix no record found for raw_track_access (Tobias Huschle) [2167776 2161270]
- locking/rwsem: Disable preemption in all down_read*() and up_read() code paths (Waiman Long) [2170939 2162139]
- locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath (Waiman Long) [2170939 2162139]
- locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter (Waiman Long) [2170939 2162139]
- locking/rwsem: Always try to wake waiters in out_nolock path (Waiman Long) [2170939 2162139]
- locking/rwsem: No need to check for handoff bit if wait queue empty (Waiman Long) [2170939 2162139]
- locking/rwsem: Make handoff bit handling more consistent (Waiman Long) [2170939 2162139]
- locking/rwsem: Disable preemption while trying for rwsem lock (Waiman Long) [2170939 2162139]
- locking/rwsem: Conditionally wake waiters in reader/writer slowpaths (Waiman Long) 2170939 2162139 [2170939 2162139]
- locking/rwsem: Optimize down_read_trylock() under highly contended case (Waiman Long) [2170939 2162139]
- locking/rwsem: Fix comments about reader optimistic lock stealing conditions (Waiman Long) [2170939 2162139]
- locking/rwsem: Disable preemption for spinning region (Waiman Long) [2170939 2162139]
- locking: Remove rcu_read_{,un}lock() for preempt_{dis,en}able() (Waiman Long) [2170939 2162139]
- watchdog: fix UAF in reboot notifier handling in watchdog core code (Wander Lairson Costa) [2139770 2131308]
- netfilter: nf_conntrack_irc: Tighten matching on DCC message (Wander Lairson Costa) [2139770 2131308]
- ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Jaroslav Kysela) [2163400 2163401] {CVE-2023-0266}
- net/mlx5e: Fix enabling sriov while tc nic rules are offloaded (Amir Tzin) [2167647 2112925]
- net/mlx5: E-Switch, pair only capable devices (Amir Tzin) [2167647 2112925]
- net/mlx5: Fix mlx5_get_next_dev() peer device matching (Amir Tzin) [2167647 2112925]
- net/mlx5: Lag, filter non compatible devices (Amir Tzin) [2167647 2112925]
[4.18.0-425.18.1_7]
- futex: Resend potentially swallowed owner death notification (Rafael Aquini) [2170054 2161526]
[4.18.0-425.17.1_7]
- net: mana: Add rmb after checking owner bits (Mohammed Gamal) [2173103 2139462]
- net: mana: Add support of XDP_REDIRECT action (Mohammed Gamal) [2173103 2139462]
- net: mana: Add the Linux MANA PF driver (Mohammed Gamal) [2173103 2139462]
- ice: fix lost multicast packets in promisc mode (Ken Cox) [2172550 2138215]
[4.18.0-425.16.1_7]
- ipv6: fix panic when fib_lookup_arg->result is fib6_info (Jiri Benc) [2167602 2140599]
- ceph: blocklist the kclient when receiving corrupted snap trace (Xiubo Li) [2168896 2162414]
- ceph: move mount state enum to super.h (Xiubo Li) [2168896 2162414]
- s390/kexec: fix ipl report address for kdump (Tobias Huschle) [2166296 2161328]
- mm, compaction: fix fast_isolate_around() to stay within boundaries (Daniel Vacek) [2170576 2149309]
- scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (Emanuele Giuseppe Esposito) [2170228 2150659]
- netfilter: conntrack: handle tcp challenge acks during connection reuse (Florian Westphal) [2165587 2158726]
[4.18.0-425.15.1_7]
- net/mlx5e: Fix use-after-free when reverting termination table (Amir Tzin) [2167640 2112927]
- net/mlx5: Do not query pci info while pci disabled (Amir Tzin) [2167645 2129249]
- x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly (Dean Nelson) [2168384 2122850]
- x86/fpu: Exclude dynamic states from init_fpstate (Dean Nelson) [2168384 2122850]
- x86/fpu: Fix the init_fpstate size check with the actual size (Dean Nelson) [2168384 2122850]
- x86/fpu: Configure init_fpstate attributes orderly (Dean Nelson) [2168384 2122850]
- x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation (Dean Nelson) [2168384 2122850]
- net/mlx5: E-Switch, properly handle ingress tagged packets on VST (Amir Tzin) [2166665 2096109]
- cpuhotplug: Fix KABI breakage (Prarit Bhargava) [2162763 2156529]
[4.18.0-425.14.1_7]
- ACPI: processor idle: Practically limit 'Dummy wait' workaround to old Intel systems (Wei Huang) [2142170 2130653]
- KVM: x86: nSVM: implement nested LBR virtualization (Emanuele Giuseppe Esposito) [2166362 2155149]
- KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running (Emanuele Giuseppe Esposito) [2166362 2155149]
- kvm: x86: SVM: use vmcb* instead of svm->vmcb where it makes sense (Emanuele Giuseppe Esposito) [2166362 2155149]
- KVM: x86: nSVM: implement nested VMLOAD/VMSAVE (Emanuele Giuseppe Esposito) [2166362 2155149]
- IB/iser: Fix login with authentication (Kamal Heib) [2161750 2120676]
- act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti) [2164648 2131339] {CVE-2022-4269}
- net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti) [2164648 2131339] {CVE-2022-4269}
- redhat/configs: Set CONFIG_X86_AMD_PSTATE to 'm' (Prarit Bhargava) [2151275 2145246]
- KVM: x86: smm: preserve interrupt shadow in SMRAM (Maxim Levitsky) [2166368 2097144]
- KVM: x86: SVM: don't save SVM state to SMRAM when VM is not long mode capable (Maxim Levitsky) [2166368 2097144]
- KVM: x86: SVM: use smram structs (Maxim Levitsky) [2166368 2097144]
- KVM: svm: drop explicit return value of kvm_vcpu_map (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: use smram struct for 64 bit smram load/restore (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: use smram struct for 32 bit smram load/restore (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: use smram structs in the common code (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: add structs for KVM's smram layout (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: check for failures on smm entry (Maxim Levitsky) [2166368 2097144]
- KVM: x86: do not go through ctxt->ops when emulating rsm (Maxim Levitsky) [2166368 2097144]
- KVM: x86: move SMM exit to a new file (Maxim Levitsky) [2166368 2097144]
- KVM: x86: move SMM entry to a new file (Maxim Levitsky) [2166368 2097144]
- KVM: x86: start moving SMM-related functions to new files (Maxim Levitsky) [2166368 2097144]
- bug: introduce ASSERT_STRUCT_OFFSET (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Rename and expose helper to detect if INIT/SIPI are allowed (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format (Maxim Levitsky) [2166368 2097144]
- KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky) [2166368 2097144]
- KVM: x86: emulator: update the emulation mode after rsm (Maxim Levitsky) [2166368 2097144]
- KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky) [2166368 2097144]
- KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Bug the VM if the emulator accesses a non-existent GPR (Maxim Levitsky) [2166368 2097144]
- \KVM: x86: Reduce the number of emulator GPRs to '8' for 32-bit KVM (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Use 16-bit fields to track dirty/valid emulator GPRs (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Omit VCPU_REGS_RIP from emulator's _regs array (Maxim Levitsky) [2166368 2097144]
- \KVM: x86: Harden _regs accesses to guard against buggy input (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Grab regs_dirty in local 'unsigned long' (Maxim Levitsky) [2166368 2097144]
- proc: proc_skip_spaces() shouldn't think it is working on C strings (Wander Lairson Costa) [2152571 2152572] {CVE-2022-4378}
- proc: avoid integer type confusion in get_proc_long (Wander Lairson Costa) [2152571 2152572] {CVE-2022-4378}
- ID
- ELSA-2023-1566
- Severity
- important
- URL
- https://linux.oracle.com/errata/ELSA-2023-1566.html
- Published
-
2023-04-05T00:00:00
(17 months ago) - Modified
-
2023-04-05T00:00:00
(17 months ago) - Rights
- Copyright 2023 Oracle, Inc.
- Other Advisories
-
- ALSA-2023:0951
- ALSA-2023:1470
- ALSA-2023:1566
- ALSA-2023:1703
- CISA-2023:0330
- DSA-5324-1
- DSA-5402-1
- DSA-5480-1
- ELSA-2022-10071
- ELSA-2022-10072
- ELSA-2022-10073
- ELSA-2022-10078
- ELSA-2022-10079
- ELSA-2022-10080
- ELSA-2022-10081
- ELSA-2022-10108
- ELSA-2023-0951
- ELSA-2023-1091
- ELSA-2023-12006
- ELSA-2023-12007
- ELSA-2023-12008
- ELSA-2023-12009
- ELSA-2023-12017
- ELSA-2023-12018
- ELSA-2023-12196
- ELSA-2023-1470
- ELSA-2023-1703
- ELSA-2023-1822
- MS:CVE-2022-4378
- MS:CVE-2023-0266
- RHSA-2023:0951
- RHSA-2023:0979
- RHSA-2023:1008
- RHSA-2023:1091
- RHSA-2023:1092
- RHSA-2023:1101
- RHSA-2023:1469
- RHSA-2023:1470
- RHSA-2023:1471
- RHSA-2023:1566
- RHSA-2023:1584
- RHSA-2023:1659
- RHSA-2023:1681
- RHSA-2023:1691
- RHSA-2023:1703
- RLSA-2023:1470
- RLSA-2023:1566
- SSA:2023-048-01
- SSA:2023-172-02
- SUSE-SU-2022:4503-1
- SUSE-SU-2022:4504-1
- SUSE-SU-2022:4505-1
- SUSE-SU-2022:4506-1
- SUSE-SU-2022:4510-1
- SUSE-SU-2022:4513-1
- SUSE-SU-2022:4515-1
- SUSE-SU-2022:4516-1
- SUSE-SU-2022:4517-1
- SUSE-SU-2022:4518-1
- SUSE-SU-2022:4520-1
- SUSE-SU-2022:4527-1
- SUSE-SU-2022:4528-1
- SUSE-SU-2022:4533-1
- SUSE-SU-2022:4534-1
- SUSE-SU-2022:4539-1
- SUSE-SU-2022:4542-1
- SUSE-SU-2022:4543-1
- SUSE-SU-2022:4544-1
- SUSE-SU-2022:4545-1
- SUSE-SU-2022:4546-1
- SUSE-SU-2022:4550-1
- SUSE-SU-2022:4551-1
- SUSE-SU-2022:4559-1
- SUSE-SU-2022:4560-1
- SUSE-SU-2022:4562-1
- SUSE-SU-2022:4566-1
- SUSE-SU-2022:4569-1
- SUSE-SU-2022:4572-1
- SUSE-SU-2022:4573-1
- SUSE-SU-2022:4574-1
- SUSE-SU-2022:4577-1
- SUSE-SU-2022:4580-1
- SUSE-SU-2022:4585-1
- SUSE-SU-2022:4587-1
- SUSE-SU-2022:4589-1
- SUSE-SU-2022:4595-1
- SUSE-SU-2022:4613-1
- SUSE-SU-2022:4614-1
- SUSE-SU-2022:4615-1
- SUSE-SU-2022:4616-1
- SUSE-SU-2022:4617-1
- SUSE-SU-2023:0152-1
- SUSE-SU-2023:0394-1
- SUSE-SU-2023:0406-1
- SUSE-SU-2023:0433-1
- SUSE-SU-2023:0485-1
- SUSE-SU-2023:0488-1
- SUSE-SU-2023:0618-1
- SUSE-SU-2023:0634-1
- SUSE-SU-2023:0779-1
- SUSE-SU-2023:1576-1
- SUSE-SU-2023:1591-1
- SUSE-SU-2023:1592-1
- SUSE-SU-2023:1595-1
- SUSE-SU-2023:1602-1
- SUSE-SU-2023:1619-1
- SUSE-SU-2023:1639-1
- SUSE-SU-2023:1640-1
- SUSE-SU-2023:1647-1
- SUSE-SU-2023:1649-1
- SUSE-SU-2023:1653-1
- SUSE-SU-2023:1708-1
- SUSE-SU-2023:2140-1
- SUSE-SU-2023:2141-1
- SUSE-SU-2023:2231-1
- SUSE-SU-2023:2368-1
- SUSE-SU-2023:2369-1
- SUSE-SU-2023:2371-1
- SUSE-SU-2023:2384-1
- SUSE-SU-2023:2425-1
- SUSE-SU-2023:2428-1
- SUSE-SU-2023:2431-1
- SUSE-SU-2023:2443-1
- SUSE-SU-2023:2455-1
- SUSE-SU-2023:2459-1
- SUSE-SU-2023:2468-1
- SUSE-SU-2023:2500-1
- SUSE-SU-2023:2502-1
- SUSE-SU-2023:2611-1
- SUSE-SU-2023:2646-1
- SUSE-SU-2023:2651-1
- SUSE-SU-2023:2653-1
- SUSE-SU-2023:2782-1
- SUSE-SU-2023:2809-1
- SUSE-SU-2023:2871-1
- USN-5799-1
- USN-5803-1
- USN-5809-1
- USN-5814-1
- USN-5831-1
- USN-5832-1
- USN-5860-1
- USN-5877-1
- USN-5879-1
- USN-5883-1
- USN-5915-1
- USN-5917-1
- USN-5919-1
- USN-5920-1
- USN-5924-1
- USN-5927-1
- USN-5934-1
- USN-5939-1
- USN-5940-1
- USN-5951-1
- USN-5970-1
- USN-5975-1
- USN-5979-1
- USN-5981-1
- USN-5982-1
- USN-5984-1
- USN-5987-1
- USN-5991-1
- USN-6000-1
- USN-6004-1
- USN-6009-1
- USN-6025-1
- USN-6030-1
- USN-6033-1
- USN-6040-1
- USN-6043-1
- USN-6057-1
- USN-6071-1
- USN-6072-1
- USN-6134-1
- USN-6171-1
- USN-6175-1
- USN-6186-1
- USN-6187-1
- USN-6284-1
- USN-6300-1
- USN-6301-1
- USN-6311-1
- USN-6312-1
- USN-6314-1
- USN-6331-1
- USN-6332-1
- USN-6337-1
- USN-6347-1
- USN-6385-1
Source | # ID | Name | URL |
---|---|---|---|
elsa | ELSA-2023-1566 | https://linux.oracle.com/errata/ELSA-2023-1566.html | |
CVE | CVE-2023-0386 | https://linux.oracle.com/cve/CVE-2023-0386.html | |
CVE | CVE-2023-0266 | https://linux.oracle.com/cve/CVE-2023-0266.html | |
CVE | CVE-2022-4269 | https://linux.oracle.com/cve/CVE-2022-4269.html | |
CVE | CVE-2022-4378 | https://linux.oracle.com/cve/CVE-2022-4378.html |
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/oraclelinux/python3-perf?distro=oraclelinux-8.7 | oraclelinux | python3-perf | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/perf?distro=oraclelinux-8.7 | oraclelinux | perf | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel?distro=oraclelinux-8.7 | oraclelinux | kernel | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-tools?distro=oraclelinux-8.7 | oraclelinux | kernel-tools | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-tools-libs?distro=oraclelinux-8.7 | oraclelinux | kernel-tools-libs | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-tools-libs-devel?distro=oraclelinux-8.7 | oraclelinux | kernel-tools-libs-devel | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-modules?distro=oraclelinux-8.7 | oraclelinux | kernel-modules | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-modules-extra?distro=oraclelinux-8.7 | oraclelinux | kernel-modules-extra | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-headers?distro=oraclelinux-8.7 | oraclelinux | kernel-headers | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-doc?distro=oraclelinux-8.7 | oraclelinux | kernel-doc | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-devel?distro=oraclelinux-8.7 | oraclelinux | kernel-devel | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-debug?distro=oraclelinux-8.7 | oraclelinux | kernel-debug | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-debug-modules?distro=oraclelinux-8.7 | oraclelinux | kernel-debug-modules | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-debug-modules-extra?distro=oraclelinux-8.7 | oraclelinux | kernel-debug-modules-extra | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-debug-devel?distro=oraclelinux-8.7 | oraclelinux | kernel-debug-devel | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-debug-core?distro=oraclelinux-8.7 | oraclelinux | kernel-debug-core | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-cross-headers?distro=oraclelinux-8.7 | oraclelinux | kernel-cross-headers | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-core?distro=oraclelinux-8.7 | oraclelinux | kernel-core | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/kernel-abi-stablelists?distro=oraclelinux-8.7 | oraclelinux | kernel-abi-stablelists | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 | ||
Affected | pkg:rpm/oraclelinux/bpftool?distro=oraclelinux-8.7 | oraclelinux | bpftool | < 4.18.0-425.19.2.el8_7 | oraclelinux-8.7 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |