Описание
ELSA-2025-15648: kernel security update (IMPORTANT)
[3.10.0-1160.119.1.0.12]
- scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) [Orabug: 38414589]
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) [Orabug: 38414589]
Обновленные пакеты
Oracle Linux 7
Oracle Linux x86_64
bpftool
3.10.0-1160.119.1.0.12.el7
kernel
3.10.0-1160.119.1.0.12.el7
kernel-abi-whitelists
3.10.0-1160.119.1.0.12.el7
kernel-debug
3.10.0-1160.119.1.0.12.el7
kernel-debug-devel
3.10.0-1160.119.1.0.12.el7
kernel-devel
3.10.0-1160.119.1.0.12.el7
kernel-doc
3.10.0-1160.119.1.0.12.el7
kernel-headers
3.10.0-1160.119.1.0.12.el7
kernel-tools
3.10.0-1160.119.1.0.12.el7
kernel-tools-libs
3.10.0-1160.119.1.0.12.el7
kernel-tools-libs-devel
3.10.0-1160.119.1.0.12.el7
perf
3.10.0-1160.119.1.0.12.el7
python-perf
3.10.0-1160.119.1.0.12.el7
Связанные CVE
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated. BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string.
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated. BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string.
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated. BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string.
