Описание
ELSA-2025-3893: kernel security update (MODERATE)
[4.18.0-553.50.1_10.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
[4.18.0-553.50.1_10]
- perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119]
- ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150}
- scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052]
- ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852]
- ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852]
- ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852]
[4.18.0-553.49.1_10]
- net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244]
- redhat: drop Y issues from changelog (Jan Stancek)
- md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673]
- md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673]
- md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673]
- md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673]
- md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673]
- raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499]
- x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}
- x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}
[4.18.0-553.48.1_10]
- rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves)
- gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208]
- gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208]
- gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208]
- gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208]
- gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208]
- gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208]
- gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208]
- gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208]
- gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208]
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
kernel-tools-libs-devel
4.18.0-553.50.1.el8_10
bpftool
4.18.0-553.50.1.el8_10
kernel-cross-headers
4.18.0-553.50.1.el8_10
kernel-headers
4.18.0-553.50.1.el8_10
kernel-tools
4.18.0-553.50.1.el8_10
kernel-tools-libs
4.18.0-553.50.1.el8_10
perf
4.18.0-553.50.1.el8_10
python3-perf
4.18.0-553.50.1.el8_10
Oracle Linux x86_64
kernel-tools-libs-devel
4.18.0-553.50.1.el8_10
bpftool
4.18.0-553.50.1.el8_10
kernel
4.18.0-553.50.1.el8_10
kernel-abi-stablelists
4.18.0-553.50.1.el8_10
kernel-core
4.18.0-553.50.1.el8_10
kernel-cross-headers
4.18.0-553.50.1.el8_10
kernel-debug
4.18.0-553.50.1.el8_10
kernel-debug-core
4.18.0-553.50.1.el8_10
kernel-debug-devel
4.18.0-553.50.1.el8_10
kernel-debug-modules
4.18.0-553.50.1.el8_10
kernel-debug-modules-extra
4.18.0-553.50.1.el8_10
kernel-devel
4.18.0-553.50.1.el8_10
kernel-doc
4.18.0-553.50.1.el8_10
kernel-headers
4.18.0-553.50.1.el8_10
kernel-modules
4.18.0-553.50.1.el8_10
kernel-modules-extra
4.18.0-553.50.1.el8_10
kernel-tools
4.18.0-553.50.1.el8_10
kernel-tools-libs
4.18.0-553.50.1.el8_10
perf
4.18.0-553.50.1.el8_10
python3-perf
4.18.0-553.50.1.el8_10
Связанные CVE
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241.
In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241.
In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241.
In the Linux kernel, the following vulnerability has been resolved: x ...
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.