[El-errata] ELSA-2024-0461 Important: Oracle Linux 9 kernel security update

Fri Mar 8 10:52:17 UTC 2024

Oracle Linux Security Advisory ELSA-2024-0461

http://linux.oracle.com/errata/ELSA-2024-0461.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-7.2.0-362.18.1.el9_3.x86_64.rpm
kernel-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-abi-stablelists-5.14.0-362.18.1.el9_3.noarch.rpm
kernel-core-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-debug-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-debug-core-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-debug-devel-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-debug-devel-matched-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-debug-modules-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-debug-modules-core-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-debug-modules-extra-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-devel-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-devel-matched-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-doc-5.14.0-362.18.1.el9_3.noarch.rpm
kernel-headers-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-modules-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-modules-core-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-modules-extra-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-tools-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-tools-libs-5.14.0-362.18.1.el9_3.x86_64.rpm
perf-5.14.0-362.18.1.el9_3.x86_64.rpm
python3-perf-5.14.0-362.18.1.el9_3.x86_64.rpm
rtla-5.14.0-362.18.1.el9_3.x86_64.rpm
rv-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-cross-headers-5.14.0-362.18.1.el9_3.x86_64.rpm
kernel-tools-libs-devel-5.14.0-362.18.1.el9_3.x86_64.rpm
libperf-5.14.0-362.18.1.el9_3.x86_64.rpm

aarch64:
bpftool-7.2.0-362.18.1.el9_3.aarch64.rpm
kernel-headers-5.14.0-362.18.1.el9_3.aarch64.rpm
kernel-tools-5.14.0-362.18.1.el9_3.aarch64.rpm
kernel-tools-libs-5.14.0-362.18.1.el9_3.aarch64.rpm
perf-5.14.0-362.18.1.el9_3.aarch64.rpm
python3-perf-5.14.0-362.18.1.el9_3.aarch64.rpm
kernel-cross-headers-5.14.0-362.18.1.el9_3.aarch64.rpm
kernel-tools-libs-devel-5.14.0-362.18.1.el9_3.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates//kernel-5.14.0-362.18.1.el9_3.src.rpm

Related CVEs:

CVE-2022-3545
CVE-2022-36402
CVE-2022-41858
CVE-2023-2166
CVE-2023-2176
CVE-2023-3777
CVE-2023-3812
CVE-2023-4015
CVE-2023-4622
CVE-2023-4623
CVE-2023-5178
CVE-2023-5633
CVE-2023-6679
CVE-2023-38409
CVE-2023-40283
CVE-2023-42753
CVE-2023-46813

Description of changes:

[5.14.0-362.18.1.el9_3.OL9]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove nmap references from kernel (Mridula Shastry) [Orabug: 34313944]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Disable unified kernel image package build
- Add Oracle Linux IMA certificates

[5.14.0]
- Debranding patches copied from Rocky Linux (Louis Abel and Sherif Nagy from RESF)

[5.14.0-362.18.1.el9_3]
- nfp: fix use-after-free in area_cache_get() (Ricardo Robaina) [RHEL-19456 RHEL-19536 RHEL-6566 RHEL-7241] {CVE-2022-3545}
- rtla: Fix uninitialized variable found (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/timerlat: Do not stop user-space if a cpu is offline (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/timerlat_aa: Fix previous IRQ delay for IRQs that happens after thread sample (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/timerlat_aa: Fix negative IRQ delay (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/timerlat_aa: Zero thread sum after every sample analysis (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/timerlat_hist: Add timerlat user-space support (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/timerlat_top: Add timerlat user-space support (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/hwnoise: Reduce runtime to 75% (John Kacur) [RHEL-18360 RHEL-10079]
- rtla: Start the tracers after creating all instances (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/timerlat_hist: Add auto-analysis support (John Kacur) [RHEL-18360 RHEL-10079]
- rtla/timerlat: Give timerlat auto analysis its own instance (John Kacur) [RHEL-18360 RHEL-10079]
- rtla: Automatically move rtla to a house-keeping cpu (John Kacur) [RHEL-18360 RHEL-10079]
- rtla: Change monitored_cpus from char * to cpu_set_t (John Kacur) [RHEL-18360 RHEL-10079]
- rtla: Add --house-keeping option (John Kacur) [RHEL-18360 RHEL-10079]
- rtla: Add -C cgroup support (John Kacur) [RHEL-18360 RHEL-10079]
- ata: ahci: Add Intel Alder Lake-P AHCI controller to low power chipsets list (Tomas Henzl) [RHEL-19394 RHEL-10941]
- fbcon: set_con2fb_map needs to set con2fb_map! (Jocelyn Falempe) [RHEL-1106 RHEL-1109 RHEL-12930 RHEL-13899] {CVE-2023-38409}
- fbcon: Fix error paths in set_con2fb_map (Jocelyn Falempe) [RHEL-1106 RHEL-1109 RHEL-12930 RHEL-13899] {CVE-2023-38409}
- net: tun: fix bugs for oversize packet when napi frags enabled (Ricardo Robaina) [RHEL-12495 RHEL-12496 RHEL-7186 RHEL-7264] {CVE-2023-3812}
- netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR (Florian Westphal) [RHEL-10536 RHEL-10538 RHEL-10537 RHEL-10539] {CVE-2023-4015}
- md: Put the right device in md_seq_next (Nigel Croxon) [RHEL-16363 RHEL-12455]
- dpll: sanitize possible null pointer dereference in dpll_pin_parent_pin_set() (Michal Schmidt) [RHEL-19677 RHEL-19095] {CVE-2023-6679}
- dpll: Fix potential msg memleak when genlmsg_put_reply failed (Michal Schmidt) [RHEL-19677 RHEL-19095] {CVE-2023-6679}
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Bastien Nocera) [RHEL-19003 RHEL-2717] {CVE-2023-40283}
- tcp: enforce receive buffer memory limits by allowing the tcp window to shrink (Felix Maurer) [RHEL-16129 RHEL-11592]
- tcp: adjust rcv_ssthresh according to sk_reserved_mem (Felix Maurer) [RHEL-16129 RHEL-11592]
- md: raid0: account for split bio in iostat accounting (Nigel Croxon) [RHEL-4082 RHEL-2718]
- can: af_can: fix NULL pointer dereference in can_rcv_filter (Ricardo Robaina) [RHEL-19465 RHEL-19526 RHEL-6428 RHEL-7052] {CVE-2023-2166}