[Oraclevm-errata] OVMSA-2023-0018 Important: Oracle VM 3 Extended Lifecycle Support (ELS) Unbreakable Enterprise kernel security update

[Errata Announcements for Oracle VM]

Oracle VM Security Advisory OVMSA-2023-0018

The following updated rpms for Oracle VM 3 Extended Lifecycle Support (ELS) have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-uek-4.1.12-124.77.2.el6uek.x86_64.rpm
kernel-uek-firmware-4.1.12-124.77.2.el6uek.noarch.rpm



Related CVEs:

CVE-2023-1380
CVE-2023-3161
CVE-2023-3141
CVE-2023-3090
CVE-2022-41218
CVE-2023-31084
CVE-2023-35824




Description of changes:

[4.1.12-124.77.2.el6uek]
- media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)  [Orabug: 35514108]  {CVE-2023-35824}
- media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai)  [Orabug: 35477742]  {CVE-2023-31084}
- media: dvb_frontend: fix locking issues at dvb_frontend_get_event() (Mauro Carvalho Chehab)  [Orabug: 35477742]  {CVE-2023-31084}
- media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai)  [Orabug: 34820632]  {CVE-2022-41218}
- media: dvb: dmx: fixed coding style issues of spacing (devendra sharma)  [Orabug: 34820632]

[4.1.12-124.77.1.el6uek]
- ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng)  [Orabug: 35550146]  {CVE-2023-3090}
- memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang)  [Orabug: 35514146]  {CVE-2023-3141}
- fbcon: Check font dimension limits (Samuel Thibault)  [Orabug: 35493679]  {CVE-2023-3161}
- wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang)  [Orabug: 35250538]  {CVE-2023-1380}

[4.1.12-124.76.2.el6uek]
- firewire: fix potential uaf in outbound_phy_packet_callback() (Chengfeng Ye)  [Orabug: 35493606]  {CVE-2023-3159}
- ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (Pavel Skripkin)  [Orabug: 35448003]  {CVE-2022-1679}
- dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer)  [Orabug: 35354880]  {CVE-2023-2269}
- media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (Duoming Zhou)  [Orabug: 35181652]  {CVE-2023-1118}
- misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (Zheng Wang)  [Orabug: 35180779]  {CVE-2022-3424}

[4.1.12-124.76.1.el6uek]
- ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)  [Orabug: 35457204]  {CVE-2023-34256}
- igmp: Add ip_mc_list lock in ip_check_mc_rcu (Liu Jian)  [Orabug: 35448048]  {CVE-2022-20141}

[4.1.12-124.75.3.el6uek]
- net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung)  [Orabug: 35354791]  {CVE-2023-2248}

[4.1.12-124.75.2.el6uek]
- prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman)  [Orabug: 35354303]  {CVE-2023-0458}
- kernel/sys.c: fix potential Spectre v1 issue (Gustavo A. R. Silva)  [Orabug: 35354303]
- xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang)  [Orabug: 35250898]  {CVE-2023-1670}
- net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim)  [Orabug: 34983586]  {CVE-2023-23454}

[4.1.12-124.75.1.el6uek]
- media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong)  [Orabug: 35312830]  {CVE-2023-28328}
- scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie)  [Orabug: 35312683]  {CVE-2023-2162}
- nvme: restrict management ioctls to admin (Keith Busch)  [Orabug: 34619368]  {CVE-2022-3169}

[4.1.12-124.74.2.el6uek]
- kvm: initialize all of the kvm_debugregs structure before sending it to userspace (Greg Kroah-Hartman)  [Orabug: 35250098]  {CVE-2023-1513}
- staging: rtl8712: fix use after free bugs (Dan Carpenter)  [Orabug: 35212876]  {CVE-2022-4095}
- staging: rtl8712: rtl8712_cmd.c: fixed comparison to null (Juliana Rodrigues)  [Orabug: 35212876]  {CVE-2022-4095}
- wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich)  [Orabug: 35037715]  {CVE-2023-23559}

[4.1.12-124.74.1.el6uek]
- seq_buf: Fix overflow in seq_buf_putmem_hex() (Yun Zhou)  [Orabug: 35217595]  {CVE-2023-28772}
- net: mpls: fix stale pointer if allocation fails during device rename (Jakub Kicinski)  [Orabug: 35181964]  {CVE-2023-26545}