Oracle9: ELSA-2022-5249: kernel Important Security Update

Advisories

Oracle Linux Security Advisory ELSA-2022-5249

https://linux.oracle.com/errata/ELSA-2022-5249.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unb=
reakable Linux Network:


x86_64:
bpftool-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-abi-stablelists-5.14.0-70.17.1.0.1.el9_0.noarch.rpm
kernel-core-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-debug-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-debug-core-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-debug-devel-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-debug-devel-matched-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-debug-modules-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-debug-modules-extra-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-devel-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-devel-matched-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-doc-5.14.0-70.17.1.0.1.el9_0.noarch.rpm
kernel-headers-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-modules-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-modules-extra-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-tools-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-tools-libs-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
perf-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
python3-perf-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-cross-headers-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm
kernel-tools-libs-devel-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm

aarch64:
bpftool-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm
kernel-headers-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm
kernel-tools-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm
kernel-tools-libs-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm
perf-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm
python3-perf-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm
kernel-cross-headers-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm
kernel-tools-libs-devel-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm


SRPMS:
https://oss.oracle.com/ol9/SRPMS-updates/kernel-5.14.0-70.17.1.0.1.el9_0.src=
.rpm

Related CVEs:

CVE-2022-1012
CVE-2022-1729
CVE-2022-1966
CVE-2022-27666




Description of changes:

[5.14.0-70.17.1.0.1.el9_0.OL9]
- lockdown: also lock down previous kgdb use (Daniel Thompson) [Orabug: 342=
90418] {CVE-2022-21499}

[5.14.0-70.17.1.el9_0.OL9]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys=
 list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 < 15.3-1.0.4.el9
- Remove nmap references from kernel (Mridula Shastry) [Orabug: 34313944]

[5.14.0-70.17.1.el9_0]
- netfilter: nf_tables: disallow non-stateful expression in sets earlier (P=
hil Sutter) [2092994 2092995] {CVE-2022-1966}
- thunderx nic: mark device as unmaintained (=CD=F1igo Huguet) [2092638 206=
0285]
- pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init (Steve Be=
st) [2092255 2067770]
- perf: Fix sys_perf_event_open() race against self (Michael Petlan) [20879=
63 2087964] {CVE-2022-1729}
- spec: Fix separate tools build (Jiri Olsa) [2090852 2054579]
- mm: lru_cache_disable: replace work queue synchronization with synchroniz=
e_rcu (Marcelo Tosatti) [2086963 2033500]

[5.14.0-70.16.1.el9_0]
- dm integrity: fix memory corruption when tag_size is less than digest siz=
e (Benjamin Marzinski) [2082187 2081778]

[5.14.0-70.15.1.el9_0]
- CI: Use zstream builder image (Veronika Kabatova)
- tcp: drop the hash_32() part from the index calculation (Guillaume Nault)=
 [2087128 2064868] {CVE-2022-1012}
- tcp: increase source port perturb table to 2^16 (Guillaume Nault) [208712=
8 2064868] {CVE-2022-1012}
- tcp: dynamically allocate the perturb table used by source ports (Guillau=
me Nault) [2087128 2064868] {CVE-2022-1012}
- tcp: add small random increments to the source port (Guillaume Nault) [20=
87128 2064868] {CVE-2022-1012}
- tcp: resalt the secret every 10 seconds (Guillaume Nault) [2087128 206486=
8] {CVE-2022-1012}
- tcp: use different parts of the port_offset for index and offset (Guillau=
me Nault) [2087128 2064868] {CVE-2022-1012}
- secure_seq: use the 64 bits of the siphash for port offset calculation (G=
uillaume Nault) [2087128 2064868] {CVE-2022-1012}
- Revert "netfilter: conntrack: tag conntracks picked up in local out hook"=
 (Florian Westphal) [2085480 2061850]
- Revert "netfilter: nat: force port remap to prevent shadowing well-known =
ports" (Florian Westphal) [2085480 2061850]
- redhat/koji/Makefile: Decouple koji Makefile from Makefile.common (Andrea=
 Claudi)
- redhat: fix make {distg-brew,distg-koji} (Andrea Claudi)
- esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca) [2=
082950 2082951] {CVE-2022-27666}
- esp: Fix possible buffer overflow in ESP transformation (Sabrina Dubroca)=
 [2082950 2082951] {CVE-2022-27666}
- sctp: use the correct skb for security_sctp_assoc_request (Ondrej Mosnace=
k) [2084044 2078856]
- security: implement sctp_assoc_established hook in selinux (Ondrej Mosnac=
ek) [2084044 2078856]
- security: add sctp_assoc_established hook (Ondrej Mosnacek) [2084044 2078=
856]
- security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej =
Mosnacek) [2084044 2078856]
- security: pass asoc to sctp_assoc_request and sctp_sk_clone (Ondrej Mosna=
cek) [2084044 2078856]

[5.14.0-70.14.1.el9_0]
- PCI: hv: Propagate coherence from VMbus device to PCI device (Vitaly Kuzn=
etsov) [2074830 2068432]
- Drivers: hv: vmbus: Propagate VMbus coherence to each VMbus device (Vital=
y Kuznetsov) [2074830 2068432]
- redhat: rpminspect: disable 'patches' check for known empty patch files (=
Herton R. Krzesinski)
- redhat/configs: make SHA512_arch algos and CRYPTO_USER built-ins (Vladis =
Dronov) [2072643 2070624]
- CI: Drop baseline runs (Veronika Kabatova)

_______________________________________________
El-errata mailing list
[email protected]
https://oss.oracle.com/mailman/listinfo/el-errata

Oracle9: ELSA-2022-5249: kernel Important Security Update

Summary

Description of changes: [5.14.0-70.17.1.0.1.el9_0.OL9] - lockdown: also lock down previous kgdb use (Daniel Thompson) [Orabug: 342= 90418] {CVE-2022-21499} [5.14.0-70.17.1.el9_0.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys= list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x64 < 15.3-1.0.4.el9 - Remove nmap references from kernel (Mridula Shastry) [Orabug: 34313944] [5.14.0-70.17.1.el9_0] - netfilter: nf_tables: disallow non-stateful expression in sets earlier (P= hil Sutter) [2092994 2092995] {CVE-2022-1966} - thunderx nic: mark device as unmaintained (=CD=F1igo Huguet) [2092638 206= 0285] - pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init (Steve Be= st) [2092255 2067770] - perf: Fix sys_perf_event_open() race against self (Michael Petlan) [20879= 63 2087964] {CVE-2022-1729} - spec: Fix separate tools build (Jiri Olsa) [2090852 2054579] - mm: lru_cache_disable: replace work queue synchronization with synchroniz= e_rcu (Marcelo Tosatti) [2086963 2033500] [5.14.0-70.16.1.el9_0] - dm integrity: fix memory corruption when tag_size is less than digest siz= e (Benjamin Marzinski) [2082187 2081778] [5.14.0-70.15.1.el9_0] - CI: Use zstream builder image (Veronika Kabatova) - tcp: drop the hash_32() part from the index calculation (Guillaume Nault)= [2087128 2064868] {CVE-2022-1012} - tcp: increase source port perturb table to 2^16 (Guillaume Nault) [208712= 8 2064868] {CVE-2022-1012} - tcp: dynamically allocate the perturb table used by source ports (Guillau= me Nault) [2087128 2064868] {CVE-2022-1012} - tcp: add small random increments to the source port (Guillaume Nault) [20= 87128 2064868] {CVE-2022-1012} - tcp: resalt the secret every 10 seconds (Guillaume Nault) [2087128 206486= 8] {CVE-2022-1012} - tcp: use different parts of the port_offset for index and offset (Guillau= me Nault) [2087128 2064868] {CVE-2022-1012} - secure_seq: use the 64 bits of the siphash for port offset calculation (G= uillaume Nault) [2087128 2064868] {CVE-2022-1012} - Revert "netfilter: conntrack: tag conntracks picked up in local out hook"= (Florian Westphal) [2085480 2061850] - Revert "netfilter: nat: force port remap to prevent shadowing well-known = ports" (Florian Westphal) [2085480 2061850] - redhat/koji/Makefile: Decouple koji Makefile from Makefile.common (Andrea= Claudi) - redhat: fix make {distg-brew,distg-koji} (Andrea Claudi) - esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca) [2= 082950 2082951] {CVE-2022-27666} - esp: Fix possible buffer overflow in ESP transformation (Sabrina Dubroca)= [2082950 2082951] {CVE-2022-27666} - sctp: use the correct skb for security_sctp_assoc_request (Ondrej Mosnace= k) [2084044 2078856] - security: implement sctp_assoc_established hook in selinux (Ondrej Mosnac= ek) [2084044 2078856] - security: add sctp_assoc_established hook (Ondrej Mosnacek) [2084044 2078= 856] - security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej = Mosnacek) [2084044 2078856] - security: pass asoc to sctp_assoc_request and sctp_sk_clone (Ondrej Mosna= cek) [2084044 2078856] [5.14.0-70.14.1.el9_0] - PCI: hv: Propagate coherence from VMbus device to PCI device (Vitaly Kuzn= etsov) [2074830 2068432] - Drivers: hv: vmbus: Propagate VMbus coherence to each VMbus device (Vital= y Kuznetsov) [2074830 2068432] - redhat: rpminspect: disable 'patches' check for known empty patch files (= Herton R. Krzesinski) - redhat/configs: make SHA512_arch algos and CRYPTO_USER built-ins (Vladis = Dronov) [2072643 2070624] - CI: Drop baseline runs (Veronika Kabatova)

i386

x86_64

bpftool-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-abi-stablelists-5.14.0-70.17.1.0.1.el9_0.noarch.rpm kernel-core-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-debug-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-debug-core-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-debug-devel-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-debug-devel-matched-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-debug-modules-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-debug-modules-extra-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-devel-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-devel-matched-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-doc-5.14.0-70.17.1.0.1.el9_0.noarch.rpm kernel-headers-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-modules-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-modules-extra-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-tools-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-tools-libs-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm perf-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm python3-perf-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-cross-headers-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm kernel-tools-libs-devel-5.14.0-70.17.1.0.1.el9_0.x86_64.rpm aarch64: bpftool-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm kernel-headers-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm kernel-tools-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm kernel-tools-libs-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm perf-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm python3-perf-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm kernel-cross-headers-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm kernel-tools-libs-devel-5.14.0-70.17.1.0.1.el9_0.aarch64.rpm

SRPMS

https://oss.oracle.com/ol9/SRPMS-updates/kernel-5.14.0-70.17.1.0.1.el9_0.src= .rpm

Severity
Related CVEs: CVE-2022-1012 CVE-2022-1729 CVE-2022-1966 CVE-2022-27666

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.