-
Tue Jan 23 2024 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.82.2.el7uek]
- Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi) [Orabug: 35959598] {CVE-2020-26555}
- sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello) [Orabug: 35181560] {CVE-2023-1077}
- sched/debug: Fix SCHED_WARN_ON() to return a value on !CONFIG_SCHED_DEBUG as well (Ingo Molnar) [Orabug: 35181560]
- sched/debug: Add SCHED_WARN_ON() (Peter Zijlstra) [Orabug: 35181560]
-
Mon Jan 08 2024 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.82.1.el7uek]
- igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35924002] {CVE-2023-42752}
- net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814457] {CVE-2023-4921}
- ixgbe: fix large MTU request from VF (Samasth Norway Ananda) [Orabug: 33752821] {CVE-2021-33098}
-
Tue Dec 05 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.81.2.el7uek]
- rebuild bumping release
-
Tue Nov 21 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.81.1.el7uek]
- netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [Orabug: 35923500] {CVE-2023-39193}
- USB: ene_usb6250: Allocate enough memory for full object (Kees Cook) [Orabug: 35924058] {CVE-2023-45862}
- netfilter: xt_u32: validate user space input (Wander Lairson Costa) [Orabug: 35923470] {CVE-2023-39192}
- net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35707466] {CVE-2023-4207}
-
Mon Oct 09 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.80.1.el7uek]
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) [Orabug: 35814478] {CVE-2023-40283}
- net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814297] {CVE-2023-4208}
- RDMA/core: net: fix kernel NULL error (Zhu Yanjun) [Orabug: 35723252]
-
Wed Sep 20 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.79.2.el7uek]
- net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814273] {CVE-2023-4206}
- net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela) [Orabug: 35636291] {CVE-2023-3611}
- rds: Fix lack of reentrancy for connection reset with dst addr zero (Håkon Bugge) [Orabug: 35741584] [Orabug: 35818110] {CVE-2023-22024}
-
Tue Sep 12 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.79.1.el7uek]
- xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) [Orabug: 35754509] {CVE-2023-3772}
- net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() (Zixuan Fu) [Orabug: 35732892] {CVE-2023-4459}
- net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() (Zixuan Fu) [Orabug: 35732764] {CVE-2023-4387}
- net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan) [Orabug: 35636313] {CVE-2023-3776}
- netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) [Orabug: 35609787] {CVE-2023-35001}
- ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li) [Orabug: 35382025] {CVE-2023-2513}
- ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (Baokun Li) [Orabug: 35382025] {CVE-2023-2513}
- netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso) [Orabug: 34362008] {CVE-2022-34918}
-
Thu Sep 07 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.78.4.el7uek]
- netfilter: nf_tables: verify registers coming from userspace (Harshvardhan Jha) [Orabug: 35776867]
-
Fri Sep 01 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.78.3.el7uek]
- vc_screen: Fix a backport in vcs_read() (Harshit Mogalapalli) [Orabug: 35768682]
-
Tue Aug 22 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.78.2.el7uek]
- xfrm: fix crash in XFRM_MSG_GETSA netlink handler (Vegard Nossum) [Orabug: 35598955] {CVE-2023-3106}
- netfilter: nf_tables: validate registers coming from userspace (Harshvardhan Jha) [Orabug: 34012909] {CVE-2022-1015}