-
Mon Apr 01 2024 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.84.2.el7uek]
- netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36251327] {CVE-2024-1086}
-
Tue Mar 05 2024 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.84.1.el7uek]
- mm: avoid conflict between MADV_DOEXEC and upstream advice values (Anthony Yznaga) [Orabug: 36334311]
- kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai) [Orabug: 35924076] {CVE-2023-45863}
- kobject: Replace strncpy with memcpy (Guenter Roeck) [Orabug: 35924076]
- net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma) [Orabug: 35923517] {CVE-2023-39194}
- net/xfrm: use kmemdup rather than duplicating its implementation (Andrzej Hajda) [Orabug: 35923517]
-
Tue Feb 20 2024 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.83.2.el7uek]
- Input: add bounds checking to input_set_capability() (Jeff LaBundy) [Orabug: 36192120] {CVE-2022-48619}
- netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua) [Orabug: 36155598] {CVE-2023-7192}
-
Tue Feb 13 2024 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.83.1.el7uek]
- ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o) [Orabug: 36229451] {CVE-2024-0775}
- atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim) [Orabug: 36229396] {CVE-2023-51780}
- Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails (Thadeu Lima de Souza Cascardo) [Orabug: 36229182] {CVE-2021-34981}
-
Tue Jan 23 2024 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.82.2.el7uek]
- Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi) [Orabug: 35959598] {CVE-2020-26555}
- sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello) [Orabug: 35181560] {CVE-2023-1077}
- sched/debug: Fix SCHED_WARN_ON() to return a value on !CONFIG_SCHED_DEBUG as well (Ingo Molnar) [Orabug: 35181560]
- sched/debug: Add SCHED_WARN_ON() (Peter Zijlstra) [Orabug: 35181560]
-
Mon Jan 08 2024 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.82.1.el7uek]
- igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35924002] {CVE-2023-42752}
- net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814457] {CVE-2023-4921}
- ixgbe: fix large MTU request from VF (Samasth Norway Ananda) [Orabug: 33752821] {CVE-2021-33098}
-
Tue Dec 05 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.81.2.el7uek]
- rebuild bumping release
-
Tue Nov 21 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.81.1.el7uek]
- netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [Orabug: 35923500] {CVE-2023-39193}
- USB: ene_usb6250: Allocate enough memory for full object (Kees Cook) [Orabug: 35924058] {CVE-2023-45862}
- netfilter: xt_u32: validate user space input (Wander Lairson Costa) [Orabug: 35923470] {CVE-2023-39192}
- net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35707466] {CVE-2023-4207}
-
Mon Oct 09 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.80.1.el7uek]
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) [Orabug: 35814478] {CVE-2023-40283}
- net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814297] {CVE-2023-4208}
- RDMA/core: net: fix kernel NULL error (Zhu Yanjun) [Orabug: 35723252]
-
Wed Sep 20 2023 Alok Tiwari <alok.a.tiwari@oracle.com> [4.1.12-124.79.2.el7uek]
- net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (valis) [Orabug: 35814273] {CVE-2023-4206}
- net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela) [Orabug: 35636291] {CVE-2023-3611}
- rds: Fix lack of reentrancy for connection reset with dst addr zero (Håkon Bugge) [Orabug: 35741584] [Orabug: 35818110] {CVE-2023-22024}