-
Tue Jun 28 2022 Stephen Brennan <stephen.s.brennan@oracle.com> [5.14.0-70.17.1.0.1.el9_0.OL9]
- lockdown: also lock down previous kgdb use (Daniel Thompson) [Orabug: 34290418] {CVE-2022-21499}
-
Tue Jun 28 2022 Natalya Naumova <natalya.naumova@oracle.com> [5.14.0-70.17.1.el9_0.OL9]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 < 15.3-1.0.4.el9
- Remove nmap references from kernel (Mridula Shastry) [Orabug: 34313944]
-
Tue Jun 14 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-70.17.1.el9_0]
- netfilter: nf_tables: disallow non-stateful expression in sets earlier (Phil Sutter) [2092994 2092995] {CVE-2022-1966}
- thunderx nic: mark device as unmaintained (Íñigo Huguet) [2092638 2060285]
- pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init (Steve Best) [2092255 2067770]
- perf: Fix sys_perf_event_open() race against self (Michael Petlan) [2087963 2087964] {CVE-2022-1729}
- spec: Fix separate tools build (Jiri Olsa) [2090852 2054579]
- mm: lru_cache_disable: replace work queue synchronization with synchronize_rcu (Marcelo Tosatti) [2086963 2033500]
-
Wed Jun 08 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-70.16.1.el9_0]
- dm integrity: fix memory corruption when tag_size is less than digest size (Benjamin Marzinski) [2082187 2081778]
-
Wed Jun 01 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-70.15.1.el9_0]
- CI: Use zstream builder image (Veronika Kabatova)
- tcp: drop the hash_32() part from the index calculation (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
- tcp: increase source port perturb table to 2^16 (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
- tcp: dynamically allocate the perturb table used by source ports (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
- tcp: add small random increments to the source port (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
- tcp: resalt the secret every 10 seconds (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
- tcp: use different parts of the port_offset for index and offset (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
- secure_seq: use the 64 bits of the siphash for port offset calculation (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
- Revert "netfilter: conntrack: tag conntracks picked up in local out hook" (Florian Westphal) [2085480 2061850]
- Revert "netfilter: nat: force port remap to prevent shadowing well-known ports" (Florian Westphal) [2085480 2061850]
- redhat/koji/Makefile: Decouple koji Makefile from Makefile.common (Andrea Claudi)
- redhat: fix make {distg-brew,distg-koji} (Andrea Claudi)
- esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca) [2082950 2082951] {CVE-2022-27666}
- esp: Fix possible buffer overflow in ESP transformation (Sabrina Dubroca) [2082950 2082951] {CVE-2022-27666}
- sctp: use the correct skb for security_sctp_assoc_request (Ondrej Mosnacek) [2084044 2078856]
- security: implement sctp_assoc_established hook in selinux (Ondrej Mosnacek) [2084044 2078856]
- security: add sctp_assoc_established hook (Ondrej Mosnacek) [2084044 2078856]
- security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej Mosnacek) [2084044 2078856]
- security: pass asoc to sctp_assoc_request and sctp_sk_clone (Ondrej Mosnacek) [2084044 2078856]
-
Wed May 11 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-70.14.1.el9_0]
- PCI: hv: Propagate coherence from VMbus device to PCI device (Vitaly Kuznetsov) [2074830 2068432]
- Drivers: hv: vmbus: Propagate VMbus coherence to each VMbus device (Vitaly Kuznetsov) [2074830 2068432]
- redhat: rpminspect: disable 'patches' check for known empty patch files (Herton R. Krzesinski)
- redhat/configs: make SHA512_arch algos and CRYPTO_USER built-ins (Vladis Dronov) [2072643 2070624]
- CI: Drop baseline runs (Veronika Kabatova)
-
Thu Apr 14 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-70.13.1.el9_0]
- redhat: disable uncommon media device infrastructure (Jarod Wilson) [2074598]
- netfilter: nf_tables: unregister flowtable hooks on netns exit (Florian Westphal) [2056869]
- netfilter: nf_tables_offload: incorrect flow offload action array size (Florian Westphal) [2056869] {CVE-2022-25636}
- netfilter: nf_tables: validate registers coming from userspace. (Phil Sutter) [2065350] {CVE-2022-1015}
- scsi: qedi: Fix failed disconnect handling (Chris Leech) [2071524]
- scsi: iscsi: Fix unbound endpoint error handling (Chris Leech) [2071524]
- scsi: iscsi: Fix conn cleanup and stop race during iscsid restart (Chris Leech) [2071524]
- scsi: iscsi: Fix endpoint reuse regression (Chris Leech) [2071524]
- scsi: iscsi: Release endpoint ID when its freed (Chris Leech) [2071524]
- scsi: iscsi: Fix offload conn cleanup when iscsid restarts (Chris Leech) [2071524]
- Revert "scsi: iscsi: Fix offload conn cleanup when iscsid restarts" (Chris Leech) [2071524]
- scsi: iscsi: Speed up session unblocking and removal (Chris Leech) [2071524]
- scsi: iscsi: Fix recovery and unblocking race (Chris Leech) [2071524]
- scsi: qedi: Fix cmd_cleanup_cmpl counter mismatch issue (Chris Leech) [2071524]
- scsi: iscsi: Unblock session then wake up error handler (Chris Leech) [2071524]
- scsi: iscsi: Fix set_param() handling (Chris Leech) [2071524]
- scsi: iscsi: Fix iscsi_task use after free (Chris Leech) [2071524]
- scsi: iscsi: Adjust iface sysfs attr detection (Chris Leech) [2071524]
- scsi: qedi: Add support for fastpath doorbell recovery (Chris Leech) [2071524]
-
Tue Apr 12 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-70.12.1.el9_0]
- redhat/configs: Enable WDT devices used by qemu VMs (Prarit Bhargava) [2074160]
- redhat/configs: disable CONFIG_CAN_SOFTING (Brian Masney) [2073521]
-
Fri Apr 08 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-70.11.1.el9_0]
- myri10ge: mark as unmaintained (Michal Schmidt) [2054208]
- benet: mark device 0xe220 (Lancer) as unmaintained (Michal Schmidt) [2054208]
- bnx2: mark as unmaintained (Michal Schmidt) [2054208]
- ice: Fix race condition during interface enslave (Petr Oros) [1988953]
- ice: Fix error with handling of bonding MTU (Petr Oros) [1988953]
- ice: Avoid RTNL lock when re-creating auxiliary device (Petr Oros) [1988953]
- ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler (Petr Oros) [1988953]
-
Wed Apr 06 2022 Herton R. Krzesinski <herton@redhat.com> [5.14.0-70.10.1.el9_0]
- CI: Remove deprecated option (Veronika Kabatova)
- scsi: iscsi: Fix nop handling during conn recovery (Chris Leech) [2069973]
- scsi: iscsi: Merge suspend fields (Chris Leech) [2069973]
- scsi: iscsi: Fix offload conn cleanup when iscsid restarts (Chris Leech) [2069973]
- scsi: iscsi: Move iscsi_ep_disconnect (Chris Leech) [2069973]