El-errata: ELSA-2021-0558 Important: Oracle Linux 8 kernel security, bug fix, and enhancement update
Oracle Linux Security Advisory ELSA-2021-0558
http://linux.oracle.com/errata/ELSA-2021-0558.html
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
x86_64:
bpftool-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-abi-whitelists-4.18.0-240.15.1.el8_3.noarch.rpm
kernel-core-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-cross-headers-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-debug-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-debug-core-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-debug-devel-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-debug-modules-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-debug-modules-extra-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-devel-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-doc-4.18.0-240.15.1.el8_3.noarch.rpm
kernel-headers-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-modules-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-modules-extra-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-tools-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-tools-libs-4.18.0-240.15.1.el8_3.x86_64.rpm
perf-4.18.0-240.15.1.el8_3.x86_64.rpm
python3-perf-4.18.0-240.15.1.el8_3.x86_64.rpm
kernel-tools-libs-devel-4.18.0-240.15.1.el8_3.x86_64.rpm
aarch64:
bpftool-4.18.0-240.15.1.el8_3.aarch64.rpm
kernel-cross-headers-4.18.0-240.15.1.el8_3.aarch64.rpm
kernel-headers-4.18.0-240.15.1.el8_3.aarch64.rpm
kernel-tools-4.18.0-240.15.1.el8_3.aarch64.rpm
kernel-tools-libs-4.18.0-240.15.1.el8_3.aarch64.rpm
perf-4.18.0-240.15.1.el8_3.aarch64.rpm
python3-perf-4.18.0-240.15.1.el8_3.aarch64.rpm
kernel-tools-libs-devel-4.18.0-240.15.1.el8_3.aarch64.rpm
SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-4.18.0-240.15.1.el8_3.src.rpm
Description of changes:
[4.18.0-240.15.1.el8_3.OL8]
- Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 pgrp locking in tiocspgrp() (Waiman Long) [1908196 1908197] {CVE-2020-29661}
- [x86] x86/tboot: Don't disable swiotlb when iommu is forced on (Tony Camuso) [1911555 1883395]
- [iommu] iommu/vt-d: Avoid panic if iommu init fails in tboot system (Tony Camuso) [1911555 1883395]
- [kernel] sched/deadline: Fix priority inheritance with multiple scheduling classes (Phil Auld) [1908731 1780490]
- [kernel] locking/rwsem: Remove reader optimistic spinning (Waiman Long) [1908519 1895046]
- [kernel] locking/rwsem: Enable reader optimistic lock stealing (Waiman Long) [1908519 1895046]
- [kernel] locking/rwsem: Prevent potential lock starvation (Waiman Long) [1908519 1895046]
- [kernel] locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath() (Waiman Long) [1908519 1895046]
- [kernel] locking/rwsem: Fold __down_{read,write}*() (Waiman Long) [1908519 1895046]
- [kernel] locking/rwsem: Introduce rwsem_write_trylock() (Waiman Long) [1908519 1895046]
- [kernel] locking/rwsem: Better collate rwsem_read_trylock() (Waiman Long) [1908519 1895046]
- [kernel] rwsem: Implement down_read_interruptible (Waiman Long) [1908519 1895046]
- [kernel] rwsem: Implement down_read_killable_nested (Waiman Long) [1908519 1895046]
- [firmware] efi/esrt: Only call efi_mem_reserve() for boot services memory (Kairui Song) [1907775 1878024]
- [firmware] efi: Drop type and attribute checks in efi_mem_desc_lookup() (Kairui Song) [1907775 1878024]
- [scsi] scsi: core: Don't start concurrent async scan on same host (Ming Lei) [1905214 1874501]
[4.18.0-240.13.1.el8_3]
- [arm64] arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (Andrew Jones) [1909577 1908439]
- [arm64] arm64: pgtable: Fix pte_accessible() (Andrew Jones) [1909577 1908439]
- [net] icmp: randomize the global rate limiter (Guillaume Nault) [1906371 1896516] {CVE-2020-25705}
- [tools] kvm: x86: do not attempt TSC synchronization on guest writes (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: x86: fix MSR_IA32_TSC read for nested migration (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: nsvm: delay MSR permission processing to first nested VM run (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: x86: rename KVM_REQ_GET_VMCS12_PAGES (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: use __GFP_ZERO instead of clear_page (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: refactor msr permission bitmap allocation (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: rename a variable in the svm_create_vcpu (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: nsvm: Avoid freeing uninitialized pointers in svm_set_nested_state() (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: nested: Don't allocate VMCB structures on stack (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: nsvm: more strict SMM checks when returning to nested guest (Paolo Bonzini) [1905084 1898018]
- [x86] svm: nsvm: setup nested msr permission bitmap on nested state load (Paolo Bonzini) [1905084 1898018]
- [x86] svm: nsvm: correctly restore GIF on vmexit from nesting after migration (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: avoid emulation with stale next_rip (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: nsvm: remove nonsensical EXITINFO1 adjustment on nested NPF (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: Rename svm_nested_virtualize_tpr() to nested_svm_virtualize_tpr() (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: Add svm_ prefix to set/clr/is_intercept() (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: Add vmcb_ prefix to mark_*() functions (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: svm: Rename struct nested_state to svm_nested_state (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: nsvm: Check that DR6[63:32] and DR7[64:32] are not set on vmrun of nested guests (Paolo Bonzini) [1905084 1898018]
- [x86] kvm: x86: Move the check for upper 32 reserved bits of DR6 to separate function (Paolo Bonzini) [1905084 1898018]
- [netdrv] net/mlx5e: Add IPv6 traffic class (DSCP) header rewrite support (Alaa Hleihel) [1897688 1889981]
- [netdrv] net/mlx5e: Fix endianness when calculating pedit mask first bit (Alaa Hleihel) [1897688 1889981]
- [net] openvswitch: fix to make sure flow_lookup() is not preempted (Eelco Chaudron) [1893281 1888237]
[4.18.0-240.12.1.el8_3]
- [net] SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() (Steve Dickson) [1912478 1884361]
- [net] SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") (Steve Dickson) [1912478 1884361]
- [mm] x86/ioremap: Map EFI runtime services data as encrypted for SEV (Lenny Szubowicz) [1909243 1883134]
- [kernel] sched/deadline: Unthrottle PI boosted threads while enqueuing (Daniel Bristot de Oliveira) [1913964 1869760]
- [kernel] sched/deadline: Fix stale throttling on de-/boosted tasks (Daniel Bristot de Oliveira) [1913964 1869760]
- [fs] NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall (Scott Mayhew) [1908313 1881550]
- [fs] NFS: Fix interrupted slots by sending a solo SEQUENCE operation (Scott Mayhew) [1908312 1887577]
- [net] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal (Antoine Tenart) [1907576 1901026]
- [powerpc] powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler (Diego Domingos) [1907301 1891822]
- [powerpc] powerpc/powernv/dump: Handle multiple writes to ack attribute (Diego Domingos) [1907301 1891822]
- [powerpc] powerpc/powernv/dump: Fix race while processing OPAL dump (Diego Domingos) [1907301 1891822]
- [powerpc] powerpc/opal_elog: Handle multiple writes to ack attribute (Diego Domingos) [1907301 1891822]
- [powerpc] powerpc/powernv/elog: Fix race while processing OPAL error log event (Diego Domingos) [1907301 1891822]
- [block] block: fix incorrect branching in blk_max_size_offset() (Mike Snitzer) [1905136 1903722]
- [md] dm: fix IO splitting (Mike Snitzer) [1905136 1903722]
- [block] block: fix get_max_io_size() (Mike Snitzer) [1905136 1903722]
- [block] block: Improve physical block alignment of split bios (Mike Snitzer) [1905136 1903722]
- [block] block: use gcd() to fix chunk_sectors limit stacking (Mike Snitzer) [1905136 1903722]
- [netdrv] net/mlx5e: Add LAG warning if bond slave is not lag master (Alaa Hleihel) [1892344 1851709]
- [netdrv] net/mlx5e: Add LAG warning for unsupported tx type (Alaa Hleihel) [1892344 1851709]
- [netdrv] net/mlx5e: Return a valid errno if can't get lag device index (Alaa Hleihel) [1892344 1851709]
- [net] openvswitch: handle DNAT tuple collision (Dumitru Ceara) [1892744 1877128]
- [mm] mm/page_idle.c: skip offline pages (Chris von Recklinghausen) [1903019 1867490]
- [include] mm/hotplug: invalid PFNs from pfn_to_online_page() (Waiman Long) [1903019 1878006]
[4.18.0-240.11.1.el8_3]
- [scsi] scsi: core: Return BLK_STS_AGAIN for ALUA transitioning (Ewan Milne) [1900112 1867264]
- [scsi] scsi: scsi_dh_alua: Set 'transitioning' state on Unit Attention (Ewan Milne) [1900112 1867264]
- [scsi] scsi: scsi_dh_alua: Return BLK_STS_AGAIN for ALUA transitioning state (Ewan Milne) [1900112 1867264]
- [block] scsi: block: Return status code in blk_mq_end_request() (Ewan Milne) [1900112 1867264]
- [include] compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use (Ivan Vecera) [1900112 1867168]
- [net] net: sctp: Rename fallthrough label to unhandled (Ivan Vecera) [1900112 1867168]
- [idle] intel_idle: Customize IceLake server support (David Arcari) [1897183 1881620]
A kernel security, bug fix, and enhancement update has been released for Oracle Linux 8.
