A kernel security, bug fix, and enhancement update has been released for Oracle Linux 8.

El-errata: ELSA-2023-1566 Important: Oracle Linux 8 kernel security, bug fix, and enhancement update

Oracle Linux Security Advisory ELSA-2023-1566

  http://linux.oracle.com/errata/ELSA-2023-1566.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-abi-stablelists-4.18.0-425.19.2.el8_7.noarch.rpm
kernel-core-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-cross-headers-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-debug-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-debug-core-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-debug-devel-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-debug-modules-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-debug-modules-extra-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-devel-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-doc-4.18.0-425.19.2.el8_7.noarch.rpm
kernel-headers-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-modules-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-modules-extra-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-tools-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-tools-libs-4.18.0-425.19.2.el8_7.x86_64.rpm
perf-4.18.0-425.19.2.el8_7.x86_64.rpm
python3-perf-4.18.0-425.19.2.el8_7.x86_64.rpm
kernel-tools-libs-devel-4.18.0-425.19.2.el8_7.x86_64.rpm

aarch64:
bpftool-4.18.0-425.19.2.el8_7.aarch64.rpm
kernel-cross-headers-4.18.0-425.19.2.el8_7.aarch64.rpm
kernel-headers-4.18.0-425.19.2.el8_7.aarch64.rpm
kernel-tools-4.18.0-425.19.2.el8_7.aarch64.rpm
kernel-tools-libs-4.18.0-425.19.2.el8_7.aarch64.rpm
perf-4.18.0-425.19.2.el8_7.aarch64.rpm
python3-perf-4.18.0-425.19.2.el8_7.aarch64.rpm
kernel-tools-libs-devel-4.18.0-425.19.2.el8_7.aarch64.rpm

SRPMS:
  http://oss.oracle.com/ol8/SRPMS-updates//kernel-4.18.0-425.19.2.el8_7.src.rpm

Related CVEs:

CVE-2022-4269
CVE-2022-4378
CVE-2023-0266
CVE-2023-0386



Description of changes:

[4.18.0-425.19.2.el8_7.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 result is fib6_info (Jiri Benc) [2167602 2140599]
- ceph: blocklist the kclient when receiving corrupted snap trace (Xiubo Li) [2168896 2162414]
- ceph: move mount state enum to super.h (Xiubo Li) [2168896 2162414]
- s390/kexec: fix ipl report address for kdump (Tobias Huschle) [2166296 2161328]
- mm, compaction: fix fast_isolate_around() to stay within boundaries (Daniel Vacek) [2170576 2149309]
- scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (Emanuele Giuseppe Esposito) [2170228 2150659]
- netfilter: conntrack: handle tcp challenge acks during connection reuse (Florian Westphal) [2165587 2158726]

[4.18.0-425.15.1.el8_7]
- net/mlx5e: Fix use-after-free when reverting termination table (Amir Tzin) [2167640 2112927]
- net/mlx5: Do not query pci info while pci disabled (Amir Tzin) [2167645 2129249]
- x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly (Dean Nelson) [2168384 2122850]
- x86/fpu: Exclude dynamic states from init_fpstate (Dean Nelson) [2168384 2122850]
- x86/fpu: Fix the init_fpstate size check with the actual size (Dean Nelson) [2168384 2122850]
- x86/fpu: Configure init_fpstate attributes orderly (Dean Nelson) [2168384 2122850]
- x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation (Dean Nelson) [2168384 2122850]
- net/mlx5: E-Switch, properly handle ingress tagged packets on VST (Amir Tzin) [2166665 2096109]
- cpuhotplug: Fix KABI breakage (Prarit Bhargava) [2162763 2156529]

[4.18.0-425.14.1.el8_7]
- ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems (Wei Huang) [2142170 2130653]
- KVM: x86: nSVM: implement nested LBR virtualization (Emanuele Giuseppe Esposito) [2166362 2155149]
- KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running (Emanuele Giuseppe Esposito) [2166362 2155149]
- kvm: x86: SVM: use vmcb* instead of svm->vmcb where it makes sense (Emanuele Giuseppe Esposito) [2166362 2155149]
- KVM: x86: nSVM: implement nested VMLOAD/VMSAVE (Emanuele Giuseppe Esposito) [2166362 2155149]
- IB/iser: Fix login with authentication (Kamal Heib) [2161750 2120676]
- act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti) [2164648 2131339] {CVE-2022-4269}
- net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti) [2164648 2131339] {CVE-2022-4269}
- redhat/configs: Set CONFIG_X86_AMD_PSTATE to 'm' (Prarit Bhargava) [2151275 2145246]
- KVM: x86: smm: preserve interrupt shadow in SMRAM (Maxim Levitsky) [2166368 2097144]
- KVM: x86: SVM: don't save SVM state to SMRAM when VM is not long mode capable (Maxim Levitsky) [2166368 2097144]
- KVM: x86: SVM: use smram structs (Maxim Levitsky) [2166368 2097144]
- KVM: svm: drop explicit return value of kvm_vcpu_map (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: use smram struct for 64 bit smram load/restore (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: use smram struct for 32 bit smram load/restore (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: use smram structs in the common code (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: add structs for KVM's smram layout (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: check for failures on smm entry (Maxim Levitsky) [2166368 2097144]
- KVM: x86: do not go through ctxt->ops when emulating rsm (Maxim Levitsky) [2166368 2097144]
- KVM: x86: move SMM exit to a new file (Maxim Levitsky) [2166368 2097144]
- KVM: x86: move SMM entry to a new file (Maxim Levitsky) [2166368 2097144]
- KVM: x86: start moving SMM-related functions to new files (Maxim Levitsky) [2166368 2097144]
- bug: introduce ASSERT_STRUCT_OFFSET (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Rename and expose helper to detect if INIT/SIPI are allowed (Maxim Levitsky) [2166368 2097144]
- KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format (Maxim Levitsky) [2166368 2097144]
- KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky) [2166368 2097144]
- KVM: x86: emulator: update the emulation mode after rsm (Maxim Levitsky) [2166368 2097144]
- KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky) [2166368 2097144]
- KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Bug the VM if the emulator accesses a non-existent GPR (Maxim Levitsky) [2166368 2097144]
- \KVM: x86: Reduce the number of emulator GPRs to '8' for 32-bit KVM (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Use 16-bit fields to track dirty/valid emulator GPRs (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Omit VCPU_REGS_RIP from emulator's _regs array (Maxim Levitsky) [2166368 2097144]
- \KVM: x86: Harden _regs accesses to guard against buggy input (Maxim Levitsky) [2166368 2097144]
- KVM: x86: Grab regs_dirty in local 'unsigned long' (Maxim Levitsky) [2166368 2097144]
- proc: proc_skip_spaces() shouldn't think it is working on C strings (Wander Lairson Costa) [2152571 2152572] {CVE-2022-4378}
- proc: avoid integer type confusion in get_proc_long (Wander Lairson Costa) [2152571 2152572] {CVE-2022-4378}

_______________________________________________