ELSA-2024-10939

ELSA-2024-10939 - kernel security update

Type:	SECURITY
Severity:	MODERATE
Release Date:	2024-12-11

Description

[5.14.0-503.16.1_5.OL9]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates

[5.14.0-503.16.1_5]
- s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-64902 RHEL-55873]
- net/smc: fix illegal rmb_desc access in SMC-D connection dump (Steve Best) [RHEL-65436 RHEL-27748] {CVE-2024-26615}
- gitlab-ci: use zstream builder container image (Michael Hofmann)
- netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (CKI Backport Bot) [RHEL-66856] {CVE-2024-50251}
- net: avoid potential underflow in qdisc_pkt_len_init() with UFO (CKI Backport Bot) [RHEL-65401] {CVE-2024-49949}
- block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-58761 RHEL-54768] {CVE-2024-43854}
- proc: fix dentry/inode overinstantiating under /proc//net (Joel Savitz) [RHEL-62824 RHEL-57703]
- iommu: Restore lost return in iommu_report_device_fault() (CKI Backport Bot) [RHEL-67364] {CVE-2024-44994}
- net: ena: Extend customer metrics reporting support (Kamal Heib) [RHEL-66933 RHEL-59968]
- net: ena: Add ENA Express metrics support (Kamal Heib) [RHEL-66933 RHEL-59968]
- xsk: fix batch alloc API on non-coherent systems (Felix Maurer) [RHEL-59884 RHEL-58954]
- selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66106] {CVE-2024-46695}
- PCI/AER: Disable AER service on suspend (Lenny Szubowicz) [RHEL-67037 RHEL-22265]
- ACPI: PM: s2idle: Evaluate all Low-Power S0 Idle _DSM functions (Mark Langsdorf) [RHEL-67037 RHEL-54149]
- mptcp: fallback when MPTCP opts are dropped after 1st data (CKI Backport Bot) [RHEL-62216 RHEL-62218]
- cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (David Arcari) [RHEL-61469 RHEL-45016]
- cpufreq/amd-pstate: Add the missing cpufreq_cpu_put() (David Arcari) [RHEL-61469 RHEL-45016]
- cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC systems (David Arcari) [RHEL-61469 RHEL-45016]
- cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons (David Arcari) [RHEL-61469 RHEL-45016]
- cpufreq/amd-pstate: fix setting policy current frequency value (David Arcari) [RHEL-61469 RHEL-45016]
- netfilter: flowtable: initialise extack before use (CKI Backport Bot) [RHEL-58545] {CVE-2024-45018}

Related CVEs

CVE-2024-45018

CVE-2024-46695

CVE-2024-49949

CVE-2024-43854

CVE-2024-50251

CVE-2024-26615

CVE-2024-44994

Updated Packages

Release/Architecture	Filename	MD5sum	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	kernel-5.14.0-503.16.1.el9_5.src.rpm	f3cfc47cd13c7bd5084eb749b06fc56c	-	ol9_aarch64_appstream
	kernel-5.14.0-503.16.1.el9_5.src.rpm	f3cfc47cd13c7bd5084eb749b06fc56c	-	ol9_aarch64_baseos_latest
	kernel-5.14.0-503.16.1.el9_5.src.rpm	f3cfc47cd13c7bd5084eb749b06fc56c	-	ol9_aarch64_codeready_builder
	kernel-5.14.0-503.16.1.el9_5.src.rpm	f3cfc47cd13c7bd5084eb749b06fc56c	-	ol9_aarch64_u5_baseos_patch
	bpftool-7.4.0-503.16.1.el9_5.aarch64.rpm	ef7208ed9f8b4cadb845f5eb6731a2f4	-	ol9_aarch64_baseos_latest
	bpftool-7.4.0-503.16.1.el9_5.aarch64.rpm	ef7208ed9f8b4cadb845f5eb6731a2f4	-	ol9_aarch64_u5_baseos_patch
	kernel-cross-headers-5.14.0-503.16.1.el9_5.aarch64.rpm	0fa31df47c14659e94b8f4b916ec9d34	-	ol9_aarch64_codeready_builder
	kernel-headers-5.14.0-503.16.1.el9_5.aarch64.rpm	f215662b51b978ccdf671a8321ec2903	-	ol9_aarch64_appstream
	kernel-tools-5.14.0-503.16.1.el9_5.aarch64.rpm	5e80a5ae14c8a1fbf6836584e6531945	-	ol9_aarch64_baseos_latest
	kernel-tools-5.14.0-503.16.1.el9_5.aarch64.rpm	5e80a5ae14c8a1fbf6836584e6531945	-	ol9_aarch64_u5_baseos_patch
	kernel-tools-libs-5.14.0-503.16.1.el9_5.aarch64.rpm	f52d2e8e24262c5ed0ccd5d33371f98e	-	ol9_aarch64_baseos_latest
	kernel-tools-libs-5.14.0-503.16.1.el9_5.aarch64.rpm	f52d2e8e24262c5ed0ccd5d33371f98e	-	ol9_aarch64_u5_baseos_patch
	kernel-tools-libs-devel-5.14.0-503.16.1.el9_5.aarch64.rpm	8166dfa674583eb5917c7857a3294e66	-	ol9_aarch64_codeready_builder
	perf-5.14.0-503.16.1.el9_5.aarch64.rpm	c748737c2d8771864099097e8d85be13	-	ol9_aarch64_appstream
	python3-perf-5.14.0-503.16.1.el9_5.aarch64.rpm	20223358fb5fc071eccdbc4aabf3ec01	-	ol9_aarch64_baseos_latest
	python3-perf-5.14.0-503.16.1.el9_5.aarch64.rpm	20223358fb5fc071eccdbc4aabf3ec01	-	ol9_aarch64_u5_baseos_patch
	rtla-5.14.0-503.16.1.el9_5.aarch64.rpm	07d69c9ff3ce3062414ae7b4369b8e50	-	ol9_aarch64_appstream
	rv-5.14.0-503.16.1.el9_5.aarch64.rpm	e8f20599d511a9a449005c63a41a8a27	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	kernel-5.14.0-503.16.1.el9_5.src.rpm	f3cfc47cd13c7bd5084eb749b06fc56c	-	ol9_x86_64_appstream
	kernel-5.14.0-503.16.1.el9_5.src.rpm	f3cfc47cd13c7bd5084eb749b06fc56c	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-503.16.1.el9_5.src.rpm	f3cfc47cd13c7bd5084eb749b06fc56c	-	ol9_x86_64_codeready_builder
	kernel-5.14.0-503.16.1.el9_5.src.rpm	f3cfc47cd13c7bd5084eb749b06fc56c	-	ol9_x86_64_u5_baseos_patch
	bpftool-7.4.0-503.16.1.el9_5.x86_64.rpm	1bb9fc8086914dcb604bdcd275d185e5	-	ol9_x86_64_baseos_latest
	bpftool-7.4.0-503.16.1.el9_5.x86_64.rpm	1bb9fc8086914dcb604bdcd275d185e5	-	ol9_x86_64_u5_baseos_patch
	kernel-5.14.0-503.16.1.el9_5.x86_64.rpm	00acb94377eb5e02b6d02bea905864f5	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-503.16.1.el9_5.x86_64.rpm	00acb94377eb5e02b6d02bea905864f5	-	ol9_x86_64_u5_baseos_patch
	kernel-abi-stablelists-5.14.0-503.16.1.el9_5.noarch.rpm	a892b139007eac06fa1ed668afbd9aef	-	ol9_x86_64_baseos_latest
	kernel-abi-stablelists-5.14.0-503.16.1.el9_5.noarch.rpm	a892b139007eac06fa1ed668afbd9aef	-	ol9_x86_64_u5_baseos_patch
	kernel-core-5.14.0-503.16.1.el9_5.x86_64.rpm	b39b2cc8baaac693c46dee2a68993b1a	-	ol9_x86_64_baseos_latest
	kernel-core-5.14.0-503.16.1.el9_5.x86_64.rpm	b39b2cc8baaac693c46dee2a68993b1a	-	ol9_x86_64_u5_baseos_patch
	kernel-cross-headers-5.14.0-503.16.1.el9_5.x86_64.rpm	436e3d850778d587cb0e32411647cf55	-	ol9_x86_64_codeready_builder
	kernel-debug-5.14.0-503.16.1.el9_5.x86_64.rpm	5367c839a1b09b6fb0288f19b4f8fba4	-	ol9_x86_64_baseos_latest
	kernel-debug-5.14.0-503.16.1.el9_5.x86_64.rpm	5367c839a1b09b6fb0288f19b4f8fba4	-	ol9_x86_64_u5_baseos_patch
	kernel-debug-core-5.14.0-503.16.1.el9_5.x86_64.rpm	e500400d68e09516d72d0859204ca254	-	ol9_x86_64_baseos_latest
	kernel-debug-core-5.14.0-503.16.1.el9_5.x86_64.rpm	e500400d68e09516d72d0859204ca254	-	ol9_x86_64_u5_baseos_patch
	kernel-debug-devel-5.14.0-503.16.1.el9_5.x86_64.rpm	b384d652f37c490b0150d6b5cf68301c	-	ol9_x86_64_appstream
	kernel-debug-devel-matched-5.14.0-503.16.1.el9_5.x86_64.rpm	8fe80d811f637363b984b50781401296	-	ol9_x86_64_appstream
	kernel-debug-modules-5.14.0-503.16.1.el9_5.x86_64.rpm	b7c4a5c36f60b5fd7614d146dd1f2b42	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-5.14.0-503.16.1.el9_5.x86_64.rpm	b7c4a5c36f60b5fd7614d146dd1f2b42	-	ol9_x86_64_u5_baseos_patch
	kernel-debug-modules-core-5.14.0-503.16.1.el9_5.x86_64.rpm	9c926850a42a099fd88fbf0a6b338143	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-core-5.14.0-503.16.1.el9_5.x86_64.rpm	9c926850a42a099fd88fbf0a6b338143	-	ol9_x86_64_u5_baseos_patch
	kernel-debug-modules-extra-5.14.0-503.16.1.el9_5.x86_64.rpm	d17174b95f674c25e8ac4d51f541a27d	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-extra-5.14.0-503.16.1.el9_5.x86_64.rpm	d17174b95f674c25e8ac4d51f541a27d	-	ol9_x86_64_u5_baseos_patch
	kernel-debug-uki-virt-5.14.0-503.16.1.el9_5.x86_64.rpm	ebb6ac1933fa327c6c487c39b22853f6	-	ol9_x86_64_baseos_latest
	kernel-debug-uki-virt-5.14.0-503.16.1.el9_5.x86_64.rpm	ebb6ac1933fa327c6c487c39b22853f6	-	ol9_x86_64_u5_baseos_patch
	kernel-devel-5.14.0-503.16.1.el9_5.x86_64.rpm	a144379e9163e0cd0bf33297c6bb9510	-	ol9_x86_64_appstream
	kernel-devel-matched-5.14.0-503.16.1.el9_5.x86_64.rpm	20fba8a2db3a8819035f99933195be63	-	ol9_x86_64_appstream
	kernel-doc-5.14.0-503.16.1.el9_5.noarch.rpm	47c7d6635b25256de7ead6ff83cd1daf	-	ol9_x86_64_appstream
	kernel-headers-5.14.0-503.16.1.el9_5.x86_64.rpm	8b0eccb7300dab3e107092b287a0c2d6	-	ol9_x86_64_appstream
	kernel-modules-5.14.0-503.16.1.el9_5.x86_64.rpm	c83f259e2a4f64d43395e847769ac88a	-	ol9_x86_64_baseos_latest
	kernel-modules-5.14.0-503.16.1.el9_5.x86_64.rpm	c83f259e2a4f64d43395e847769ac88a	-	ol9_x86_64_u5_baseos_patch
	kernel-modules-core-5.14.0-503.16.1.el9_5.x86_64.rpm	f8e058a02643d1c9406041871b3eb707	-	ol9_x86_64_baseos_latest
	kernel-modules-core-5.14.0-503.16.1.el9_5.x86_64.rpm	f8e058a02643d1c9406041871b3eb707	-	ol9_x86_64_u5_baseos_patch
	kernel-modules-extra-5.14.0-503.16.1.el9_5.x86_64.rpm	b45c60d12d6645ae9ecd56d022e750c3	-	ol9_x86_64_baseos_latest
	kernel-modules-extra-5.14.0-503.16.1.el9_5.x86_64.rpm	b45c60d12d6645ae9ecd56d022e750c3	-	ol9_x86_64_u5_baseos_patch
	kernel-tools-5.14.0-503.16.1.el9_5.x86_64.rpm	a9dab020084095e02948aa79648326c9	-	ol9_x86_64_baseos_latest
	kernel-tools-5.14.0-503.16.1.el9_5.x86_64.rpm	a9dab020084095e02948aa79648326c9	-	ol9_x86_64_u5_baseos_patch
	kernel-tools-libs-5.14.0-503.16.1.el9_5.x86_64.rpm	233bd7aedf6499c13de0dbb555feb988	-	ol9_x86_64_baseos_latest
	kernel-tools-libs-5.14.0-503.16.1.el9_5.x86_64.rpm	233bd7aedf6499c13de0dbb555feb988	-	ol9_x86_64_u5_baseos_patch
	kernel-tools-libs-devel-5.14.0-503.16.1.el9_5.x86_64.rpm	6ee74f33d7d79271f576e1f2fd1714ee	-	ol9_x86_64_codeready_builder
	kernel-uki-virt-5.14.0-503.16.1.el9_5.x86_64.rpm	4c80b5b8b446e92774e1f9bca5fb51e1	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-5.14.0-503.16.1.el9_5.x86_64.rpm	4c80b5b8b446e92774e1f9bca5fb51e1	-	ol9_x86_64_u5_baseos_patch
	kernel-uki-virt-addons-5.14.0-503.16.1.el9_5.x86_64.rpm	0e9ecde98639b5dc40ebc591aed25cd9	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-addons-5.14.0-503.16.1.el9_5.x86_64.rpm	0e9ecde98639b5dc40ebc591aed25cd9	-	ol9_x86_64_u5_baseos_patch
	libperf-5.14.0-503.16.1.el9_5.x86_64.rpm	5ffdec95d9559e5868ee728310aac2f8	-	ol9_x86_64_codeready_builder
	perf-5.14.0-503.16.1.el9_5.x86_64.rpm	36bde24ad74bb71a54449cd705849e40	-	ol9_x86_64_appstream
	python3-perf-5.14.0-503.16.1.el9_5.x86_64.rpm	3a3a37b0c83297071e9ca2467bee5781	-	ol9_x86_64_baseos_latest
	python3-perf-5.14.0-503.16.1.el9_5.x86_64.rpm	3a3a37b0c83297071e9ca2467bee5781	-	ol9_x86_64_u5_baseos_patch
	rtla-5.14.0-503.16.1.el9_5.x86_64.rpm	48b2527227a8481d6267c3416422f7c0	-	ol9_x86_64_appstream
	rv-5.14.0-503.16.1.el9_5.x86_64.rpm	653ab08653cda1676aa66b25f4c23b9a	-	ol9_x86_64_appstream