DATABASE RESOURCES PRICING ABOUT US

{"id": "ELSA-2022-9313", "vendorId": null, "type": "oraclelinux", "bulletinFamily": "unix", "title": "Unbreakable Enterprise kernel security update", "description": "[4.14.35-2047.512.6]\n- Revert 'rds/ib: recover rds connection from stuck rx path' (Rohit Nair) [Orabug: 34039271] \n- uek-rpm: update kABI lists for new symbols (Saeed Mirzamohammadi) [Orabug: 33993774]\n[4.14.35-2047.512.5]\n- netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso) [Orabug: 34012925] {CVE-2022-1016}\n- rds: Fix incorrect initialization order (Hakon Bugge) [Orabug: 33923372] \n- btrfs: unlock newly allocated extent buffer after error (Qu Wenruo) [Orabug: 33997138] {CVE-2021-4149}\n- sr9700: sanity check for packet length (Oliver Neukum) [Orabug: 33962706] {CVE-2022-26966}\n[4.14.35-2047.512.4]\n- Linux 4.14.265 (Greg Kroah-Hartman) \n- ext4: fix error handling in ext4_restore_inline_data() (Ritesh Harjani) \n- EDAC/xgene: Fix deferred probing (Sergey Shtylyov) \n- EDAC/altera: Fix deferred probing (Sergey Shtylyov) \n- rtc: cmos: Evaluate century appropriate (Riwen Lu) \n- selftests: futex: Use variable MAKE instead of make (Muhammad Usama Anjum) \n- nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. (Dai Ngo) \n- scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (John Meneghini) \n- ASoC: fsl: Add missing error handling in pcm030_fabric_probe (Miaoqian Lin) \n- drm/i915/overlay: Prevent divide by zero bugs in scaling (Dan Carpenter) \n- net: macsec: Verify that send_sci is on when setting Tx sci explicitly (Lior Nahmanson) \n- net: ieee802154: Return meaningful error codes from the netlink helpers (Miquel Raynal) \n- net: ieee802154: ca8210: Stop leaking skb's (Miquel Raynal) \n- spi: meson-spicc: add IRQ check in meson_spicc_probe (Miaoqian Lin) \n- spi: mediatek: Avoid NULL pointer crash in interrupt (Benjamin Gaignard) \n- spi: bcm-qspi: check for valid cs before applying chip select (Kamal Dasu) \n- iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() (Joerg Roedel) \n- iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (Guoqing Jiang) \n- RDMA/mlx4: Don't continue event handler after memory allocation failure (Leon Romanovsky) \n- block: bio-integrity: Advance seed correctly for larger interval sizes (Martin K. Petersen) \n- drm/nouveau: fix off by one in BIOS boundary checking (Nick Lopez) \n- ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (Mark Brown) \n- ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (Mark Brown) \n- ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (Mark Brown) \n- audit: improve audit queue handling when 'audit=1' on cmdline (Paul Moore) \n- af_packet: fix data-race in packet_setsockopt / packet_setsockopt (Eric Dumazet) \n- rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (Eric Dumazet) \n- net: amd-xgbe: Fix skb data length underflow (Shyam Sundar S K) \n- net: amd-xgbe: ensure to reset the tx_timer_active flag (Raju Rangoju) \n- ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback (Georgi Valkov) \n- netfilter: nat: limit port clash resolution attempts (Florian Westphal) \n- netfilter: nat: remove l4 protocol port rovers (Florian Westphal) \n- bpf: fix truncated jump targets on heavy expansions (Daniel Borkmann) \n- ipv4: raw: lock the socket in raw_bind() (Eric Dumazet) \n- yam: fix a memory leak in yam_siocdevprivate() (Hangyu Hua) \n- ibmvnic: don't spin in tasklet (Sukadev Bhattiprolu) \n- drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (Jose Exposito) \n- drm/msm: Fix wrong size calculation (Xianting Tian) \n- net-procfs: show net devices bound packet types (Jianguo Wu) \n- NFSv4: nfs_atomic_open() can race when looking up a non-regular file (Trond Myklebust) \n- NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust) \n- hwmon: (lm90) Reduce maximum conversion rate for G781 (Guenter Roeck) \n- ping: fix the sk_bound_dev_if match in ping_lookup (Xin Long) \n- net: fix information leakage in /proc/net/ptype (Saeed Mirzamohammadi) \n- ipv6_tunnel: Rate limit warning messages (Ido Schimmel) \n- scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (John Meneghini) \n- rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev (Matthias Kaehlcke) \n- rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (Sujit Kautkar) \n- i40e: fix unsigned stat widths (Joe Damato) \n- i40e: Increase delay to 1 s after global EMP reset (Jedrzej Jagielski) \n- lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() (Christophe Leroy) \n- powerpc/32: Fix boot failure with GCC latent entropy plugin (Christophe Leroy) \n- net: sfp: ignore disabled SFP node (Marek Behun) \n- usb: typec: tcpm: Do not disconnect while receiving VBUS off (Badhri Jagan Sridharan) \n- USB: core: Fix hang in usb_kill_urb by adding memory barriers (Alan Stern) \n- usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS (Pavankumar Kondeti) \n- usb: common: ulpi: Fix crash in ulpi_match() (Jon Hunter) \n- usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge (Alan Stern) \n- tty: Add support for Brainboxes UC cards. (Cameron Williams) \n- tty: n_gsm: fix SW flow control encoding/handling (daniel.starke@siemens.com) \n- serial: stm32: fix software flow control transfer (Valentin Caron) \n- netfilter: nft_payload: do not update layer 4 checksum when mangling fragments (Pablo Neira Ayuso) \n- PM: wakeup: simplify the output logic of pm_show_wakelocks() (Greg Kroah-Hartman) \n- scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices (Steffen Maier) \n- s390/hypfs: include z/VM guests with access control group set (Vasily Gorbik) \n- Bluetooth: refactor malicious adv data check (Brian Gix) \n- Linux 4.14.264 (Greg Kroah-Hartman) \n- can: bcm: fix UAF of bcm op (Ziyang Xuan) \n- Linux 4.14.263 (Greg Kroah-Hartman) \n- gianfar: fix jumbo packets+napi+rx overrun crash (Michael Braun) \n- gianfar: simplify FCS handling and fix memory leak (Andy Spencer) \n- drm/ttm/nouveau: don't call tt destroy callback on alloc failure. (Dave Airlie) \n- mips,s390,sh,sparc: gup: Work around the 'COW can break either way' issue (Ben Hutchings) \n- lib82596: Fix IRQ check in sni_82596_probe (Miaoqian Lin) \n- scripts/dtc: dtx_diff: remove broken example from help text (Matthias Schiffer) \n- bcmgenet: add WOL IRQ check (Sergey Shtylyov) \n- net_sched: restore 'mpu xxx' handling (Kevin Bracey) \n- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition (Tudor Ambarus) \n- dmaengine: at_xdmac: Fix lld view setting (Tudor Ambarus) \n- dmaengine: at_xdmac: Print debug message after realeasing the lock (Tudor Ambarus) \n- dmaengine: at_xdmac: Don't start transactions at tx_submit level (Tudor Ambarus) \n- libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() (Guillaume Nault) \n- netns: add schedule point in ops_exit_list() (Eric Dumazet) \n- net: axienet: fix number of TX ring slots for available check (Robert Hancock) \n- net: axienet: Wait for PhyRstCmplt after core reset (Robert Hancock) \n- af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (Eric Dumazet) \n- parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries (Miaoqian Lin) \n- net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module (Tobias Waldekranz) \n- powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses (Tobias Waldekranz) \n- powerpc/cell: Fix clang -Wimplicit-fallthrough warning (Anders Roxell) \n- RDMA/rxe: Fix a typo in opcode name (Chengguang Xu) \n- RDMA/hns: Modify the mapping attribute of doorbell to device (Yixing Liu) \n- Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization (Lukas Bulwahn) \n- firmware: Update Kconfig help text for Google firmware (Ben Hutchings) \n- drm/radeon: fix error handling in radeon_driver_open_kms (Christian Konig) \n- crypto: stm32/crc32 - Fix kernel BUG triggered in probe() (Marek Vasut) \n- ext4: don't use the orphan list when migrating an inode (Theodore Ts'o) \n- ext4: Fix BUG_ON in ext4_bread when write quota data (Ye Bin) \n- ext4: set csum seed in tmp inode while migrating to extents (Luis Henriques) \n- ext4: make sure quota gets properly shutdown on error (Jan Kara) \n- iwlwifi: mvm: Increase the scan timeout guard to 30 seconds (Ilan Peer) \n- cputime, cpuacct: Include guest time in user time in cpuacct.stat (Andrey Ryabinin) \n- serial: Fix incorrect rs485 polarity on uart open (Lukas Wunner) \n- ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers (Petr Cvachoucek) \n- power: bq25890: Enable continuous conversion for ADC at charging (Yauhen Kharuzhy) \n- ASoC: mediatek: mt8173: fix device_node leak (Tzung-Bi Shih) \n- scsi: sr: Don't use GFP_DMA (Christoph Hellwig) \n- MIPS: Octeon: Fix build errors using clang (Tianjia Zhang) \n- i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters (Lakshmi Sowjanya D) \n- MIPS: OCTEON: add put_device() after of_find_device_by_node() (Ye Guojin) \n- ALSA: seq: Set upper limit of processed events (Takashi Iwai) \n- w1: Misuse of get_user()/put_user() reported by sparse (Christophe Leroy) \n- i2c: mpc: Correct I2C reset procedure (Joakim Tjernlund) \n- powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING (Michael Ellerman) \n- i2c: i801: Don't silently correct invalid transfer size (Heiner Kallweit) \n- powerpc/watchdog: Fix missed watchdog reset due to memory ordering race (Nicholas Piggin) \n- powerpc/btext: add missing of_node_put (Julia Lawall) \n- powerpc/cell: add missing of_node_put (Julia Lawall) \n- powerpc/powernv: add missing of_node_put (Julia Lawall) \n- powerpc/6xx: add missing of_node_put (Julia Lawall) \n- parisc: Avoid calling faulthandler_disabled() twice (John David Anglin) \n- serial: core: Keep mctrl register state and cached copy in sync (Lukas Wunner) \n- serial: pl010: Drop CR register reset on set_termios (Lukas Wunner) \n- net: phy: marvell: configure RGMII delays for 88E1118 (Russell King (Oracle)) \n- dm space map common: add bounds check to sm_ll_lookup_bitmap() (Joe Thornber) \n- dm btree: add a defensive bounds check to insert_at() (Joe Thornber) \n- mac80211: allow non-standard VHT MCS-10/11 (Ping-Ke Shih) \n- net: mdio: Demote probed message to debug print (Florian Fainelli) \n- btrfs: remove BUG_ON(!eie) in find_parent_nodes (Josef Bacik) \n- btrfs: remove BUG_ON() in find_parent_nodes() (Josef Bacik) \n- ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (Kirill A. Shutemov) \n- ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (Rafael J. Wysocki) \n- ACPICA: Utilities: Avoid deleting the same object twice in a row (Rafael J. Wysocki) \n- ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (Mark Langsdorf) \n- jffs2: GC deadlock reading a page that is used in jffs2_write_begin() (Kyeong Yoo) \n- um: registers: Rename function names to avoid conflicts and build problems (Randy Dunlap) \n- iwlwifi: remove module loading failure message (Johannes Berg) \n- iwlwifi: fix leaks/bad data after failed firmware load (Johannes Berg) \n- ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (Zekun Shen) \n- usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 (Kai-Heng Feng) \n- arm64: tegra: Adjust length of CCPLEX cluster MMIO region (Thierry Reding) \n- mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO (Ulf Hansson) \n- media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() (Zhou Qingyang) \n- media: igorplugusb: receiver overflow should be reported (Sean Young) \n- bpf: Do not WARN in bpf_warn_invalid_xdp_action() (Paolo Abeni) \n- net: bonding: debug: avoid printing debug logs when bond is not notifying peers (Suresh Kumar) \n- ath10k: Fix tx hanging (Sebastian Gottschall) \n- iwlwifi: mvm: synchronize with FW after multicast commands (Johannes Berg) \n- media: m920x: don't use stack on USB reads (Mauro Carvalho Chehab) \n- media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() (Zhou Qingyang) \n- media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. (James Hilliard) \n- floppy: Add max size check for user space request (Xiongwei Song) \n- usb: uhci: add aspeed ast2600 uhci support (Neal Liu) \n- mwifiex: Fix skb_over_panic in mwifiex_usb_recv() (Zekun Shen) \n- HSI: core: Fix return freed object in hsi_new_client (Chengfeng Ye) \n- gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use (Hans de Goede) \n- drm/bridge: megachips: Ensure both bridges are probed before registration (Martyn Welch) \n- mlxsw: pci: Add shutdown method in PCI driver (Danielle Ratson) \n- media: b2c2: Add missing check in flexcop_pci_isr: (Zheyu Ma) \n- HID: apple: Do not reset quirks when the Fn key is not found (Jose Exposito) \n- usb: gadget: f_fs: Use stream_open() for endpoint files (Pavankumar Kondeti) \n- drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR (Ben Skeggs) \n- ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (Zekun Shen) \n- fs: dlm: filter user dlm messages for kernel locks (Alexander Aring) \n- Bluetooth: Fix debugfs entry leak in hci_register_dev() (Wei Yongjun) \n- RDMA/cxgb4: Set queue pair state when being queried (Kamal Heib) \n- mips: bcm63xx: add support for clk_set_parent() (Randy Dunlap) \n- mips: lantiq: add support for clk_set_parent() (Randy Dunlap) \n- misc: lattice-ecp3-config: Fix task hung when firmware load failed (Wei Yongjun) \n- ASoC: samsung: idma: Check of ioremap return value (Jiasheng Jiang) \n- iommu/iova: Fix race between FQ timeout and teardown (Xiongfeng Wang) \n- dmaengine: pxa/mmp: stop referencing config->slave_id (Arnd Bergmann) \n- RDMA/core: Let ib_find_gid() continue search even after empty entry (Avihai Horon) \n- scsi: ufs: Fix race conditions related to driver data (Bart Van Assche) \n- char/mwave: Adjust io port register size (Kees Cook) \n- ALSA: oss: fix compile error when OSS_DEBUG is enabled (Bixuan Cui) \n- powerpc/prom_init: Fix improper check of prom_getprop() (Peiwei Hu) \n- RDMA/hns: Validate the pkey index (Kamal Heib) \n- ALSA: hda: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ALSA: jack: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ext4: avoid trim error on fs with small groups (Jan Kara) \n- net: mcs7830: handle usb read errors properly (Pavel Skripkin) \n- pcmcia: fix setting of kthread task states (Dominik Brodowski) \n- can: xilinx_can: xcan_probe(): check for error irq (Jiasheng Jiang) \n- can: softing: softing_startstop(): fix set but not used variable warning (Marc Kleine-Budde) \n- tpm: add request_locality before write TPM_INT_ENABLE (Chen Jun) \n- spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe (Miaoqian Lin) \n- fsl/fman: Check for null pointer after calling devm_ioremap (Jiasheng Jiang) \n- ppp: ensure minimum packet size in ppp_write() (Eric Dumazet) \n- pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() (Zhou Qingyang) \n- pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() (Zhou Qingyang) \n- x86/mce/inject: Avoid out-of-bounds write when setting flags (Zhang Zixun) \n- usb: ftdi-elan: fix memory leak on device disconnect (Wei Yongjun) \n- media: msi001: fix possible null-ptr-deref in msi001_probe() (Wang Hai) \n- media: dw2102: Fix use after free (Anton Vasilyev) \n- sched/rt: Try to restart rt period timer when rt runtime exceeded (Li Hua) \n- media: si2157: Fix 'warm' tuner state detection (Robert Schlabbach) \n- media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() (Zhou Qingyang) \n- media: dib8000: Fix a memleak in dib8000_init() (Zhou Qingyang) \n- floppy: Fix hang in watchdog when disk is ejected (Tasos Sahanidis) \n- serial: amba-pl011: do not request memory region twice (Lino Sanfilippo) \n- drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() (Zhou Qingyang) \n- drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() (Zhou Qingyang) \n- arm64: dts: qcom: msm8916: fix MMC controller aliases (Dmitry Baryshkov) \n- netfilter: bridge: add support for pppoe filtering (Florian Westphal) \n- media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released (Dafna Hirschfeld) \n- tty: serial: atmel: Call dma_async_issue_pending() (Tudor Ambarus) \n- tty: serial: atmel: Check return code of dmaengine_submit() (Tudor Ambarus) \n- crypto: qce - fix uaf on qce_ahash_register_one (Chengfeng Ye) \n- media: dmxdev: fix UAF when dvb_register_device() fails (Wang Hai) \n- Bluetooth: stop proccessing malicious adv data (Pavel Skripkin) \n- media: em28xx: fix memory leak in em28xx_init_dev (Dongliang Mu) \n- wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND (Bryan O'Donoghue) \n- clk: bcm-2835: Remove rounding up the dividers (Maxime Ripard) \n- clk: bcm-2835: Pick the closest clock rate (Maxime Ripard) \n- Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails (Wang Hai) \n- PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (Yifeng Li) \n- shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode (Gang Li) \n- can: softing_cs: softingcs_probe(): fix memleak on registration failure (Johan Hovold) \n- media: stk1160: fix control-message timeouts (Johan Hovold) \n- media: pvrusb2: fix control-message timeouts (Johan Hovold) \n- media: redrat3: fix control-message timeouts (Johan Hovold) \n- media: dib0700: fix undefined behavior in tuner shutdown (Michael Kuron) \n- media: s2255: fix control-message timeouts (Johan Hovold) \n- media: cpia2: fix control-message timeouts (Johan Hovold) \n- media: em28xx: fix control-message timeouts (Johan Hovold) \n- media: mceusb: fix control-message timeouts (Johan Hovold) \n- media: flexcop-usb: fix control-message timeouts (Johan Hovold) \n- rtc: cmos: take rtc_lock while reading from CMOS (Mateusz Jonczyk) \n- nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() (Krzysztof Kozlowski) \n- HID: wacom: Avoid using stale array indicies to read contact count (Jason Gerecke) \n- HID: wacom: Ignore the confidence flag when a touch is removed (Jason Gerecke) \n- HID: uhid: Fix worker destroying device without any protection (Jann Horn) \n- Bluetooth: fix init and cleanup of sco_conn.timeout_work (Desmond Cheong Zhi Xi) \n- Bluetooth: schedule SCO timeouts with delayed_work (Desmond Cheong Zhi Xi) \n- rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled (Larry Finger) \n- media: uvcvideo: fix division by zero at stream start (Johan Hovold) \n- orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() (Christophe JAILLET) \n- drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() (Nathan Chancellor) \n- staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() (Nathan Chancellor) \n- random: fix data race on crng init time (Eric Biggers) \n- random: fix data race on crng_node_pool (Eric Biggers) \n- can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} (Brian Silverman) \n- can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data (Marc Kleine-Budde) \n- mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() (Andy Shevchenko) \n- USB: Fix 'slab-out-of-bounds Write' bug in usb_hcd_poll_rh_status (Alan Stern) \n- USB: core: Fix bug in resuming hub's handling of wakeup requests (Alan Stern) \n- Bluetooth: bfusb: fix division by zero in send path (Johan Hovold) \n- Linux 4.14.262 (Greg Kroah-Hartman) \n- mISDN: change function names to avoid conflicts (wolfgang huang) \n- net: udp: fix alignment problem in udp4_seq_show() (yangxingwu) \n- ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate (William Zhao) \n- scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() (Lixiaokeng) \n- ipv6: Do cleanup if attribute validation fails in multipath route (David Ahern) \n- ipv6: Continue processing multipath route even if gateway attribute is invalid (David Ahern) \n- phonet: refcount leak in pep_sock_accep (Hangyu Hua) \n- rndis_host: support Hytera digital radios (Thomas Toye) \n- power: reset: ltc2952: Fix use of floating point literals (Nathan Chancellor) \n- sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc (Eric Dumazet) \n- ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route (David Ahern) \n- ipv6: Check attribute length for RTA_GATEWAY in multipath route (David Ahern) \n- i40e: Fix incorrect netdev's real number of RX/TX queues (Jedrzej Jagielski) \n- i40e: fix use-after-free in i40e_sync_filters_subtask() (Di Zhu) \n- mac80211: initialize variable have_higher_than_11mbit (Tom Rix) \n- RDMA/core: Don't infoleak GRH fields (Leon Romanovsky) \n- ieee802154: atusb: fix uninit value in atusb_set_extended_addr (Pavel Skripkin) \n- virtio_pci: Support surprise removal of virtio pci device (Parav Pandit) \n- tracing: Tag trace_percpu_buffer as a percpu pointer (Naveen N. Rao) \n- tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() (Naveen N. Rao) \n- Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models (Takashi Iwai)\n[4.14.35-2047.512.3]\n- lib/timerqueue: Rely on rbtree semantics for next timer (Davidlohr Bueso) [Orabug: 33406086] {CVE-2021-20317} {CVE-2021-20317}\n- rds/ib: Resize CQ if send-/recv-ring-size are changed (Hans Westgaard Ry) [Orabug: 33940520] \n- uek-rpm: remove uek-rpm/ol8 (John Donnelly) [Orabug: 33665655] \n- uek-rpm: Enable config CONFIG_SCSI_MQ_DEFAULT (Saeed Mirzamohammadi) [Orabug: 33973455] \n- sched: restore the sliding search window for select_idle_cpu() (Libo Chen) [Orabug: 33965297] \n- NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust) [Orabug: 33958155] {CVE-2022-24448}\n- Linux 4.14.261 (Greg Kroah-Hartman) \n- sctp: use call_rcu to free endpoint (Xin Long) \n- net: fix use-after-free in tw_timer_handler (Muchun Song) \n- Input: spaceball - fix parsing of movement data packets (Leo L. Schwab) \n- Input: appletouch - initialize work before device registration (Pavel Skripkin) \n- binder: fix async_free_space accounting for empty parcels (Todd Kjos) \n- usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. (Vincent Pelletier) \n- xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. (Mathias Nyman) \n- uapi: fix linux/nfc.h userspace compilation errors (Dmitry V. Levin) \n- nfc: uapi: use kernel size_t to fix user-space builds (Krzysztof Kozlowski) \n- fsl/fman: Fix missing put_device() call in fman_port_probe (Miaoqian Lin) \n- NFC: st21nfca: Fix memory leak in device probe and remove (Wei Yongjun) \n- net: usb: pegasus: Do not drop long Ethernet frames (Matthias-Christian Ott) \n- scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (Dan Carpenter) \n- selinux: initialize proto variable in selinux_ip_postroute_compat() (Tom Rix) \n- recordmcount.pl: fix typo in s390 mcount regex (Heiko Carstens) \n- platform/x86: apple-gmux: use resource_size() with res (Wang Qing) \n- HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option (Hans de Goede) \n- Linux 4.14.260 (Greg Kroah-Hartman) \n- phonet/pep: refuse to enable an unbound pipe (Remi Denis-Courmont) \n- hamradio: improve the incomplete fix to avoid NPD (Lin Ma) \n- hamradio: defer ax25 kfree after unregister_netdev (Lin Ma) \n- ax25: NPD bug when detaching AX25 device (Lin Ma) \n- hwmon: (lm90) Do not report 'busy' status bit as alarm (Guenter Roeck) \n- KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state (Sean Christopherson) \n- usb: gadget: u_ether: fix race in setting MAC address in setup phase (Marian Postevca) \n- f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() (Chao Yu) \n- ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling (Ard Biesheuvel) \n- pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines (Fabien Dessenne) \n- x86/pkey: Fix undefined behaviour with PKRU_WD_BIT (Andrew Cooper) \n- Input: atmel_mxt_ts - fix double free in mxt_read_info_block (Jose Exposito) \n- ALSA: drivers: opl3: Fix incorrect use of vp->state (Colin Ian King) \n- ALSA: jack: Check the return value of kstrdup() (Xiaoke Wang) \n- hwmon: (lm90) Fix usage of CONFIG2 register in detect function (Guenter Roeck) \n- sfc: falcon: Check null pointer of rx_queue->page_ring (Jiasheng Jiang) \n- drivers: net: smc911x: Check for error irq (Jiasheng Jiang) \n- fjes: Check for error irq (Jiasheng Jiang) \n- bonding: fix ad_actor_system option setting to default (Fernando Fernandez Mancera) \n- net: skip virtio_net_hdr_set_proto if protocol already set (Willem de Bruijn) \n- qlcnic: potential dereference null pointer of rx_queue->page_ring (Jiasheng Jiang) \n- spi: change clk_disable_unprepare to clk_unprepare (Dongliang Mu) \n- HID: holtek: fix mouse probing (Benjamin Tissoires) \n- can: kvaser_usb: get CAN clock frequency from device (Jimmy Assarsson) \n- net: usb: lan78xx: add Allied Telesis AT29M2-AF (Greg Jesionowski) \n- x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) [Orabug: 33937656] {CVE-2021-26401}\n- Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Fix bug in retpoline mode on AMD with 'spectre_v2=none' (Patrick Colp) [Orabug: 33937656] {CVE-2021-26401}\n- ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33925502] \n- ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet) [Orabug: 33917057] {CVE-2020-36516}\n- ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet) [Orabug: 33917057] {CVE-2020-36516}\n- lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33910800] {CVE-2022-0847}\n- x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp) [Orabug: 33890092] \n- udf: Restore i_lenAlloc when inode expansion fails (Jan Kara) [Orabug: 33870267] {CVE-2022-0617}\n- udf: Fix NULL ptr deref when converting from inline format (Jan Kara) [Orabug: 33870267] {CVE-2022-0617}\n- scsi: libiscsi: Hold back_lock when calling iscsi_complete_task (Gulam Mohamed) [Orabug: 33851182] \n- drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause) [Orabug: 33840433] {CVE-2022-22942}\n- drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin) [Orabug: 33835811] {CVE-2022-0330}\n- proc/vmcore: fix clearing user buffer by properly using clear_user() (David Hildenbrand) [Orabug: 33832650] \n- rds/ib: recover rds connection from stuck rx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820767] \n- rds: ib: Make selection of completion_vector QoS aware (Hakon Bugge) [Orabug: 33819408] \n- Enable CONFIG_DM_DUST and nano for UEK5 (Gulam Mohamed) [Orabug: 33653698] \n- dm dust: use dust block size for badblocklist index (Bryan Gurney) [Orabug: 33653698] \n- dm dust: Make dm_dust_init and dm_dust_exit static (YueHaibing) [Orabug: 33653698] \n- dm dust: remove redundant unsigned comparison to less than zero (Colin Ian King) [Orabug: 33653698] \n- dm: add dust target (Bryan Gurney) [Orabug: 33653698] \n- hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit) [Orabug: 33617219] {CVE-2021-4002}\n- rds/ib: handle posted ACK during connection shutdown (Nagappan Ramasamy Palaniappan) [Orabug: 33820747] \n- rds/ib: reap tx completions during connection shutdown (Nagappan Ramasamy Palaniappan) [Orabug: 33820747] \n- rds/ib: recover rds connection from stuck tx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820747] \n- rds/ib: Kernel change to extend rds-info functionality (Rohit Nair) [Orabug: 33821341] \n- uek-rpm: Add missing symbols to kabi_lockedlist (Stephen Brennan) [Orabug: 33871558]\n[4.14.35-2047.512.1]\n- Revert 'stable: clamp SUBLEVEL in 4.14' (Alan Maguire) [Orabug: 33861950] \n- tipc: improve size validations for received domain records (Jon Maloy) [Orabug: 33850803] {CVE-2022-0435} {CVE-2022-0435}\n- cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33825688] {CVE-2022-0492}\n- blk-stat: delete useless code (Shaohua Li) [Orabug: 33772945] \n- DMA/rxe: Update default value of RXE_MAX_PDN (Rao Shoaib) [Orabug: 33676598]\n[4.14.35-2047.512.0]\n- bpf: Disallow unprivileged bpf by default (Pawan Gupta) [Orabug: 33734682] \n- bpf: Add kconfig knob for disabling unpriv bpf by default (Daniel Borkmann) [Orabug: 33734682] \n- RDMA/rxe: Use correct sizing on buffers holding page DMA addresses (Shiraz Saleem) [Orabug: 33676942] \n- hwmon: (k10temp) Add support for Zen3 CPUs (Rahul Rohit) [Orabug: 33782835] \n- arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table (Ard Biesheuvel) [Orabug: 33787546] \n- uek-rpm: Pensando: Enable Elba EDAC (Dave Kleikamp) [Orabug: 33831294] \n- dsc-drivers: update for 1.15.9-C-64 (Dave Kleikamp) [Orabug: 33831294] \n- drivers/hwmon: Adding support LTC3888 (David Clear) [Orabug: 33831294] \n- drivers/edac: Add Elba EDAC support (David Clear) [Orabug: 33831294] \n- arm64/configs: Remove CONFIG_PENSANDO_SOC_CAPMEM_HUGEPAGE (David Clear) [Orabug: 33831294] \n- drivers/soc/pensando: Add reset cause driver (David Clear) [Orabug: 33831294] \n- net/rds: Fix memory leak in __rds_conn_create() on alloc_ordered_workqueue fail (Freddy Carrillo) [Orabug: 33811475] \n- x86/smpboot: check cpu_initialized_mask first after returning from schedule() (Dongli Zhang) [Orabug: 33544127] \n- Linux 4.14.259 (Greg Kroah-Hartman) \n- xen/console: harden hvc_xen against event channel storms (Juergen Gross) \n- Input: touchscreen - avoid bitwise vs logical OR warning (Nathan Chancellor) \n- ARM: 8800/1: use choice for kernel unwinders (Stefan Agner) \n- mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO (Nathan Chancellor) \n- ARM: 8805/2: remove unneeded naked function usage (Nicolas Pitre) \n- net: lan78xx: Avoid unnecessary self assignment (Nathan Chancellor) \n- fuse: annotate lock in fuse_reverse_inval_entry() (Miklos Szeredi) \n- ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name (Fabio Estevam) \n- firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Sudeep Holla) \n- net: systemport: Add global locking for descriptor lifecycle (Florian Fainelli) \n- libata: if T_LENGTH is zero, dma direction should be DMA_NONE (George Kennedy) \n- timekeeping: Really make sure wall_to_monotonic isn't positive (Yu Liao) \n- USB: serial: option: add Telit FN990 compositions (Daniele Palmas) \n- PCI/MSI: Mask MSI-X vectors only on success (Stefan Roese) \n- PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error (Thomas Gleixner) \n- USB: gadget: bRequestType is a bitfield, not a enum (Greg Kroah-Hartman) \n- sit: do not call ipip6_dev_free() from sit_init_net() (Eric Dumazet) \n- net/packet: rx_owner_map depends on pg_vec (Willem de Bruijn) \n- ixgbe: set X550 MDIO speed before talking to PHY (Cyril Novikov) \n- igbvf: fix double free in 'igbvf_probe' (Letu Ren) \n- soc/tegra: fuse: Fix bitwise vs. logical OR warning (Nathan Chancellor) \n- dmaengine: st_fdma: fix MODULE_ALIAS (Alyssa Ross) \n- ARM: socfpga: dts: fix qspi node compatible (Dinh Nguyen) \n- x86/sme: Explicitly map new EFI memmap table as encrypted (Tom Lendacky) \n- nfsd: fix use-after-free due to delegation race (J. Bruce Fields) \n- audit: improve robustness of the audit queue handling (Paul Moore) \n- dm btree remove: fix use after free in rebalance_children() (Joe Thornber) \n- recordmcount.pl: look for jgnop instruction as well as bcrl on s390 (Jerome Marchand) \n- mac80211: send ADDBA requests using the tid/queue of the aggregation session (Felix Fietkau) \n- hwmon: (dell-smm) Fix warning on /proc/i8k creation error (Armin Wolf) \n- bpf: fix panic due to oob in bpf_prog_test_run_skb (Daniel Borkmann) \n- tracing: Fix a kmemleak false positive in tracing_map (Chen Jun) \n- net: netlink: af_netlink: Prevent empty skb by adding a check on len. (Harshit Mogalapalli) \n- i2c: rk3x: Handle a spurious start completion interrupt flag (Ondrej Jirman) \n- parisc/agp: Annotate parisc agp init functions with __init (Helge Deller) \n- net/mlx4_en: Update reported link modes for 1/10G (Erik Ekman) \n- drm/msm/dsi: set default num_data_lanes (Philip Chen) \n- nfc: fix segfault in nfc_genl_dump_devices_done (Tadeusz Struk) \n- Linux 4.14.258 (Greg Kroah-Hartman) \n- irqchip: nvic: Fix offset for Interrupt Priority Offsets (Vladimir Murzin) \n- irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL (Wudi Wang) \n- irqchip/armada-370-xp: Fix support for Multi-MSI interrupts (Pali Rohar) \n- irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() (Pali Rohar) \n- iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove (Yang Yingliang) \n- iio: adc: axp20x_adc: fix charging current reporting on AXP22x (Evgeny Boger) \n- iio: dln2: Check return value of devm_iio_trigger_register() (Lars-Peter Clausen) \n- iio: dln2-adc: Fix lockdep complaint (Noralf Tronnes) \n- iio: itg3200: Call iio_trigger_notify_done() on error (Lars-Peter Clausen) \n- iio: kxsd9: Don't return error code in trigger handler (Lars-Peter Clausen) \n- iio: ltr501: Don't return error code in trigger handler (Lars-Peter Clausen) \n- iio: mma8452: Fix trigger reference couting (Lars-Peter Clausen) \n- iio: stk3310: Don't return error code in interrupt handler (Lars-Peter Clausen) \n- iio: trigger: stm32-timer: fix MODULE_ALIAS (Alyssa Ross) \n- iio: trigger: Fix reference counting (Lars-Peter Clausen) \n- usb: core: config: using bit mask instead of individual bits (Pavel Hofman) \n- xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending (Kai-Heng Feng) \n- usb: core: config: fix validation of wMaxPacketValue entries (Pavel Hofman) \n- USB: gadget: zero allocate endpoint 0 buffers (Greg Kroah-Hartman) \n- USB: gadget: detect too-big endpoint 0 requests (Greg Kroah-Hartman) \n- net/qla3xxx: fix an error code in ql_adapter_up() (Dan Carpenter) \n- net, neigh: clear whole pneigh_entry at alloc time (Eric Dumazet) \n- net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() (Joakim Zhang) \n- net: altera: set a couple error code in probe() (Dan Carpenter) \n- net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero (Lee Jones) \n- qede: validate non LSO skb length (Manish Chopra) \n- block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) (Davidlohr Bueso) \n- tracefs: Set all files to the same group ownership as the mount option (Steven Rostedt (VMware)) \n- signalfd: use wake_up_pollfree() (Eric Biggers) \n- binder: use wake_up_pollfree() (Eric Biggers) \n- wait: add wake_up_pollfree() (Eric Biggers) \n- libata: add horkage for ASMedia 1092 (Hannes Reinecke) \n- can: m_can: Disable and ignore ELO interrupt (Brian Silverman) \n- can: pch_can: pch_can_rx_normal: fix use after free (Vincent Mailhol) \n- tracefs: Have new files inherit the ownership of their parent (Steven Rostedt (VMware)) \n- ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() (Takashi Iwai) \n- ALSA: pcm: oss: Limit the period size to 16MB (Takashi Iwai) \n- ALSA: pcm: oss: Fix negative period/buffer sizes (Takashi Iwai) \n- ALSA: ctl: Fix copy of updated id with element read/write (Alan Young) \n- mm: bdi: initialize bdi_min_ratio when bdi is unregistered (Manjong Lee) \n- IB/hfi1: Correct guard on eager buffer deallocation (Mike Marciniszyn) \n- seg6: fix the iif in the IPv6 socket control block (Andrea Mayer) \n- nfp: Fix memory leak in nfp_cpp_area_cache_add() (Jianglei Nie) \n- bpf: Fix the off-by-two error in range markings (Maxim Mikityanskiy) \n- nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (Krzysztof Kozlowski) \n- can: sja1000: fix use after free in ems_pcmcia_add_card() (Dan Carpenter) \n- HID: check for valid USB device for many HID drivers (Greg Kroah-Hartman) \n- HID: wacom: fix problems when device is not a valid USB device (Greg Kroah-Hartman) \n- HID: add USB_HID dependancy on some USB HID drivers (Greg Kroah-Hartman) \n- HID: add USB_HID dependancy to hid-chicony (Greg Kroah-Hartman) \n- HID: add USB_HID dependancy to hid-prodikeys (Greg Kroah-Hartman) \n- HID: add hid_is_usb() function to make it simpler for USB detection (Greg Kroah-Hartman) \n- Linux 4.14.257 (Greg Kroah-Hartman) {CVE-2021-38199}\n- parisc: Mark cr16 CPU clocksource unstable on all SMP machines (Helge Deller) \n- serial: core: fix transmit-buffer reset and memleak (Johan Hovold) \n- serial: pl011: Add ACPI SBSA UART match id (Pierre Gondois) \n- tty: serial: msm_serial: Deactivate RX DMA for polling support (Sven Eckelmann) \n- x86/64/mm: Map all kernel memory into trampoline_pgd (Joerg Roedel) \n- usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect (Badhri Jagan Sridharan) \n- xhci: Fix commad ring abort, write all 64 bits to CRCR register. (Mathias Nyman) \n- vgacon: Propagate console boot parameters before calling 'vc_resize' (Maciej W. Rozycki) \n- parisc: Fix 'make install' on newer debian releases (Helge Deller) \n- parisc: Fix KBUILD_IMAGE for self-extracting kernel (Helge Deller) \n- net/smc: Keep smc_close_final rc during active close (Tony Lu) \n- net/rds: correct socket tunable error in rds_tcp_tune() (William Kucharski) \n- net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of '0' if no IRQ is available (Sven Schuchmann) \n- net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (Zhou Qingyang) \n- siphash: use _unaligned version by default (Arnd Bergmann) \n- net: mpls: Fix notifications when deleting a device (Benjamin Poirier) \n- net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() (Zhou Qingyang) \n- natsemi: xtensa: fix section mismatch warnings (Randy Dunlap) \n- sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl (Baokun Li) \n- sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl (Baokun Li) \n- kprobes: Limit max data_size of the kretprobe instances (Masami Hiramatsu) \n- vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit (Stephen Suryaputra) \n- perf hist: Fix memory leak of a perf_hpp_fmt (Ian Rogers) \n- net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock() (Teng Qi) \n- net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound (zhangyue) \n- ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Teng Qi) \n- scsi: iscsi: Unblock session then wake up error handler (Mike Christie) \n- thermal: core: Reset previous low and high trip during thermal zone init (Manaf Meethalavalappu Pallikunhi) \n- btrfs: check-integrity: fix a warning on write caching disabled disk (Wang Yugui) \n- s390/setup: avoid using memblock_enforce_memory_limit (Vasily Gorbik) \n- platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep (Slark Xiao) \n- net: return correct error code (liuguoqiang) \n- NFSv42: Fix pagecache invalidation after COPY/CLONE (Benjamin Coddington) \n- ipc: WARN if trying to remove ipc object which is absent (Alexander Mikhalitsyn) \n- shm: extend forced shm destroy to support objects from several IPC nses (Alexander Mikhalitsyn) \n- tty: hvc: replace BUG_ON() with negative return value (Juergen Gross) \n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (Juergen Gross) \n- fuse: release pipe buf after last use (Miklos Szeredi) \n- NFC: add NCI_UNREG flag to eliminate the race (Lin Ma) \n- arm64: dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function (Marek Behun) \n- arm64: dts: marvell: armada-37xx: declare PCIe reset pin (Miquel Raynal) \n- pinctrl: armada-37xx: Correct PWM pins definitions (Marek Behun) \n- pinctrl: armada-37xx: add missing pin: PCIe1 Wakeup (Gregory CLEMENT) \n- pinctrl: armada-37xx: Correct mpp definitions (Marek Behun) \n- PCI: aardvark: Fix checking for link up via LTSSM state (Pali Rohar) \n- PCI: aardvark: Fix link training (Pali Rohar) \n- PCI: aardvark: Fix PCIe Max Payload Size setting (Pali Rohar) \n- PCI: aardvark: Configure PCIe resources from 'ranges' DT property (Pali Rohar) \n- PCI: aardvark: Remove PCIe outbound window configuration (Evan Wang) \n- PCI: aardvark: Update comment about disabling link training (Pali Rohar) \n- PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link() (Pali Rohar) \n- PCI: aardvark: Fix compilation on s390 (Pali Rohar) \n- PCI: aardvark: Don't touch PCIe registers if no card connected (Pali Rohar) \n- PCI: aardvark: Introduce an advk_pcie_valid_device() helper (Thomas Petazzoni) \n- PCI: aardvark: Indicate error in 'val' when config read fails (Pali Rohar) \n- PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros (Pali Rohar) \n- PCI: aardvark: Issue PERST via GPIO (Pali Rohar) \n- PCI: aardvark: Improve link training (Marek Behun) \n- PCI: aardvark: Train link immediately after enabling training (Pali Rohar) \n- PCI: aardvark: Wait for endpoint to be ready before training link (Remi Pommarel) \n- PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (Wen Yang) \n- PCI: aardvark: Fix I/O space page leak (Sergei Shtylyov) \n- s390/mm: validate VMA in PGSTE manipulation functions (David Hildenbrand) \n- tracing: Check pid filtering when creating events (Steven Rostedt (VMware)) \n- vhost/vsock: fix incorrect used length reported to the guest (Stefano Garzarella) \n- net/smc: Don't call clcsock shutdown twice when smc shutdown (Tony Lu) \n- MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 (Huang Pei) \n- tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows (Eric Dumazet) \n- net/smc: Ensure the active closing peer first closes clcsock (Tony Lu) \n- ipv6: fix typos in __ip6_finish_output() (Eric Dumazet) \n- drm/vc4: fix error code in vc4_create_object() (Dan Carpenter) \n- scsi: mpt3sas: Fix kernel panic during drive powercycle test (Sreekanth Reddy) \n- ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (Takashi Iwai) \n- NFSv42: Don't fail clone() unless the OP_CLONE operation failed (Trond Myklebust) \n- net: ieee802154: handle iftypes as u32 (Alexander Aring) \n- ASoC: topology: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ARM: dts: BCM5301X: Add interrupt properties to GPIO node (Florian Fainelli) \n- ARM: dts: BCM5301X: Fix I2C controller interrupt (Florian Fainelli) \n- netfilter: ipvs: Fix reuse connection if RS weight is 0 (yangxingwu) \n- tracing: Fix pid filtering when triggers are attached (Steven Rostedt (VMware)) \n- xen: detect uninitialized xenbus in xenbus_init (Stefano Stabellini) \n- xen: don't continue xenstore initialization in case of errors (Stefano Stabellini) \n- fuse: fix page stealing (Miklos Szeredi) \n- staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (Dan Carpenter) \n- HID: wacom: Use 'Confidence' flag to prevent reporting invalid contacts (Jason Gerecke) \n- media: cec: copy sequence field for the reply (Hans Verkuil) \n- ALSA: ctxfi: Fix out-of-range access (Takashi Iwai) \n- usb: hub: Fix locking issues with address0_mutex (Mathias Nyman) \n- usb: hub: Fix usb enumeration issue due to address0 race (Mathias Nyman) \n- USB: serial: option: add Fibocom FM101-GL variants (Mingjie Zhang) \n- USB: serial: option: add Telit LE910S1 0x9200 composition (Daniele Palmas)", "published": "2022-04-25T00:00:00", "modified": "2022-04-25T00:00:00", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 9.0}, "severity": "HIGH", "exploitabilityScore": 8.0, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, "href": "http://linux.oracle.com/errata/ELSA-2022-9313.html", "reporter": "OracleLinux", "references": [], "cvelist": ["CVE-2020-36516", "CVE-2021-20317", "CVE-2021-26401", "CVE-2021-4002", "CVE-2021-4149", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0617", "CVE-2022-0847", "CVE-2022-1016", "CVE-2022-22942", "CVE-2022-24448", "CVE-2022-26966"], "immutableFields": [], "lastseen": "2022-07-12T18:39:43", "viewCount": 47, "enchantments": {"score": {"value": 0.0, "vector": "NONE"}, "dependencies": {"references": [{"type": "almalinux", "idList": ["ALSA-2021:4647", "ALSA-2022:0825", "ALSA-2022:1988"]}, {"type": "amazon", "idList": ["ALAS-2022-1563", "ALAS-2022-1571", "ALAS-2022-1577", "ALAS2-2021-1719", "ALAS2-2021-1727", "ALAS2-2022-1749", "ALAS2-2022-1761", "ALAS2-2022-1768"]}, {"type": "amd", "idList": ["AMD-SB-1036"]}, {"type": "androidsecurity", "idList": ["ANDROID:2022-05-01"]}, {"type": "attackerkb", "idList": ["AKB:EA31F9B4-91F6-4926-9B68-5F98B55FC0FE"]}, {"type": "centos", "idList": ["CESA-2022:0620", "CESA-2022:4642"]}, {"type": "cisa", "idList": ["CISA:36070B40E6791FC966ACFEACAE76F54C"]}, {"type": "citrix", "idList": ["CTX341586"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:1B101FB251EDFB9515B6EABF00F1012E", "CFOUNDRY:53F8A02950D1071788BF2E23EFF823EF", "CFOUNDRY:73F8C8B872786F9D1C6842EE16AD1519", "CFOUNDRY:873D4C50CDC37566272A2CA3925ADB7A", "CFOUNDRY:9170AF39C296B9726CD7B93B3A36EC22", "CFOUNDRY:C1D2F4D8A3F0384C89F6C8D93A4DCF97", "CFOUNDRY:C7BE92CF45CB8F4FCBCEA8F043427BCF", "CFOUNDRY:EFCCA8E89849350B3F5BDC16FFE250F8"]}, {"type": "cloudlinux", "idList": ["CLSA-2022:1650986488", "CLSA-2022:1650986589"]}, {"type": "cve", "idList": ["CVE-2020-36516", "CVE-2021-20317", "CVE-2021-26401", "CVE-2021-4002", "CVE-2021-4149", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0617", "CVE-2022-0847", "CVE-2022-24448", "CVE-2022-26966"]}, {"type": "debian", "idList": ["DEBIAN:DLA-2843-1:AB8E9", "DEBIAN:DLA-2940-1:FB71D", "DEBIAN:DLA-2941-1:96084", "DEBIAN:DLA-3065-1:C1710", "DEBIAN:DSA-5092-1:463D4", "DEBIAN:DSA-5095-1:31FF6", "DEBIAN:DSA-5096-1:B47F5", "DEBIAN:DSA-5127-1:B6959", "DEBIAN:DSA-5173-1:5A28E"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2020-36516", "DEBIANCVE:CVE-2021-20317", "DEBIANCVE:CVE-2021-26401", "DEBIANCVE:CVE-2021-4002", "DEBIANCVE:CVE-2021-4149", "DEBIANCVE:CVE-2022-0330", "DEBIANCVE:CVE-2022-0435", "DEBIANCVE:CVE-2022-0492", "DEBIANCVE:CVE-2022-0617", "DEBIANCVE:CVE-2022-0847", "DEBIANCVE:CVE-2022-1016", "DEBIANCVE:CVE-2022-22942", "DEBIANCVE:CVE-2022-24448", "DEBIANCVE:CVE-2022-26966"]}, {"type": "exploitdb", "idList": ["EDB-ID:50808"]}, {"type": "f5", "idList": ["F5:K30914425", "F5:K54724312", "F5:K63603485"]}, {"type": "fedora", "idList": ["FEDORA:2C60130E5BFF", "FEDORA:3C62F312AD5B", "FEDORA:5021030569C0", "FEDORA:6CC3030C5A5F", "FEDORA:956DE30B8B74"]}, {"type": "githubexploit", "idList": ["05772ECE-A777-5C16-8AE4-25697DCA9E81", "0661150D-5F5B-5091-9137-D0F74B0B773E", "06ADB47C-85A7-55EC-AF1F-B6D385357D51", "086F5A44-8ECA-5D00-9C60-EC88FF0A6024", "0A92F6C1-7482-5379-9255-395EE9F50C04", "0AB0DD16-3EF1-5D1D-BE61-96FDD1D699D1", "0CEB4629-9B78-506E-A0CF-6E62D3203564", "0F72D810-4FD9-5249-B4EE-C262C0E8E81F", "12570BB6-9BCA-5792-9E08-32A83CFD8209", "12586F18-65D0-56EC-ABDC-A2C75034CF09", "18307056-6D88-5195-8CFA-56E31359A0D0", "1964C242-8B6C-5810-8E68-05612C82FC9C", "1BD47E86-3B10-5D96-B1C1-658AFD757407", "1F2532B3-0167-53EA-ACD1-3EC546ACA052", "269A4547-2CD1-5B12-B3D0-9D78BE5431EC", "2C78124E-4C73-5C91-B8BF-5079AC3CDFA1", "2F7AEDB6-2F5A-5DA7-A85D-746DEA4C7B0B", "32070F43-C6B7-5C66-89ED-2AE2F8A1DD03", "3508DC5C-AD5C-508A-B78C-09B6AAEB232C", "3773C013-3749-58FC-826E-D8D781A68DF0", "38C8D690-B509-5A38-90C0-C9F825598CD9", "3B3DFBBD-2F8E-56CE-B2A4-9D5D4527B2E9", "483F1274-762B-571F-949F-1C5067A06733", "492EFDCD-23F3-59CE-A969-F39D7FDC6A26", "4ABDA4BC-28F3-5905-A32E-0ACA0226EDFB", "52F5C576-65D5-5536-996C-AF0A19F01F5B", "54CB6211-047E-5129-8A15-3E47982A69B7", "564795E6-048F-581C-B600-4CA7B45E1319", "65583195-380B-5F46-A183-7DD135337290", "687DFFBC-B653-59B8-BEB3-091905C4B176", "689C5F8A-6D6F-57E5-9B20-4E85EB67AE29", "68FB3CCC-E98B-5AB8-BB16-9661E947858E", "707C38FA-F0B2-55CC-8D02-98EDBDDA27DB", "71F849A9-2312-5FE0-83E4-C6DE378661BA", "768F8F97-383F-5D15-BBA5-81FFC7138CD5", "84404A2B-FE32-5957-BBF3-981AF3074BF4", "8B409CA3-4DAE-57CA-B491-B4590CB1E0FB", "8F8D2F72-BC08-5672-91A1-523A5EF7D1AA", "90A1A21C-0BCB-5C0E-AC76-A9EEC30F9907", "9164EE1E-594B-5679-8EF8-6BB9506270D0", "91ACFD93-47E2-56B0-A34A-8DC0F7D97A8E", "926D289B-3E6E-5186-8511-1F7D832A8CAD", "9840D3EA-61BB-54B6-904A-09DAD15F24DC", "9FDDDA87-06DB-51EC-ADC5-5009B1A6F124", "A171AB83-32C6-5B8D-9F82-F426CC504532", "A249241C-8F8A-5640-BDDD-E66E8A9E48B8", "A3B770BE-1A12-5CD4-A06F-EE317094975F", "A404C02A-61C8-53DD-9BC0-EDE503C19C2C", "A714BDDC-3F3E-5762-8D54-A97B7FAD41C4", "ABF4B7F4-3AAC-58C8-B546-FC4ED5C0827A", "AC8391C6-9C7C-562A-A523-E925BC4005C3", "B534183D-00E6-58F7-BD0F-372BEC91370C", "B573163B-4BBC-5984-8941-EC17F24348B1", "BB31C2F4-F061-56B0-A316-953AD0E4E42E", "BC274E1C-826C-5417-953C-082B3ECA17BD", "C9458BBE-5F11-5BB6-BE59-8D6EC5E3D513", "CAF813CE-0A25-5EA7-93B7-BEA8325E0296", "D144D690-C331-5457-B5B3-92AE9A0109D6", "D3E5B654-426C-530F-AD24-9E84C86C623A", "D86EDC54-781B-5FC3-95F4-35B9EB4DFF0B", "DFCB8D82-860E-5D5D-ABA6-50C59B69936B", "DFF99976-FE50-580B-8456-0C46E6F1AA69", "E15E347F-A26F-5F55-AA97-650439269AD6", "E486E79A-CFAD-56DE-B622-D64E700A822C", "E4C46A03-D265-51D4-AF1A-A576FA76B6B3", "ED3ABF40-1012-549B-9D0F-E7434B20E12A", "F68A7C89-1ADB-5CF7-8EAC-4DEA137ED81A", "F6CBF78D-D79C-5DEC-A6E9-A8FC076880BE", "F96353A7-4B24-55A5-94FF-961F6C500826"]}, {"type": "hivepro", "idList": ["HIVEPRO:0FD85E9ED6B2DCA44395302577E41C7B", "HIVEPRO:B25417250BE7F8A7BBB1186F85A865F9", "HIVEPRO:B59A6E24EF39F36B9D2E6D13B050D69A", "HIVEPRO:BCE2BBD9B7F60262FC88072724858373"]}, {"type": "ibm", "idList": ["72AD5D71FF571D991FCA51BDAC7D0D303109A868FA89340C6F8CD492F9F038E3", "8629A4ADAFCB95D5120D30DB27A7FEE450956908C79505EDF721F7E19CC8A212", "91D7C6C9A5739FEE5F42D389A6790AF75591DE3F4B00792DEC9B2F9736C9AA92", "A654520C31D8C30F04EA4DF13D66906D11A4C16B55D50B50EB88F47415ABF80C", "B2EA2FBA4D280351FEA7F9EC1921C448D44F4D9EC613590A87A15467F7D34153", "B315A585CDBD4D516E60AAEBBA49CDD9274D016108F5F855F13CF2FE3AA0F562", "ED670677BEE7F824FAA4922AD08CFBF43478203FCCB636E589E6854737336228"]}, {"type": "ics", "idList": ["ICSA-22-167-09"]}, {"type": "mageia", "idList": ["MGASA-2021-0538", "MGASA-2021-0539", "MGASA-2022-0041", "MGASA-2022-0042", "MGASA-2022-0062", "MGASA-2022-0063", "MGASA-2022-0092", "MGASA-2022-0095", "MGASA-2022-0121", "MGASA-2022-0122"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:1A0558E103585383F84E3D6A1AD1518E"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT-LINUX-LOCAL-CVE_2022_0847_DIRTYPIPE-"]}, {"type": "nessus", "idList": ["AL2_ALAS-2021-1719.NASL", "AL2_ALAS-2021-1727.NASL", "AL2_ALAS-2022-1749.NASL", "AL2_ALAS-2022-1761.NASL", "AL2_ALAS-2022-1768.NASL", "AL2_ALASKERNEL-5_10-2022-010.NASL", "AL2_ALASKERNEL-5_10-2022-011.NASL", "AL2_ALASKERNEL-5_10-2022-012.NASL", "AL2_ALASKERNEL-5_15-2022-001.NASL", "AL2_ALASKERNEL-5_4-2022-022.NASL", "AL2_ALASKERNEL-5_4-2022-023.NASL", "AL2_ALASKERNEL-5_4-2022-024.NASL", "ALA_ALAS-2022-1563.NASL", "ALA_ALAS-2022-1571.NASL", "ALA_ALAS-2022-1577.NASL", "ALMA_LINUX_ALSA-2021-4647.NASL", "ALMA_LINUX_ALSA-2022-1988.NASL", "CENTOS8_RHSA-2021-4646.NASL", "CENTOS8_RHSA-2021-4647.NASL", "CENTOS8_RHSA-2022-0825.NASL", "CENTOS_RHSA-2022-0620.NASL", "CENTOS_RHSA-2022-4642.NASL", "DEBIAN_DLA-2843.NASL", "DEBIAN_DLA-3065.NASL", "DEBIAN_DSA-5092.NASL", "DEBIAN_DSA-5095.NASL", "DEBIAN_DSA-5096.NASL", "DEBIAN_DSA-5127.NASL", "DEBIAN_DSA-5173.NASL", "EULEROS_SA-2022-1292.NASL", "EULEROS_SA-2022-1308.NASL", "EULEROS_SA-2022-1328.NASL", "EULEROS_SA-2022-1366.NASL", "EULEROS_SA-2022-1376.NASL", "EULEROS_SA-2022-1402.NASL", "EULEROS_SA-2022-1429.NASL", "EULEROS_SA-2022-1450.NASL", "EULEROS_SA-2022-1466.NASL", "EULEROS_SA-2022-1475.NASL", "EULEROS_SA-2022-1523.NASL", "EULEROS_SA-2022-1537.NASL", "EULEROS_SA-2022-1607.NASL", "EULEROS_SA-2022-1630.NASL", "EULEROS_SA-2022-1647.NASL", "EULEROS_SA-2022-1661.NASL", "EULEROS_SA-2022-1681.NASL", "EULEROS_SA-2022-1735.NASL", "EULEROS_SA-2022-1779.NASL", "EULEROS_SA-2022-1780.NASL", "EULEROS_SA-2022-1781.NASL", "EULEROS_SA-2022-1782.NASL", "EULEROS_SA-2022-1791.NASL", "EULEROS_SA-2022-1808.NASL", "EULEROS_SA-2022-1817.NASL", "EULEROS_SA-2022-1829.NASL", "EULEROS_SA-2022-1844.NASL", "EULEROS_SA-2022-1868.NASL", "EULEROS_SA-2022-1896.NASL", "EULEROS_SA-2022-1934.NASL", "EULEROS_SA-2022-1969.NASL", "EULEROS_SA-2022-2026.NASL", "EULEROS_SA-2022-2054.NASL", "EULEROS_SA-2022-2075.NASL", "EULEROS_SA-2022-2081.NASL", "EULEROS_SA-2022-2181.NASL", "EULEROS_SA-2022-2200.NASL", "F5_BIGIP_SOL54724312.NASL", "NEWSTART_CGSL_NS-SA-2022-0004_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2022-0024_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2022-0074_KERNEL.NASL", "OPENSUSE-2021-3876.NASL", "OPENSUSE-2022-0056-1.NASL", "OPENSUSE-2022-0131-1.NASL", "OPENSUSE-2022-0169-1.NASL", "OPENSUSE-2022-0198-1.NASL", "OPENSUSE-2022-0363-1.NASL", "OPENSUSE-2022-0366-1.NASL", "OPENSUSE-2022-0370-1.NASL", "OPENSUSE-2022-0755-1.NASL", "OPENSUSE-2022-0760-1.NASL", "OPENSUSE-2022-0768-1.NASL", "OPENSUSE-2022-0940-1.NASL", "OPENSUSE-2022-1037-1.NASL", "OPENSUSE-2022-1039-1.NASL", "ORACLELINUX_ELSA-2021-4647.NASL", "ORACLELINUX_ELSA-2021-5227.NASL", "ORACLELINUX_ELSA-2022-0620.NASL", "ORACLELINUX_ELSA-2022-0825.NASL", "ORACLELINUX_ELSA-2022-1988.NASL", "ORACLELINUX_ELSA-2022-4642.NASL", "ORACLELINUX_ELSA-2022-9141.NASL", "ORACLELINUX_ELSA-2022-9142.NASL", "ORACLELINUX_ELSA-2022-9147.NASL", "ORACLELINUX_ELSA-2022-9148.NASL", "ORACLELINUX_ELSA-2022-9179.NASL", "ORACLELINUX_ELSA-2022-9180.NASL", "ORACLELINUX_ELSA-2022-9210.NASL", "ORACLELINUX_ELSA-2022-9211.NASL", "ORACLELINUX_ELSA-2022-9212.NASL", "ORACLELINUX_ELSA-2022-9213.NASL", "ORACLELINUX_ELSA-2022-9244.NASL", "ORACLELINUX_ELSA-2022-9245.NASL", "ORACLELINUX_ELSA-2022-9260.NASL", "ORACLELINUX_ELSA-2022-9266.NASL", "ORACLELINUX_ELSA-2022-9267.NASL", "ORACLELINUX_ELSA-2022-9270.NASL", "ORACLELINUX_ELSA-2022-9271.NASL", "ORACLELINUX_ELSA-2022-9273.NASL", "ORACLELINUX_ELSA-2022-9274.NASL", "ORACLELINUX_ELSA-2022-9313.NASL", "ORACLELINUX_ELSA-2022-9314.NASL", "ORACLELINUX_ELSA-2022-9348.NASL", "ORACLELINUX_ELSA-2022-9365.NASL", "ORACLELINUX_ELSA-2022-9368.NASL", "ORACLELINUX_ELSA-2022-9667.NASL", "ORACLEVM_OVMSA-2022-0011.NASL", "ORACLEVM_OVMSA-2022-0014.NASL", "REDHAT-RHSA-2021-4646.NASL", "REDHAT-RHSA-2021-4647.NASL", "REDHAT-RHSA-2021-4648.NASL", "REDHAT-RHSA-2021-4650.NASL", "REDHAT-RHSA-2021-4871.NASL", "REDHAT-RHSA-2021-4875.NASL", "REDHAT-RHSA-2022-0592.NASL", "REDHAT-RHSA-2022-0620.NASL", "REDHAT-RHSA-2022-0622.NASL", "REDHAT-RHSA-2022-0712.NASL", "REDHAT-RHSA-2022-0718.NASL", "REDHAT-RHSA-2022-0771.NASL", "REDHAT-RHSA-2022-0772.NASL", "REDHAT-RHSA-2022-0777.NASL", "REDHAT-RHSA-2022-0819.NASL", "REDHAT-RHSA-2022-0820.NASL", "REDHAT-RHSA-2022-0821.NASL", "REDHAT-RHSA-2022-0822.NASL", "REDHAT-RHSA-2022-0823.NASL", "REDHAT-RHSA-2022-0825.NASL", "REDHAT-RHSA-2022-0831.NASL", "REDHAT-RHSA-2022-0841.NASL", "REDHAT-RHSA-2022-0849.NASL", "REDHAT-RHSA-2022-0851.NASL", "REDHAT-RHSA-2022-0925.NASL", "REDHAT-RHSA-2022-0958.NASL", "REDHAT-RHSA-2022-1103.NASL", "REDHAT-RHSA-2022-1104.NASL", "REDHAT-RHSA-2022-1106.NASL", "REDHAT-RHSA-2022-1107.NASL", "REDHAT-RHSA-2022-1186.NASL", "REDHAT-RHSA-2022-1209.NASL", "REDHAT-RHSA-2022-1213.NASL", "REDHAT-RHSA-2022-1263.NASL", "REDHAT-RHSA-2022-1324.NASL", "REDHAT-RHSA-2022-1373.NASL", "REDHAT-RHSA-2022-1413.NASL", "REDHAT-RHSA-2022-1417.NASL", "REDHAT-RHSA-2022-1418.NASL", "REDHAT-RHSA-2022-1455.NASL", "REDHAT-RHSA-2022-1589.NASL", "REDHAT-RHSA-2022-1619.NASL", "REDHAT-RHSA-2022-1975.NASL", "REDHAT-RHSA-2022-1988.NASL", "REDHAT-RHSA-2022-2186.NASL", "REDHAT-RHSA-2022-2189.NASL", "REDHAT-RHSA-2022-2211.NASL", "REDHAT-RHSA-2022-4642.NASL", "REDHAT-RHSA-2022-4644.NASL", "REDHAT-RHSA-2022-4655.NASL", "REDHAT-RHSA-2022-4717.NASL", "REDHAT-RHSA-2022-4721.NASL", "REDHAT-RHSA-2022-5157.NASL", "ROCKY_LINUX_RLSA-2021-4646.NASL", "ROCKY_LINUX_RLSA-2021-4647.NASL", "ROCKY_LINUX_RLSA-2022-1975.NASL", "ROCKY_LINUX_RLSA-2022-1988.NASL", "ROCKY_LINUX_RLSA-2022-819.NASL", "ROCKY_LINUX_RLSA-2022-825.NASL", "SLACKWARE_SSA_2022-031-01.NASL", "SLACKWARE_SSA_2022-067-01.NASL", "SLACKWARE_SSA_2022-129-01.NASL", "SL_20220223_KERNEL_ON_SL7_X.NASL", "SL_20220519_KERNEL_ON_SL7_X.NASL", "SUSE_SU-2021-3876-1.NASL", "SUSE_SU-2021-3969-1.NASL", "SUSE_SU-2021-3972-1.NASL", "SUSE_SU-2022-0056-1.NASL", "SUSE_SU-2022-0068-1.NASL", "SUSE_SU-2022-0079-1.NASL", "SUSE_SU-2022-0080-1.NASL", "SUSE_SU-2022-0090-1.NASL", "SUSE_SU-2022-0131-1.NASL", "SUSE_SU-2022-0169-1.NASL", "SUSE_SU-2022-0181-1.NASL", "SUSE_SU-2022-0197-1.NASL", "SUSE_SU-2022-0198-1.NASL", "SUSE_SU-2022-0288-1.NASL", "SUSE_SU-2022-0289-1.NASL", "SUSE_SU-2022-0362-1.NASL", "SUSE_SU-2022-0363-1.NASL", "SUSE_SU-2022-0364-1.NASL", "SUSE_SU-2022-0365-1.NASL", "SUSE_SU-2022-0366-1.NASL", "SUSE_SU-2022-0367-1.NASL", "SUSE_SU-2022-0370-1.NASL", "SUSE_SU-2022-0371-1.NASL", "SUSE_SU-2022-0372-1.NASL", "SUSE_SU-2022-0418-1.NASL", "SUSE_SU-2022-0429-1.NASL", "SUSE_SU-2022-0436-1.NASL", "SUSE_SU-2022-0463-1.NASL", "SUSE_SU-2022-0477-1.NASL", "SUSE_SU-2022-0543-1.NASL", "SUSE_SU-2022-0544-1.NASL", "SUSE_SU-2022-0555-1.NASL", "SUSE_SU-2022-0755-1.NASL", "SUSE_SU-2022-0756-1.NASL", "SUSE_SU-2022-0757-1.NASL", "SUSE_SU-2022-0759-1.NASL", "SUSE_SU-2022-0760-1.NASL", "SUSE_SU-2022-0761-1.NASL", "SUSE_SU-2022-0762-1.NASL", "SUSE_SU-2022-0763-1.NASL", "SUSE_SU-2022-0764-1.NASL", "SUSE_SU-2022-0765-1.NASL", "SUSE_SU-2022-0766-1.NASL", "SUSE_SU-2022-0767-1.NASL", "SUSE_SU-2022-0768-1.NASL", "SUSE_SU-2022-0931-1.NASL", "SUSE_SU-2022-0939-1.NASL", "SUSE_SU-2022-0940-1.NASL", "SUSE_SU-2022-0978-1.NASL", "SUSE_SU-2022-0984-1.NASL", "SUSE_SU-2022-0991-1.NASL", "SUSE_SU-2022-0998-1.NASL", "SUSE_SU-2022-1012-1.NASL", "SUSE_SU-2022-1035-1.NASL", "SUSE_SU-2022-1036-1.NASL", "SUSE_SU-2022-1037-1.NASL", "SUSE_SU-2022-1038-1.NASL", "SUSE_SU-2022-1039-1.NASL", "SUSE_SU-2022-1163-1.NASL", "SUSE_SU-2022-1172-1.NASL", "SUSE_SU-2022-1183-1.NASL", "SUSE_SU-2022-1189-1.NASL", "SUSE_SU-2022-1193-1.NASL", "SUSE_SU-2022-1194-1.NASL", "SUSE_SU-2022-1196-1.NASL", "SUSE_SU-2022-1197-1.NASL", "SUSE_SU-2022-1212-1.NASL", "SUSE_SU-2022-1223-1.NASL", "SUSE_SU-2022-1242-1.NASL", "SUSE_SU-2022-1246-1.NASL", "SUSE_SU-2022-1255-1.NASL", "SUSE_SU-2022-1256-1.NASL", "SUSE_SU-2022-1257-1.NASL", "SUSE_SU-2022-1266-1.NASL", "SUSE_SU-2022-1267-1.NASL", "SUSE_SU-2022-1270-1.NASL", "SUSE_SU-2022-1278-1.NASL", "SUSE_SU-2022-1283-1.NASL", "SUSE_SU-2022-1285-1.NASL", "SUSE_SU-2022-1300-1.NASL", "SUSE_SU-2022-1318-1.NASL", "SUSE_SU-2022-1320-1.NASL", "SUSE_SU-2022-1322-1.NASL", "SUSE_SU-2022-1326-1.NASL", "SUSE_SU-2022-1329-1.NASL", "SUSE_SU-2022-1335-1.NASL", "SUSE_SU-2022-1359-1.NASL", "SUSE_SU-2022-1369-1.NASL", "SUSE_SU-2022-1375-1.NASL", "SUSE_SU-2022-1402-1.NASL", "SUSE_SU-2022-1407-1.NASL", "SUSE_SU-2022-1408-1.NASL", "SUSE_SU-2022-1440-1.NASL", "SUSE_SU-2022-1453-1.NASL", "SUSE_SU-2022-1486-1.NASL", "SUSE_SU-2022-14905-1.NASL", "SUSE_SU-2022-1569-1.NASL", "SUSE_SU-2022-1575-1.NASL", "SUSE_SU-2022-1580-1.NASL", "SUSE_SU-2022-1589-1.NASL", "SUSE_SU-2022-1591-1.NASL", "SUSE_SU-2022-1593-1.NASL", "SUSE_SU-2022-1605-1.NASL", "SUSE_SU-2022-1637-1.NASL", "SUSE_SU-2022-1640-1.NASL", "SUSE_SU-2022-2079-1.NASL", "SUSE_SU-2022-2080-1.NASL", "SUSE_SU-2022-2111-1.NASL", "SUSE_SU-2022-2268-1.NASL", "SUSE_SU-2022-2520-1.NASL", "SUSE_SU-2022-2615-1.NASL", "UBUNTU_USN-5206-1.NASL", "UBUNTU_USN-5207-1.NASL", "UBUNTU_USN-5208-1.NASL", "UBUNTU_USN-5209-1.NASL", "UBUNTU_USN-5210-1.NASL", "UBUNTU_USN-5211-1.NASL", "UBUNTU_USN-5218-1.NASL", "UBUNTU_USN-5278-1.NASL", "UBUNTU_USN-5294-1.NASL", "UBUNTU_USN-5294-2.NASL", "UBUNTU_USN-5295-1.NASL", "UBUNTU_USN-5295-2.NASL", "UBUNTU_USN-5297-1.NASL", "UBUNTU_USN-5298-1.NASL", "UBUNTU_USN-5302-1.NASL", "UBUNTU_USN-5317-1.NASL", "UBUNTU_USN-5337-1.NASL", "UBUNTU_USN-5338-1.NASL", "UBUNTU_USN-5339-1.NASL", "UBUNTU_USN-5343-1.NASL", "UBUNTU_USN-5362-1.NASL", "UBUNTU_USN-5368-1.NASL", "UBUNTU_USN-5377-1.NASL", "UBUNTU_USN-5381-1.NASL", "UBUNTU_USN-5383-1.NASL", "UBUNTU_USN-5384-1.NASL", "UBUNTU_USN-5385-1.NASL", "UBUNTU_USN-5390-1.NASL", "UBUNTU_USN-5390-2.NASL", "UBUNTU_USN-5415-1.NASL", "UBUNTU_USN-5417-1.NASL", "UBUNTU_USN-5418-1.NASL", "UBUNTU_USN-5466-1.NASL", "UBUNTU_USN-5467-1.NASL", "UBUNTU_USN-5505-1.NASL"]}, {"type": "oracle", "idList": ["ORACLE:CPUJUL2022"]}, {"type": "oraclelinux", "idList": ["ELSA-2021-4647", "ELSA-2022-0620", "ELSA-2022-0825", "ELSA-2022-1988", "ELSA-2022-4642", "ELSA-2022-9141", "ELSA-2022-9142", "ELSA-2022-9147", "ELSA-2022-9148", "ELSA-2022-9179", "ELSA-2022-9180", "ELSA-2022-9210", "ELSA-2022-9211", "ELSA-2022-9212", "ELSA-2022-9213", "ELSA-2022-9244", "ELSA-2022-9245", "ELSA-2022-9260", "ELSA-2022-9266", "ELSA-2022-9267", "ELSA-2022-9270", "ELSA-2022-9271", "ELSA-2022-9273", "ELSA-2022-9274", "ELSA-2022-9314", "ELSA-2022-9348", "ELSA-2022-9365", "ELSA-2022-9368", "ELSA-2022-9667"]}, {"type": "osv", "idList": ["OSV:DLA-2843-1", "OSV:DLA-2940-1", "OSV:DLA-2941-1", "OSV:DLA-3065-1", "OSV:DSA-5092-1", "OSV:DSA-5095-1", "OSV:DSA-5096-1", "OSV:DSA-5127-1", "OSV:DSA-5173-1"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:166258"]}, {"type": "photon", "idList": ["PHSA-2021-0138", "PHSA-2021-0325", "PHSA-2022-0148", "PHSA-2022-0151", "PHSA-2022-0152", "PHSA-2022-0160", "PHSA-2022-0168", "PHSA-2022-0341", "PHSA-2022-0356", "PHSA-2022-0361", "PHSA-2022-0376", "PHSA-2022-0393", "PHSA-2022-0433", "PHSA-2022-0440", "PHSA-2022-0449", "PHSA-2022-0459", "PHSA-2022-0460", "PHSA-2022-0464", "PHSA-2022-0469", "PHSA-2022-0473"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:02EDDA927928C11A6D10A4A0D17823AF", "RAPID7BLOG:07CA09B4E3B3835E096AA56546C43E8E", "RAPID7BLOG:5BB9C8859E9D36496DAB6425419453D9", "RAPID7BLOG:C89CBECF94C64F41DF3E509527A73690"]}, {"type": "redhat", "idList": ["RHSA-2021:4646", "RHSA-2021:4647", "RHSA-2021:4648", "RHSA-2021:4650", "RHSA-2021:4871", "RHSA-2021:4875", "RHSA-2021:4914", "RHSA-2021:5038", "RHSA-2021:5127", "RHSA-2021:5129", "RHSA-2022:0592", "RHSA-2022:0620", "RHSA-2022:0622", "RHSA-2022:0712", "RHSA-2022:0718", "RHSA-2022:0771", "RHSA-2022:0772", "RHSA-2022:0777", "RHSA-2022:0819", "RHSA-2022:0820", "RHSA-2022:0821", "RHSA-2022:0822", "RHSA-2022:0823", "RHSA-2022:0825", "RHSA-2022:0831", "RHSA-2022:0841", "RHSA-2022:0849", "RHSA-2022:0851", "RHSA-2022:0856", "RHSA-2022:0925", "RHSA-2022:0958", "RHSA-2022:1083", "RHSA-2022:1103", "RHSA-2022:1104", "RHSA-2022:1106", "RHSA-2022:1107", "RHSA-2022:1186", "RHSA-2022:1209", "RHSA-2022:1213", "RHSA-2022:1263", "RHSA-2022:1324", "RHSA-2022:1373", "RHSA-2022:1396", "RHSA-2022:1413", "RHSA-2022:1417", "RHSA-2022:1418", "RHSA-2022:1455", "RHSA-2022:1476", "RHSA-2022:1589", "RHSA-2022:1619", "RHSA-2022:1622", "RHSA-2022:1699", "RHSA-2022:1975", "RHSA-2022:1988", "RHSA-2022:2186", "RHSA-2022:2189", "RHSA-2022:2211", "RHSA-2022:4642", "RHSA-2022:4644", "RHSA-2022:4655", "RHSA-2022:4717", "RHSA-2022:4721", "RHSA-2022:4814", "RHSA-2022:4956", "RHSA-2022:5157", "RHSA-2022:5201", "RHSA-2022:5392", "RHSA-2022:5483"]}, {"type": "redhatcve", "idList": ["RH:CVE-2020-36516", "RH:CVE-2021-20317", "RH:CVE-2021-26401", "RH:CVE-2021-4002", "RH:CVE-2021-4149", "RH:CVE-2022-0330", "RH:CVE-2022-0435", "RH:CVE-2022-0492", "RH:CVE-2022-0617", "RH:CVE-2022-0847", "RH:CVE-2022-1016", "RH:CVE-2022-22942", "RH:CVE-2022-24448", "RH:CVE-2022-26966"]}, {"type": "rocky", "idList": ["RLSA-2021:4646", "RLSA-2021:4647", "RLSA-2022:1975", "RLSA-2022:1988", "RLSA-2022:819", "RLSA-2022:825"]}, {"type": "securelist", "idList": ["SECURELIST:11665FFD7075FB9D59316195101DE894", "SECURELIST:895B39A6085B9876A2B776FD85EF2689"]}, {"type": "slackware", "idList": ["SSA-2022-031-01", "SSA-2022-067-01", "SSA-2022-129-01"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2022:0056-1", "OPENSUSE-SU-2022:0131-1", "OPENSUSE-SU-2022:0169-1", "OPENSUSE-SU-2022:0198-1", "OPENSUSE-SU-2022:0363-1", "OPENSUSE-SU-2022:0366-1", "OPENSUSE-SU-2022:0370-1", "OPENSUSE-SU-2022:0755-1", "OPENSUSE-SU-2022:0760-1", "OPENSUSE-SU-2022:0768-1", "OPENSUSE-SU-2022:0940-1", "OPENSUSE-SU-2022:1037-1", "OPENSUSE-SU-2022:1039-1", "SUSE-SU-2022:1163-1", "SUSE-SU-2022:1183-1", "SUSE-SU-2022:1256-1", "SUSE-SU-2022:2079-1", "SUSE-SU-2022:2111-1", "SUSE-SU-2022:2520-1", "SUSE-SU-2022:2615-1"]}, {"type": "thn", "idList": ["THN:8198C407B889F0B459BC5B078A2D620C", "THN:938E26EF0D2BCE29F29F40BEEB9944AB", "THN:B3B3DCC2A63D28F471BD0B6A3E2BD325", "THN:E1BBDEC03BFACEE731E20A3BE9FFD214"]}, {"type": "threatpost", "idList": ["THREATPOST:1A553B57472BB0EB8D69F573B510FDE6", "THREATPOST:932AA74F12B9D2AD0E8589AC1A2C1438"]}, {"type": "trendmicroblog", "idList": ["TRENDMICROBLOG:0C2FF089C7ACB1C778D7B5AC05563AA6"]}, {"type": "ubuntu", "idList": ["LSN-0083-1", "LSN-0085-1", "LSN-0086-1", "USN-5206-1", "USN-5207-1", "USN-5208-1", "USN-5209-1", "USN-5210-1", "USN-5210-2", "USN-5211-1", "USN-5218-1", "USN-5278-1", "USN-5294-1", "USN-5294-2", "USN-5295-1", "USN-5295-2", "USN-5297-1", "USN-5298-1", "USN-5302-1", "USN-5317-1", "USN-5337-1", "USN-5338-1", "USN-5339-1", "USN-5343-1", "USN-5362-1", "USN-5368-1", "USN-5377-1", "USN-5381-1", "USN-5383-1", "USN-5384-1", "USN-5385-1", "USN-5390-1", "USN-5390-2", "USN-5415-1", "USN-5417-1", "USN-5418-1", "USN-5466-1", "USN-5467-1", "USN-5505-1", "USN-5513-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2020-36516", "UB:CVE-2021-20317", "UB:CVE-2021-26401", "UB:CVE-2021-4002", "UB:CVE-2021-4149", "UB:CVE-2022-0330", "UB:CVE-2022-0435", "UB:CVE-2022-0492", "UB:CVE-2022-0617", "UB:CVE-2022-0847", "UB:CVE-2022-1016", "UB:CVE-2022-22942", "UB:CVE-2022-24448", "UB:CVE-2022-26966"]}, {"type": "veracode", "idList": ["VERACODE:33126", "VERACODE:33693", "VERACODE:34347", "VERACODE:34616", "VERACODE:34843", "VERACODE:34844", "VERACODE:35280", "VERACODE:35281", "VERACODE:35531", "VERACODE:35533", "VERACODE:36099"]}, {"type": "virtuozzo", "idList": ["VZA-2022-015"]}, {"type": "xen", "idList": ["XSA-398"]}, {"type": "zdt", "idList": ["1337DAY-ID-37458", "1337DAY-ID-37460", "1337DAY-ID-37461", "1337DAY-ID-37474"]}]}, "epss": [{"cve": "CVE-2020-36516", "epss": "0.000470000", "percentile": "0.142870000", "modified": "2023-03-19"}, {"cve": "CVE-2021-20317", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2021-26401", "epss": "0.000430000", "percentile": "0.069270000", "modified": "2023-03-19"}, {"cve": "CVE-2021-4002", "epss": "0.000430000", "percentile": "0.077200000", "modified": "2023-03-19"}, {"cve": "CVE-2021-4149", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2022-0330", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2022-0435", "epss": "0.023980000", "percentile": "0.882070000", "modified": "2023-03-19"}, {"cve": "CVE-2022-0492", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2022-0617", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2022-0847", "epss": "0.065020000", "percentile": "0.925880000", "modified": "2023-03-19"}, {"cve": "CVE-2022-1016", "epss": "0.000450000", "percentile": "0.121930000", "modified": "2023-03-19"}, {"cve": "CVE-2022-24448", "epss": "0.000460000", "percentile": "0.128480000", "modified": "2023-03-19"}, {"cve": "CVE-2022-26966", "epss": "0.000450000", "percentile": "0.118840000", "modified": "2023-03-19"}], "vulnersScore": 0.0}, "_state": {"score": 1684014194, "dependencies": 1660032824, "epss": 1679290575}, "_internal": {"score_hash": "601988ddb85eacc8eec936b50971de77"}, "affectedPackage": [{"OS": "oracle linux", "OSVersion": "7", "arch": "src", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-4.14.35-2047.512.6.el7uek.src.rpm", "operator": "lt", "packageName": "kernel-uek"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "kernel-uek"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-debug-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "kernel-uek-debug"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-debug-devel-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "kernel-uek-debug-devel"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-devel-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "kernel-uek-devel"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-headers-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "kernel-uek-headers"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-tools-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "kernel-uek-tools"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-tools-libs-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "kernel-uek-tools-libs"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-tools-libs-devel-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "kernel-uek-tools-libs-devel"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "perf-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "perf"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "aarch64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "python-perf-4.14.35-2047.512.6.el7uek.aarch64.rpm", "operator": "lt", "packageName": "python-perf"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "src", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-4.14.35-2047.512.6.el7uek.src.rpm", "operator": "lt", "packageName": "kernel-uek"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "x86_64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-4.14.35-2047.512.6.el7uek.x86_64.rpm", "operator": "lt", "packageName": "kernel-uek"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "x86_64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-debug-4.14.35-2047.512.6.el7uek.x86_64.rpm", "operator": "lt", "packageName": "kernel-uek-debug"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "x86_64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-debug-devel-4.14.35-2047.512.6.el7uek.x86_64.rpm", "operator": "lt", "packageName": "kernel-uek-debug-devel"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "x86_64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-devel-4.14.35-2047.512.6.el7uek.x86_64.rpm", "operator": "lt", "packageName": "kernel-uek-devel"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "noarch", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-doc-4.14.35-2047.512.6.el7uek.noarch.rpm", "operator": "lt", "packageName": "kernel-uek-doc"}, {"OS": "oracle linux", "OSVersion": "7", "arch": "x86_64", "packageVersion": "4.14.35-2047.512.6.el7uek", "packageFilename": "kernel-uek-tools-4.14.35-2047.512.6.el7uek.x86_64.rpm", "operator": "lt", "packageName": "kernel-uek-tools"}]}

{"oraclelinux": [{"lastseen": "2022-07-12T18:39:51", "description": "[4.14.35-2047.512.6.el7]\n- Revert 'rds/ib: recover rds connection from stuck rx path' (Rohit Nair) [Orabug: 34039271] \n- uek-rpm: update kABI lists for new symbols (Saeed Mirzamohammadi) [Orabug: 33993774]\n[4.14.35-2047.512.5]\n- netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso) [Orabug: 34012925] {CVE-2022-1016}\n- rds: Fix incorrect initialization order (Hakon Bugge) [Orabug: 33923372] \n- btrfs: unlock newly allocated extent buffer after error (Qu Wenruo) [Orabug: 33997138] {CVE-2021-4149}\n- sr9700: sanity check for packet length (Oliver Neukum) [Orabug: 33962706] {CVE-2022-26966}\n[4.14.35-2047.512.4]\n- Linux 4.14.265 (Greg Kroah-Hartman) \n- ext4: fix error handling in ext4_restore_inline_data() (Ritesh Harjani) \n- EDAC/xgene: Fix deferred probing (Sergey Shtylyov) \n- EDAC/altera: Fix deferred probing (Sergey Shtylyov) \n- rtc: cmos: Evaluate century appropriate (Riwen Lu) \n- selftests: futex: Use variable MAKE instead of make (Muhammad Usama Anjum) \n- nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. (Dai Ngo) \n- scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (John Meneghini) \n- ASoC: fsl: Add missing error handling in pcm030_fabric_probe (Miaoqian Lin) \n- drm/i915/overlay: Prevent divide by zero bugs in scaling (Dan Carpenter) \n- net: macsec: Verify that send_sci is on when setting Tx sci explicitly (Lior Nahmanson) \n- net: ieee802154: Return meaningful error codes from the netlink helpers (Miquel Raynal) \n- net: ieee802154: ca8210: Stop leaking skb's (Miquel Raynal) \n- spi: meson-spicc: add IRQ check in meson_spicc_probe (Miaoqian Lin) \n- spi: mediatek: Avoid NULL pointer crash in interrupt (Benjamin Gaignard) \n- spi: bcm-qspi: check for valid cs before applying chip select (Kamal Dasu) \n- iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() (Joerg Roedel) \n- iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (Guoqing Jiang) \n- RDMA/mlx4: Don't continue event handler after memory allocation failure (Leon Romanovsky) \n- block: bio-integrity: Advance seed correctly for larger interval sizes (Martin K. Petersen) \n- drm/nouveau: fix off by one in BIOS boundary checking (Nick Lopez) \n- ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (Mark Brown) \n- ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (Mark Brown) \n- ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (Mark Brown) \n- audit: improve audit queue handling when 'audit=1' on cmdline (Paul Moore) \n- af_packet: fix data-race in packet_setsockopt / packet_setsockopt (Eric Dumazet) \n- rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (Eric Dumazet) \n- net: amd-xgbe: Fix skb data length underflow (Shyam Sundar S K) \n- net: amd-xgbe: ensure to reset the tx_timer_active flag (Raju Rangoju) \n- ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback (Georgi Valkov) \n- netfilter: nat: limit port clash resolution attempts (Florian Westphal) \n- netfilter: nat: remove l4 protocol port rovers (Florian Westphal) \n- bpf: fix truncated jump targets on heavy expansions (Daniel Borkmann) \n- ipv4: raw: lock the socket in raw_bind() (Eric Dumazet) \n- yam: fix a memory leak in yam_siocdevprivate() (Hangyu Hua) \n- ibmvnic: don't spin in tasklet (Sukadev Bhattiprolu) \n- drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (Jose Exposito) \n- drm/msm: Fix wrong size calculation (Xianting Tian) \n- net-procfs: show net devices bound packet types (Jianguo Wu) \n- NFSv4: nfs_atomic_open() can race when looking up a non-regular file (Trond Myklebust) \n- NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust) \n- hwmon: (lm90) Reduce maximum conversion rate for G781 (Guenter Roeck) \n- ping: fix the sk_bound_dev_if match in ping_lookup (Xin Long) \n- net: fix information leakage in /proc/net/ptype (Saeed Mirzamohammadi) \n- ipv6_tunnel: Rate limit warning messages (Ido Schimmel) \n- scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (John Meneghini) \n- rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev (Matthias Kaehlcke) \n- rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (Sujit Kautkar) \n- i40e: fix unsigned stat widths (Joe Damato) \n- i40e: Increase delay to 1 s after global EMP reset (Jedrzej Jagielski) \n- lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() (Christophe Leroy) \n- powerpc/32: Fix boot failure with GCC latent entropy plugin (Christophe Leroy) \n- net: sfp: ignore disabled SFP node (Marek Behun) \n- usb: typec: tcpm: Do not disconnect while receiving VBUS off (Badhri Jagan Sridharan) \n- USB: core: Fix hang in usb_kill_urb by adding memory barriers (Alan Stern) \n- usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS (Pavankumar Kondeti) \n- usb: common: ulpi: Fix crash in ulpi_match() (Jon Hunter) \n- usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge (Alan Stern) \n- tty: Add support for Brainboxes UC cards. (Cameron Williams) \n- tty: n_gsm: fix SW flow control encoding/handling (daniel.starke@siemens.com) \n- serial: stm32: fix software flow control transfer (Valentin Caron) \n- netfilter: nft_payload: do not update layer 4 checksum when mangling fragments (Pablo Neira Ayuso) \n- PM: wakeup: simplify the output logic of pm_show_wakelocks() (Greg Kroah-Hartman) \n- scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices (Steffen Maier) \n- s390/hypfs: include z/VM guests with access control group set (Vasily Gorbik) \n- Bluetooth: refactor malicious adv data check (Brian Gix) \n- Linux 4.14.264 (Greg Kroah-Hartman) \n- can: bcm: fix UAF of bcm op (Ziyang Xuan) \n- Linux 4.14.263 (Greg Kroah-Hartman) \n- gianfar: fix jumbo packets+napi+rx overrun crash (Michael Braun) \n- gianfar: simplify FCS handling and fix memory leak (Andy Spencer) \n- drm/ttm/nouveau: don't call tt destroy callback on alloc failure. (Dave Airlie) \n- mips,s390,sh,sparc: gup: Work around the 'COW can break either way' issue (Ben Hutchings) \n- lib82596: Fix IRQ check in sni_82596_probe (Miaoqian Lin) \n- scripts/dtc: dtx_diff: remove broken example from help text (Matthias Schiffer) \n- bcmgenet: add WOL IRQ check (Sergey Shtylyov) \n- net_sched: restore 'mpu xxx' handling (Kevin Bracey) \n- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition (Tudor Ambarus) \n- dmaengine: at_xdmac: Fix lld view setting (Tudor Ambarus) \n- dmaengine: at_xdmac: Print debug message after realeasing the lock (Tudor Ambarus) \n- dmaengine: at_xdmac: Don't start transactions at tx_submit level (Tudor Ambarus) \n- libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() (Guillaume Nault) \n- netns: add schedule point in ops_exit_list() (Eric Dumazet) \n- net: axienet: fix number of TX ring slots for available check (Robert Hancock) \n- net: axienet: Wait for PhyRstCmplt after core reset (Robert Hancock) \n- af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (Eric Dumazet) \n- parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries (Miaoqian Lin) \n- net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module (Tobias Waldekranz) \n- powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses (Tobias Waldekranz) \n- powerpc/cell: Fix clang -Wimplicit-fallthrough warning (Anders Roxell) \n- RDMA/rxe: Fix a typo in opcode name (Chengguang Xu) \n- RDMA/hns: Modify the mapping attribute of doorbell to device (Yixing Liu) \n- Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization (Lukas Bulwahn) \n- firmware: Update Kconfig help text for Google firmware (Ben Hutchings) \n- drm/radeon: fix error handling in radeon_driver_open_kms (Christian Konig) \n- crypto: stm32/crc32 - Fix kernel BUG triggered in probe() (Marek Vasut) \n- ext4: don't use the orphan list when migrating an inode (Theodore Ts'o) \n- ext4: Fix BUG_ON in ext4_bread when write quota data (Ye Bin) \n- ext4: set csum seed in tmp inode while migrating to extents (Luis Henriques) \n- ext4: make sure quota gets properly shutdown on error (Jan Kara) \n- iwlwifi: mvm: Increase the scan timeout guard to 30 seconds (Ilan Peer) \n- cputime, cpuacct: Include guest time in user time in cpuacct.stat (Andrey Ryabinin) \n- serial: Fix incorrect rs485 polarity on uart open (Lukas Wunner) \n- ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers (Petr Cvachoucek) \n- power: bq25890: Enable continuous conversion for ADC at charging (Yauhen Kharuzhy) \n- ASoC: mediatek: mt8173: fix device_node leak (Tzung-Bi Shih) \n- scsi: sr: Don't use GFP_DMA (Christoph Hellwig) \n- MIPS: Octeon: Fix build errors using clang (Tianjia Zhang) \n- i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters (Lakshmi Sowjanya D) \n- MIPS: OCTEON: add put_device() after of_find_device_by_node() (Ye Guojin) \n- ALSA: seq: Set upper limit of processed events (Takashi Iwai) \n- w1: Misuse of get_user()/put_user() reported by sparse (Christophe Leroy) \n- i2c: mpc: Correct I2C reset procedure (Joakim Tjernlund) \n- powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING (Michael Ellerman) \n- i2c: i801: Don't silently correct invalid transfer size (Heiner Kallweit) \n- powerpc/watchdog: Fix missed watchdog reset due to memory ordering race (Nicholas Piggin) \n- powerpc/btext: add missing of_node_put (Julia Lawall) \n- powerpc/cell: add missing of_node_put (Julia Lawall) \n- powerpc/powernv: add missing of_node_put (Julia Lawall) \n- powerpc/6xx: add missing of_node_put (Julia Lawall) \n- parisc: Avoid calling faulthandler_disabled() twice (John David Anglin) \n- serial: core: Keep mctrl register state and cached copy in sync (Lukas Wunner) \n- serial: pl010: Drop CR register reset on set_termios (Lukas Wunner) \n- net: phy: marvell: configure RGMII delays for 88E1118 (Russell King (Oracle)) \n- dm space map common: add bounds check to sm_ll_lookup_bitmap() (Joe Thornber) \n- dm btree: add a defensive bounds check to insert_at() (Joe Thornber) \n- mac80211: allow non-standard VHT MCS-10/11 (Ping-Ke Shih) \n- net: mdio: Demote probed message to debug print (Florian Fainelli) \n- btrfs: remove BUG_ON(!eie) in find_parent_nodes (Josef Bacik) \n- btrfs: remove BUG_ON() in find_parent_nodes() (Josef Bacik) \n- ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (Kirill A. Shutemov) \n- ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (Rafael J. Wysocki) \n- ACPICA: Utilities: Avoid deleting the same object twice in a row (Rafael J. Wysocki) \n- ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (Mark Langsdorf) \n- jffs2: GC deadlock reading a page that is used in jffs2_write_begin() (Kyeong Yoo) \n- um: registers: Rename function names to avoid conflicts and build problems (Randy Dunlap) \n- iwlwifi: remove module loading failure message (Johannes Berg) \n- iwlwifi: fix leaks/bad data after failed firmware load (Johannes Berg) \n- ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (Zekun Shen) \n- usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 (Kai-Heng Feng) \n- arm64: tegra: Adjust length of CCPLEX cluster MMIO region (Thierry Reding) \n- mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO (Ulf Hansson) \n- media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() (Zhou Qingyang) \n- media: igorplugusb: receiver overflow should be reported (Sean Young) \n- bpf: Do not WARN in bpf_warn_invalid_xdp_action() (Paolo Abeni) \n- net: bonding: debug: avoid printing debug logs when bond is not notifying peers (Suresh Kumar) \n- ath10k: Fix tx hanging (Sebastian Gottschall) \n- iwlwifi: mvm: synchronize with FW after multicast commands (Johannes Berg) \n- media: m920x: don't use stack on USB reads (Mauro Carvalho Chehab) \n- media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() (Zhou Qingyang) \n- media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. (James Hilliard) \n- floppy: Add max size check for user space request (Xiongwei Song) \n- usb: uhci: add aspeed ast2600 uhci support (Neal Liu) \n- mwifiex: Fix skb_over_panic in mwifiex_usb_recv() (Zekun Shen) \n- HSI: core: Fix return freed object in hsi_new_client (Chengfeng Ye) \n- gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use (Hans de Goede) \n- drm/bridge: megachips: Ensure both bridges are probed before registration (Martyn Welch) \n- mlxsw: pci: Add shutdown method in PCI driver (Danielle Ratson) \n- media: b2c2: Add missing check in flexcop_pci_isr: (Zheyu Ma) \n- HID: apple: Do not reset quirks when the Fn key is not found (Jose Exposito) \n- usb: gadget: f_fs: Use stream_open() for endpoint files (Pavankumar Kondeti) \n- drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR (Ben Skeggs) \n- ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (Zekun Shen) \n- fs: dlm: filter user dlm messages for kernel locks (Alexander Aring) \n- Bluetooth: Fix debugfs entry leak in hci_register_dev() (Wei Yongjun) \n- RDMA/cxgb4: Set queue pair state when being queried (Kamal Heib) \n- mips: bcm63xx: add support for clk_set_parent() (Randy Dunlap) \n- mips: lantiq: add support for clk_set_parent() (Randy Dunlap) \n- misc: lattice-ecp3-config: Fix task hung when firmware load failed (Wei Yongjun) \n- ASoC: samsung: idma: Check of ioremap return value (Jiasheng Jiang) \n- iommu/iova: Fix race between FQ timeout and teardown (Xiongfeng Wang) \n- dmaengine: pxa/mmp: stop referencing config->slave_id (Arnd Bergmann) \n- RDMA/core: Let ib_find_gid() continue search even after empty entry (Avihai Horon) \n- scsi: ufs: Fix race conditions related to driver data (Bart Van Assche) \n- char/mwave: Adjust io port register size (Kees Cook) \n- ALSA: oss: fix compile error when OSS_DEBUG is enabled (Bixuan Cui) \n- powerpc/prom_init: Fix improper check of prom_getprop() (Peiwei Hu) \n- RDMA/hns: Validate the pkey index (Kamal Heib) \n- ALSA: hda: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ALSA: jack: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ext4: avoid trim error on fs with small groups (Jan Kara) \n- net: mcs7830: handle usb read errors properly (Pavel Skripkin) \n- pcmcia: fix setting of kthread task states (Dominik Brodowski) \n- can: xilinx_can: xcan_probe(): check for error irq (Jiasheng Jiang) \n- can: softing: softing_startstop(): fix set but not used variable warning (Marc Kleine-Budde) \n- tpm: add request_locality before write TPM_INT_ENABLE (Chen Jun) \n- spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe (Miaoqian Lin) \n- fsl/fman: Check for null pointer after calling devm_ioremap (Jiasheng Jiang) \n- ppp: ensure minimum packet size in ppp_write() (Eric Dumazet) \n- pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() (Zhou Qingyang) \n- pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() (Zhou Qingyang) \n- x86/mce/inject: Avoid out-of-bounds write when setting flags (Zhang Zixun) \n- usb: ftdi-elan: fix memory leak on device disconnect (Wei Yongjun) \n- media: msi001: fix possible null-ptr-deref in msi001_probe() (Wang Hai) \n- media: dw2102: Fix use after free (Anton Vasilyev) \n- sched/rt: Try to restart rt period timer when rt runtime exceeded (Li Hua) \n- media: si2157: Fix 'warm' tuner state detection (Robert Schlabbach) \n- media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() (Zhou Qingyang) \n- media: dib8000: Fix a memleak in dib8000_init() (Zhou Qingyang) \n- floppy: Fix hang in watchdog when disk is ejected (Tasos Sahanidis) \n- serial: amba-pl011: do not request memory region twice (Lino Sanfilippo) \n- drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() (Zhou Qingyang) \n- drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() (Zhou Qingyang) \n- arm64: dts: qcom: msm8916: fix MMC controller aliases (Dmitry Baryshkov) \n- netfilter: bridge: add support for pppoe filtering (Florian Westphal) \n- media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released (Dafna Hirschfeld) \n- tty: serial: atmel: Call dma_async_issue_pending() (Tudor Ambarus) \n- tty: serial: atmel: Check return code of dmaengine_submit() (Tudor Ambarus) \n- crypto: qce - fix uaf on qce_ahash_register_one (Chengfeng Ye) \n- media: dmxdev: fix UAF when dvb_register_device() fails (Wang Hai) \n- Bluetooth: stop proccessing malicious adv data (Pavel Skripkin) \n- media: em28xx: fix memory leak in em28xx_init_dev (Dongliang Mu) \n- wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND (Bryan O'Donoghue) \n- clk: bcm-2835: Remove rounding up the dividers (Maxime Ripard) \n- clk: bcm-2835: Pick the closest clock rate (Maxime Ripard) \n- Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails (Wang Hai) \n- PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (Yifeng Li) \n- shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode (Gang Li) \n- can: softing_cs: softingcs_probe(): fix memleak on registration failure (Johan Hovold) \n- media: stk1160: fix control-message timeouts (Johan Hovold) \n- media: pvrusb2: fix control-message timeouts (Johan Hovold) \n- media: redrat3: fix control-message timeouts (Johan Hovold) \n- media: dib0700: fix undefined behavior in tuner shutdown (Michael Kuron) \n- media: s2255: fix control-message timeouts (Johan Hovold) \n- media: cpia2: fix control-message timeouts (Johan Hovold) \n- media: em28xx: fix control-message timeouts (Johan Hovold) \n- media: mceusb: fix control-message timeouts (Johan Hovold) \n- media: flexcop-usb: fix control-message timeouts (Johan Hovold) \n- rtc: cmos: take rtc_lock while reading from CMOS (Mateusz Jonczyk) \n- nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() (Krzysztof Kozlowski) \n- HID: wacom: Avoid using stale array indicies to read contact count (Jason Gerecke) \n- HID: wacom: Ignore the confidence flag when a touch is removed (Jason Gerecke) \n- HID: uhid: Fix worker destroying device without any protection (Jann Horn) \n- Bluetooth: fix init and cleanup of sco_conn.timeout_work (Desmond Cheong Zhi Xi) \n- Bluetooth: schedule SCO timeouts with delayed_work (Desmond Cheong Zhi Xi) \n- rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled (Larry Finger) \n- media: uvcvideo: fix division by zero at stream start (Johan Hovold) \n- orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() (Christophe JAILLET) \n- drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() (Nathan Chancellor) \n- staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() (Nathan Chancellor) \n- random: fix data race on crng init time (Eric Biggers) \n- random: fix data race on crng_node_pool (Eric Biggers) \n- can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} (Brian Silverman) \n- can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data (Marc Kleine-Budde) \n- mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() (Andy Shevchenko) \n- USB: Fix 'slab-out-of-bounds Write' bug in usb_hcd_poll_rh_status (Alan Stern) \n- USB: core: Fix bug in resuming hub's handling of wakeup requests (Alan Stern) \n- Bluetooth: bfusb: fix division by zero in send path (Johan Hovold) \n- Linux 4.14.262 (Greg Kroah-Hartman) \n- mISDN: change function names to avoid conflicts (wolfgang huang) \n- net: udp: fix alignment problem in udp4_seq_show() (yangxingwu) \n- ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate (William Zhao) \n- scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() (Lixiaokeng) \n- ipv6: Do cleanup if attribute validation fails in multipath route (David Ahern) \n- ipv6: Continue processing multipath route even if gateway attribute is invalid (David Ahern) \n- phonet: refcount leak in pep_sock_accep (Hangyu Hua) \n- rndis_host: support Hytera digital radios (Thomas Toye) \n- power: reset: ltc2952: Fix use of floating point literals (Nathan Chancellor) \n- sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc (Eric Dumazet) \n- ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route (David Ahern) \n- ipv6: Check attribute length for RTA_GATEWAY in multipath route (David Ahern) \n- i40e: Fix incorrect netdev's real number of RX/TX queues (Jedrzej Jagielski) \n- i40e: fix use-after-free in i40e_sync_filters_subtask() (Di Zhu) \n- mac80211: initialize variable have_higher_than_11mbit (Tom Rix) \n- RDMA/core: Don't infoleak GRH fields (Leon Romanovsky) \n- ieee802154: atusb: fix uninit value in atusb_set_extended_addr (Pavel Skripkin) \n- virtio_pci: Support surprise removal of virtio pci device (Parav Pandit) \n- tracing: Tag trace_percpu_buffer as a percpu pointer (Naveen N. Rao) \n- tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() (Naveen N. Rao) \n- Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models (Takashi Iwai)\n[4.14.35-2047.512.3]\n- lib/timerqueue: Rely on rbtree semantics for next timer (Davidlohr Bueso) [Orabug: 33406086] {CVE-2021-20317} {CVE-2021-20317}\n- rds/ib: Resize CQ if send-/recv-ring-size are changed (Hans Westgaard Ry) [Orabug: 33940520] \n- uek-rpm: remove uek-rpm/ol8 (John Donnelly) [Orabug: 33665655] \n- uek-rpm: Enable config CONFIG_SCSI_MQ_DEFAULT (Saeed Mirzamohammadi) [Orabug: 33973455] \n- sched: restore the sliding search window for select_idle_cpu() (Libo Chen) [Orabug: 33965297] \n- NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust) [Orabug: 33958155] {CVE-2022-24448}\n- Linux 4.14.261 (Greg Kroah-Hartman) \n- sctp: use call_rcu to free endpoint (Xin Long) \n- net: fix use-after-free in tw_timer_handler (Muchun Song) \n- Input: spaceball - fix parsing of movement data packets (Leo L. Schwab) \n- Input: appletouch - initialize work before device registration (Pavel Skripkin) \n- binder: fix async_free_space accounting for empty parcels (Todd Kjos) \n- usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. (Vincent Pelletier) \n- xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. (Mathias Nyman) \n- uapi: fix linux/nfc.h userspace compilation errors (Dmitry V. Levin) \n- nfc: uapi: use kernel size_t to fix user-space builds (Krzysztof Kozlowski) \n- fsl/fman: Fix missing put_device() call in fman_port_probe (Miaoqian Lin) \n- NFC: st21nfca: Fix memory leak in device probe and remove (Wei Yongjun) \n- net: usb: pegasus: Do not drop long Ethernet frames (Matthias-Christian Ott) \n- scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (Dan Carpenter) \n- selinux: initialize proto variable in selinux_ip_postroute_compat() (Tom Rix) \n- recordmcount.pl: fix typo in s390 mcount regex (Heiko Carstens) \n- platform/x86: apple-gmux: use resource_size() with res (Wang Qing) \n- HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option (Hans de Goede) \n- Linux 4.14.260 (Greg Kroah-Hartman) \n- phonet/pep: refuse to enable an unbound pipe (Remi Denis-Courmont) \n- hamradio: improve the incomplete fix to avoid NPD (Lin Ma) \n- hamradio: defer ax25 kfree after unregister_netdev (Lin Ma) \n- ax25: NPD bug when detaching AX25 device (Lin Ma) \n- hwmon: (lm90) Do not report 'busy' status bit as alarm (Guenter Roeck) \n- KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state (Sean Christopherson) \n- usb: gadget: u_ether: fix race in setting MAC address in setup phase (Marian Postevca) \n- f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() (Chao Yu) \n- ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling (Ard Biesheuvel) \n- pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines (Fabien Dessenne) \n- x86/pkey: Fix undefined behaviour with PKRU_WD_BIT (Andrew Cooper) \n- Input: atmel_mxt_ts - fix double free in mxt_read_info_block (Jose Exposito) \n- ALSA: drivers: opl3: Fix incorrect use of vp->state (Colin Ian King) \n- ALSA: jack: Check the return value of kstrdup() (Xiaoke Wang) \n- hwmon: (lm90) Fix usage of CONFIG2 register in detect function (Guenter Roeck) \n- sfc: falcon: Check null pointer of rx_queue->page_ring (Jiasheng Jiang) \n- drivers: net: smc911x: Check for error irq (Jiasheng Jiang) \n- fjes: Check for error irq (Jiasheng Jiang) \n- bonding: fix ad_actor_system option setting to default (Fernando Fernandez Mancera) \n- net: skip virtio_net_hdr_set_proto if protocol already set (Willem de Bruijn) \n- qlcnic: potential dereference null pointer of rx_queue->page_ring (Jiasheng Jiang) \n- spi: change clk_disable_unprepare to clk_unprepare (Dongliang Mu) \n- HID: holtek: fix mouse probing (Benjamin Tissoires) \n- can: kvaser_usb: get CAN clock frequency from device (Jimmy Assarsson) \n- net: usb: lan78xx: add Allied Telesis AT29M2-AF (Greg Jesionowski) \n- x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) [Orabug: 33937656] {CVE-2021-26401}\n- Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp) [Orabug: 33937656] {CVE-2021-26401}\n- x86/speculation: Fix bug in retpoline mode on AMD with 'spectre_v2=none' (Patrick Colp) [Orabug: 33937656] {CVE-2021-26401}\n- ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33925502] \n- ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet) [Orabug: 33917057] {CVE-2020-36516}\n- ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet) [Orabug: 33917057] {CVE-2020-36516}\n- lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33910800] {CVE-2022-0847}\n- x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp) [Orabug: 33890092] \n- udf: Restore i_lenAlloc when inode expansion fails (Jan Kara) [Orabug: 33870267] {CVE-2022-0617}\n- udf: Fix NULL ptr deref when converting from inline format (Jan Kara) [Orabug: 33870267] {CVE-2022-0617}\n- scsi: libiscsi: Hold back_lock when calling iscsi_complete_task (Gulam Mohamed) [Orabug: 33851182] \n- drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause) [Orabug: 33840433] {CVE-2022-22942}\n- drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin) [Orabug: 33835811] {CVE-2022-0330}\n- proc/vmcore: fix clearing user buffer by properly using clear_user() (David Hildenbrand) [Orabug: 33832650] \n- rds/ib: recover rds connection from stuck rx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820767] \n- rds: ib: Make selection of completion_vector QoS aware (Hakon Bugge) [Orabug: 33819408] \n- Enable CONFIG_DM_DUST and nano for UEK5 (Gulam Mohamed) [Orabug: 33653698] \n- dm dust: use dust block size for badblocklist index (Bryan Gurney) [Orabug: 33653698] \n- dm dust: Make dm_dust_init and dm_dust_exit static (YueHaibing) [Orabug: 33653698] \n- dm dust: remove redundant unsigned comparison to less than zero (Colin Ian King) [Orabug: 33653698] \n- dm: add dust target (Bryan Gurney) [Orabug: 33653698] \n- hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit) [Orabug: 33617219] {CVE-2021-4002}\n- rds/ib: handle posted ACK during connection shutdown (Nagappan Ramasamy Palaniappan) [Orabug: 33820747] \n- rds/ib: reap tx completions during connection shutdown (Nagappan Ramasamy Palaniappan) [Orabug: 33820747] \n- rds/ib: recover rds connection from stuck tx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820747] \n- rds/ib: Kernel change to extend rds-info functionality (Rohit Nair) [Orabug: 33821341] \n- uek-rpm: Add missing symbols to kabi_lockedlist (Stephen Brennan) [Orabug: 33871558]\n[4.14.35-2047.512.1]\n- Revert 'stable: clamp SUBLEVEL in 4.14' (Alan Maguire) [Orabug: 33861950] \n- tipc: improve size validations for received domain records (Jon Maloy) [Orabug: 33850803] {CVE-2022-0435} {CVE-2022-0435}\n- cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33825688] {CVE-2022-0492}\n- blk-stat: delete useless code (Shaohua Li) [Orabug: 33772945] \n- DMA/rxe: Update default value of RXE_MAX_PDN (Rao Shoaib) [Orabug: 33676598]\n[4.14.35-2047.512.0]\n- bpf: Disallow unprivileged bpf by default (Pawan Gupta) [Orabug: 33734682] \n- bpf: Add kconfig knob for disabling unpriv bpf by default (Daniel Borkmann) [Orabug: 33734682] \n- RDMA/rxe: Use correct sizing on buffers holding page DMA addresses (Shiraz Saleem) [Orabug: 33676942] \n- hwmon: (k10temp) Add support for Zen3 CPUs (Rahul Rohit) [Orabug: 33782835] \n- arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table (Ard Biesheuvel) [Orabug: 33787546] \n- uek-rpm: Pensando: Enable Elba EDAC (Dave Kleikamp) [Orabug: 33831294] \n- dsc-drivers: update for 1.15.9-C-64 (Dave Kleikamp) [Orabug: 33831294] \n- drivers/hwmon: Adding support LTC3888 (David Clear) [Orabug: 33831294] \n- drivers/edac: Add Elba EDAC support (David Clear) [Orabug: 33831294] \n- arm64/configs: Remove CONFIG_PENSANDO_SOC_CAPMEM_HUGEPAGE (David Clear) [Orabug: 33831294] \n- drivers/soc/pensando: Add reset cause driver (David Clear) [Orabug: 33831294] \n- net/rds: Fix memory leak in __rds_conn_create() on alloc_ordered_workqueue fail (Freddy Carrillo) [Orabug: 33811475] \n- x86/smpboot: check cpu_initialized_mask first after returning from schedule() (Dongli Zhang) [Orabug: 33544127] \n- Linux 4.14.259 (Greg Kroah-Hartman) \n- xen/console: harden hvc_xen against event channel storms (Juergen Gross) \n- Input: touchscreen - avoid bitwise vs logical OR warning (Nathan Chancellor) \n- ARM: 8800/1: use choice for kernel unwinders (Stefan Agner) \n- mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO (Nathan Chancellor) \n- ARM: 8805/2: remove unneeded naked function usage (Nicolas Pitre) \n- net: lan78xx: Avoid unnecessary self assignment (Nathan Chancellor) \n- fuse: annotate lock in fuse_reverse_inval_entry() (Miklos Szeredi) \n- ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name (Fabio Estevam) \n- firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Sudeep Holla) \n- net: systemport: Add global locking for descriptor lifecycle (Florian Fainelli) \n- libata: if T_LENGTH is zero, dma direction should be DMA_NONE (George Kennedy) \n- timekeeping: Really make sure wall_to_monotonic isn't positive (Yu Liao) \n- USB: serial: option: add Telit FN990 compositions (Daniele Palmas) \n- PCI/MSI: Mask MSI-X vectors only on success (Stefan Roese) \n- PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error (Thomas Gleixner) \n- USB: gadget: bRequestType is a bitfield, not a enum (Greg Kroah-Hartman) \n- sit: do not call ipip6_dev_free() from sit_init_net() (Eric Dumazet) \n- net/packet: rx_owner_map depends on pg_vec (Willem de Bruijn) \n- ixgbe: set X550 MDIO speed before talking to PHY (Cyril Novikov) \n- igbvf: fix double free in 'igbvf_probe' (Letu Ren) \n- soc/tegra: fuse: Fix bitwise vs. logical OR warning (Nathan Chancellor) \n- dmaengine: st_fdma: fix MODULE_ALIAS (Alyssa Ross) \n- ARM: socfpga: dts: fix qspi node compatible (Dinh Nguyen) \n- x86/sme: Explicitly map new EFI memmap table as encrypted (Tom Lendacky) \n- nfsd: fix use-after-free due to delegation race (J. Bruce Fields) \n- audit: improve robustness of the audit queue handling (Paul Moore) \n- dm btree remove: fix use after free in rebalance_children() (Joe Thornber) \n- recordmcount.pl: look for jgnop instruction as well as bcrl on s390 (Jerome Marchand) \n- mac80211: send ADDBA requests using the tid/queue of the aggregation session (Felix Fietkau) \n- hwmon: (dell-smm) Fix warning on /proc/i8k creation error (Armin Wolf) \n- bpf: fix panic due to oob in bpf_prog_test_run_skb (Daniel Borkmann) \n- tracing: Fix a kmemleak false positive in tracing_map (Chen Jun) \n- net: netlink: af_netlink: Prevent empty skb by adding a check on len. (Harshit Mogalapalli) \n- i2c: rk3x: Handle a spurious start completion interrupt flag (Ondrej Jirman) \n- parisc/agp: Annotate parisc agp init functions with __init (Helge Deller) \n- net/mlx4_en: Update reported link modes for 1/10G (Erik Ekman) \n- drm/msm/dsi: set default num_data_lanes (Philip Chen) \n- nfc: fix segfault in nfc_genl_dump_devices_done (Tadeusz Struk) \n- Linux 4.14.258 (Greg Kroah-Hartman) \n- irqchip: nvic: Fix offset for Interrupt Priority Offsets (Vladimir Murzin) \n- irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL (Wudi Wang) \n- irqchip/armada-370-xp: Fix support for Multi-MSI interrupts (Pali Rohar) \n- irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() (Pali Rohar) \n- iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove (Yang Yingliang) \n- iio: adc: axp20x_adc: fix charging current reporting on AXP22x (Evgeny Boger) \n- iio: dln2: Check return value of devm_iio_trigger_register() (Lars-Peter Clausen) \n- iio: dln2-adc: Fix lockdep complaint (Noralf Tronnes) \n- iio: itg3200: Call iio_trigger_notify_done() on error (Lars-Peter Clausen) \n- iio: kxsd9: Don't return error code in trigger handler (Lars-Peter Clausen) \n- iio: ltr501: Don't return error code in trigger handler (Lars-Peter Clausen) \n- iio: mma8452: Fix trigger reference couting (Lars-Peter Clausen) \n- iio: stk3310: Don't return error code in interrupt handler (Lars-Peter Clausen) \n- iio: trigger: stm32-timer: fix MODULE_ALIAS (Alyssa Ross) \n- iio: trigger: Fix reference counting (Lars-Peter Clausen) \n- usb: core: config: using bit mask instead of individual bits (Pavel Hofman) \n- xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending (Kai-Heng Feng) \n- usb: core: config: fix validation of wMaxPacketValue entries (Pavel Hofman) \n- USB: gadget: zero allocate endpoint 0 buffers (Greg Kroah-Hartman) \n- USB: gadget: detect too-big endpoint 0 requests (Greg Kroah-Hartman) \n- net/qla3xxx: fix an error code in ql_adapter_up() (Dan Carpenter) \n- net, neigh: clear whole pneigh_entry at alloc time (Eric Dumazet) \n- net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() (Joakim Zhang) \n- net: altera: set a couple error code in probe() (Dan Carpenter) \n- net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero (Lee Jones) \n- qede: validate non LSO skb length (Manish Chopra) \n- block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) (Davidlohr Bueso) \n- tracefs: Set all files to the same group ownership as the mount option (Steven Rostedt (VMware)) \n- signalfd: use wake_up_pollfree() (Eric Biggers) \n- binder: use wake_up_pollfree() (Eric Biggers) \n- wait: add wake_up_pollfree() (Eric Biggers) \n- libata: add horkage for ASMedia 1092 (Hannes Reinecke) \n- can: m_can: Disable and ignore ELO interrupt (Brian Silverman) \n- can: pch_can: pch_can_rx_normal: fix use after free (Vincent Mailhol) \n- tracefs: Have new files inherit the ownership of their parent (Steven Rostedt (VMware)) \n- ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() (Takashi Iwai) \n- ALSA: pcm: oss: Limit the period size to 16MB (Takashi Iwai) \n- ALSA: pcm: oss: Fix negative period/buffer sizes (Takashi Iwai) \n- ALSA: ctl: Fix copy of updated id with element read/write (Alan Young) \n- mm: bdi: initialize bdi_min_ratio when bdi is unregistered (Manjong Lee) \n- IB/hfi1: Correct guard on eager buffer deallocation (Mike Marciniszyn) \n- seg6: fix the iif in the IPv6 socket control block (Andrea Mayer) \n- nfp: Fix memory leak in nfp_cpp_area_cache_add() (Jianglei Nie) \n- bpf: Fix the off-by-two error in range markings (Maxim Mikityanskiy) \n- nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (Krzysztof Kozlowski) \n- can: sja1000: fix use after free in ems_pcmcia_add_card() (Dan Carpenter) \n- HID: check for valid USB device for many HID drivers (Greg Kroah-Hartman) \n- HID: wacom: fix problems when device is not a valid USB device (Greg Kroah-Hartman) \n- HID: add USB_HID dependancy on some USB HID drivers (Greg Kroah-Hartman) \n- HID: add USB_HID dependancy to hid-chicony (Greg Kroah-Hartman) \n- HID: add USB_HID dependancy to hid-prodikeys (Greg Kroah-Hartman) \n- HID: add hid_is_usb() function to make it simpler for USB detection (Greg Kroah-Hartman) \n- Linux 4.14.257 (Greg Kroah-Hartman) {CVE-2021-38199}\n- parisc: Mark cr16 CPU clocksource unstable on all SMP machines (Helge Deller) \n- serial: core: fix transmit-buffer reset and memleak (Johan Hovold) \n- serial: pl011: Add ACPI SBSA UART match id (Pierre Gondois) \n- tty: serial: msm_serial: Deactivate RX DMA for polling support (Sven Eckelmann) \n- x86/64/mm: Map all kernel memory into trampoline_pgd (Joerg Roedel) \n- usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect (Badhri Jagan Sridharan) \n- xhci: Fix commad ring abort, write all 64 bits to CRCR register. (Mathias Nyman) \n- vgacon: Propagate console boot parameters before calling 'vc_resize' (Maciej W. Rozycki) \n- parisc: Fix 'make install' on newer debian releases (Helge Deller) \n- parisc: Fix KBUILD_IMAGE for self-extracting kernel (Helge Deller) \n- net/smc: Keep smc_close_final rc during active close (Tony Lu) \n- net/rds: correct socket tunable error in rds_tcp_tune() (William Kucharski) \n- net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of '0' if no IRQ is available (Sven Schuchmann) \n- net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (Zhou Qingyang) \n- siphash: use _unaligned version by default (Arnd Bergmann) \n- net: mpls: Fix notifications when deleting a device (Benjamin Poirier) \n- net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() (Zhou Qingyang) \n- natsemi: xtensa: fix section mismatch warnings (Randy Dunlap) \n- sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl (Baokun Li) \n- sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl (Baokun Li) \n- kprobes: Limit max data_size of the kretprobe instances (Masami Hiramatsu) \n- vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit (Stephen Suryaputra) \n- perf hist: Fix memory leak of a perf_hpp_fmt (Ian Rogers) \n- net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock() (Teng Qi) \n- net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound (zhangyue) \n- ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Teng Qi) \n- scsi: iscsi: Unblock session then wake up error handler (Mike Christie) \n- thermal: core: Reset previous low and high trip during thermal zone init (Manaf Meethalavalappu Pallikunhi) \n- btrfs: check-integrity: fix a warning on write caching disabled disk (Wang Yugui) \n- s390/setup: avoid using memblock_enforce_memory_limit (Vasily Gorbik) \n- platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep (Slark Xiao) \n- net: return correct error code (liuguoqiang) \n- NFSv42: Fix pagecache invalidation after COPY/CLONE (Benjamin Coddington) \n- ipc: WARN if trying to remove ipc object which is absent (Alexander Mikhalitsyn) \n- shm: extend forced shm destroy to support objects from several IPC nses (Alexander Mikhalitsyn) \n- tty: hvc: replace BUG_ON() with negative return value (Juergen Gross) \n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (Juergen Gross) \n- fuse: release pipe buf after last use (Miklos Szeredi) \n- NFC: add NCI_UNREG flag to eliminate the race (Lin Ma) \n- arm64: dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function (Marek Behun) \n- arm64: dts: marvell: armada-37xx: declare PCIe reset pin (Miquel Raynal) \n- pinctrl: armada-37xx: Correct PWM pins definitions (Marek Behun) \n- pinctrl: armada-37xx: add missing pin: PCIe1 Wakeup (Gregory CLEMENT) \n- pinctrl: armada-37xx: Correct mpp definitions (Marek Behun) \n- PCI: aardvark: Fix checking for link up via LTSSM state (Pali Rohar) \n- PCI: aardvark: Fix link training (Pali Rohar) \n- PCI: aardvark: Fix PCIe Max Payload Size setting (Pali Rohar) \n- PCI: aardvark: Configure PCIe resources from 'ranges' DT property (Pali Rohar) \n- PCI: aardvark: Remove PCIe outbound window configuration (Evan Wang) \n- PCI: aardvark: Update comment about disabling link training (Pali Rohar) \n- PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link() (Pali Rohar) \n- PCI: aardvark: Fix compilation on s390 (Pali Rohar) \n- PCI: aardvark: Don't touch PCIe registers if no card connected (Pali Rohar) \n- PCI: aardvark: Introduce an advk_pcie_valid_device() helper (Thomas Petazzoni) \n- PCI: aardvark: Indicate error in 'val' when config read fails (Pali Rohar) \n- PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros (Pali Rohar) \n- PCI: aardvark: Issue PERST via GPIO (Pali Rohar) \n- PCI: aardvark: Improve link training (Marek Behun) \n- PCI: aardvark: Train link immediately after enabling training (Pali Rohar) \n- PCI: aardvark: Wait for endpoint to be ready before training link (Remi Pommarel) \n- PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (Wen Yang) \n- PCI: aardvark: Fix I/O space page leak (Sergei Shtylyov) \n- s390/mm: validate VMA in PGSTE manipulation functions (David Hildenbrand) \n- tracing: Check pid filtering when creating events (Steven Rostedt (VMware)) \n- vhost/vsock: fix incorrect used length reported to the guest (Stefano Garzarella) \n- net/smc: Don't call clcsock shutdown twice when smc shutdown (Tony Lu) \n- MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 (Huang Pei) \n- tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows (Eric Dumazet) \n- net/smc: Ensure the active closing peer first closes clcsock (Tony Lu) \n- ipv6: fix typos in __ip6_finish_output() (Eric Dumazet) \n- drm/vc4: fix error code in vc4_create_object() (Dan Carpenter) \n- scsi: mpt3sas: Fix kernel panic during drive powercycle test (Sreekanth Reddy) \n- ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (Takashi Iwai) \n- NFSv42: Don't fail clone() unless the OP_CLONE operation failed (Trond Myklebust) \n- net: ieee802154: handle iftypes as u32 (Alexander Aring) \n- ASoC: topology: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ARM: dts: BCM5301X: Add interrupt properties to GPIO node (Florian Fainelli) \n- ARM: dts: BCM5301X: Fix I2C controller interrupt (Florian Fainelli) \n- netfilter: ipvs: Fix reuse connection if RS weight is 0 (yangxingwu) \n- tracing: Fix pid filtering when triggers are attached (Steven Rostedt (VMware)) \n- xen: detect uninitialized xenbus in xenbus_init (Stefano Stabellini) \n- xen: don't continue xenstore initialization in case of errors (Stefano Stabellini) \n- fuse: fix page stealing (Miklos Szeredi) \n- staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (Dan Carpenter) \n- HID: wacom: Use 'Confidence' flag to prevent reporting invalid contacts (Jason Gerecke) \n- media: cec: copy sequence field for the reply (Hans Verkuil) \n- ALSA: ctxfi: Fix out-of-range access (Takashi Iwai) \n- usb: hub: Fix locking issues with address0_mutex (Mathias Nyman) \n- usb: hub: Fix usb enumeration issue due to address0 race (Mathias Nyman) \n- USB: serial: option: add Fibocom FM101-GL variants (Mingjie Zhang) \n- USB: serial: option: add Telit LE910S1 0x9200 composition (Daniele Palmas)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-04-25T00:00:00", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel-container security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-36516", "CVE-2021-20317", "CVE-2021-26401", "CVE-2021-4002", "CVE-2021-4149", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0617", "CVE-2022-0847", "CVE-2022-1016", "CVE-2022-22942", "CVE-2022-24448", "CVE-2022-26966"], "modified": "2022-04-25T00:00:00", "id": "ELSA-2022-9314", "href": "http://linux.oracle.com/errata/ELSA-2022-9314.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-04-11T23:30:28", "description": "[5.4.17-2136.306.1.3]\n- KVM: x86/mmu: do compare-and-exchange of gPTE via the user address (Paolo Bonzini) [Orabug: 34053807] {CVE-2022-1158}\n[5.4.17-2136.306.1.2]\n- Revert 'rds/ib: recover rds connection from stuck rx path' (Rohit Nair) [Orabug: 34045203]\n[5.4.17-2136.306.1.1]\n- netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso) [Orabug: 34035701] {CVE-2022-1016}\n- exec, elf: ignore invalid note data (Anthony Yznaga) [Orabug: 34035682]\n[5.4.17-2136.306.1]\n- sr9700: sanity check for packet length (Brian Maly) [Orabug: 33962705] {CVE-2022-26966}\n- net/packet: rx_owner_map depends on pg_vec (Willem de Bruijn) [Orabug: 33835787] {CVE-2021-22600}\n- KVM: SVM: Don't flush cache if hardware enforces cache coherency across encryption domains (Krish Sadhukhan) [Orabug: 33921125] \n- x86/mm/pat: Don't flush cache if hardware enforces cache coherency across encryption domnains (Krish Sadhukhan) [Orabug: 33921125] \n- rds/ib: Resize CQ if send-/recv-ring-size are changed (Hans Westgaard Ry) [Orabug: 33940519] \n- NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust) [Orabug: 33958154] {CVE-2022-24448}\n- Revert 'btrfs: inode: refactor the parameters of insert_reserved_file_extent()' (Srikanth C S) [Orabug: 33958240] \n- Revert 'btrfs: fix metadata reservation for fallocate that leads to transaction aborts' (Srikanth C S) [Orabug: 33958240] \n- ovl: fix WARN_ON nlink drop to zero (Miklos Szeredi) [Orabug: 33687076] \n- panic: reinitialize logbuf locks before notifiers (Stephen Brennan) [Orabug: 33740420] \n- printk: Drop console_sem during panic (Stephen Brennan) [Orabug: 33740420] \n- printk: Avoid livelock with heavy printk during panic (Stephen Brennan) [Orabug: 33740420] \n- printk: disable optimistic spin during panic (Stephen Brennan) [Orabug: 33740420] \n- printk: Add panic_in_progress helper (Stephen Brennan) [Orabug: 33740420] \n- sched: Put vcpu preemption idle check into a SCHED_FEAT. (chris hyser) [Orabug: 33806261] \n- rds/ib: recover rds connection from stuck rx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820776] \n- drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause) [Orabug: 33840432] {CVE-2022-22942}\n- udf: Restore i_lenAlloc when inode expansion fails (Jan Kara) [Orabug: 33870266] {CVE-2022-0617}\n- udf: Fix NULL ptr deref when converting from inline format (Jan Kara) [Orabug: 33870266] {CVE-2022-0617}\n- ACPI: sysfs: copy ACPI data using io memory copying (Colin Ian King) [Orabug: 33876016] \n- Enable CONFIG_DM_DUST and nano for UEK6 (Gulam Mohamed) [Orabug: 33897851] \n- arm64/efi: remove spurious WARN_ON for !4K kernels (Mark Rutland) [Orabug: 33900748] \n- lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33910799] \n- ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet) [Orabug: 33917056] {CVE-2020-36516}\n- ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet) [Orabug: 33917056] {CVE-2020-36516}\n- bpf: fix out-of-tree module build (Alan Maguire) [Orabug: 33919430] \n- ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33925471] \n- arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33921736] {CVE-2022-23960}\n- KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Mitigate spectre style branch history side channels (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- KVM: arm64: Add templates for BHB mitigation sequences (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Add part number for Arm Cortex-A77 (Rob Herring) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Add percpu vectors for EL1 (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Move trampoline macros out of ifdef'd section (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Move the trampoline data page before the text page (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Free up another register on kpti's tramp_exit path (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Make the trampoline cleanup optional (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry.S: Add ventry overflow sanity checks (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) [Orabug: 33941936] {CVE-2021-26401}\n- Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp) [Orabug: 33917127] \n- x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Fix bug in retpoline mode on AMD with (Patrick Colp) [Orabug: 33941936] {CVE-2021-26401}\n- ovl: fix WARN_ON nlink drop to zero (Miklos Szeredi) [Orabug: 33687076] \n- panic: reinitialize logbuf locks before notifiers (Stephen Brennan) [Orabug: 33740420] \n- printk: Drop console_sem during panic (Stephen Brennan) [Orabug: 33740420] \n- printk: Avoid livelock with heavy printk during panic (Stephen Brennan) [Orabug: 33740420] \n- printk: disable optimistic spin during panic (Stephen Brennan) [Orabug: 33740420] \n- printk: Add panic_in_progress helper (Stephen Brennan) [Orabug: 33740420] \n- sched: Put vcpu preemption idle check into a SCHED_FEAT. (chris hyser) [Orabug: 33806261] \n- rds/ib: recover rds connection from stuck rx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820776] \n- drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause) [Orabug: 33840432] {CVE-2022-22942}\n- udf: Restore i_lenAlloc when inode expansion fails (Jan Kara) [Orabug: 33870266] {CVE-2022-0617}\n- udf: Fix NULL ptr deref when converting from inline format (Jan Kara) [Orabug: 33870266] {CVE-2022-0617}\n- ACPI: sysfs: copy ACPI data using io memory copying (Colin Ian King) [Orabug: 33876016] \n- Enable CONFIG_DM_DUST and nano for UEK6 (Gulam Mohamed) [Orabug: 33897851] \n- arm64/efi: remove spurious WARN_ON for !4K kernels (Mark Rutland) [Orabug: 33900748] \n- lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33910799] \n- ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet) [Orabug: 33917056] {CVE-2020-36516}\n- ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet) [Orabug: 33917056] {CVE-2020-36516}\n- bpf: fix out-of-tree module build (Alan Maguire) [Orabug: 33919430] \n- ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33925471] \n- arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33921736] \n- arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33921736] \n- KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse) [Orabug: 33921736] \n- arm64: Mitigate spectre style branch history side channels (James Morse) [Orabug: 33921736] \n- KVM: arm64: Add templates for BHB mitigation sequences (James Morse) [Orabug: 33921736] \n- arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual) [Orabug: 33921736] \n- arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose) [Orabug: 33921736] \n- arm64: Add part number for Arm Cortex-A77 (Rob Herring) [Orabug: 33921736] \n- arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse) [Orabug: 33921736] \n- arm64: Add percpu vectors for EL1 (James Morse) [Orabug: 33921736] \n- arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse) [Orabug: 33921736] \n- arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse) [Orabug: 33921736] \n- arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse) [Orabug: 33921736] \n- arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse) [Orabug: 33921736] \n- arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse) [Orabug: 33921736] \n- arm64: entry: Move trampoline macros out of ifdef'd section (James Morse) [Orabug: 33921736] \n- arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse) [Orabug: 33921736] \n- arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse) [Orabug: 33921736] \n- arm64: entry: Move the trampoline data page before the text page (James Morse) [Orabug: 33921736] \n- arm64: entry: Free up another register on kpti's tramp_exit path (James Morse) [Orabug: 33921736] \n- arm64: entry: Make the trampoline cleanup optional (James Morse) [Orabug: 33921736] \n- arm64: entry.S: Add ventry overflow sanity checks (James Morse) [Orabug: 33921736] \n- Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King) [Orabug: 33921736] \n- Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King) [Orabug: 33921736] \n- Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King) [Orabug: 33921736] \n- Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King) [Orabug: 33921736] \n- Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.' (Russell King) [Orabug: 33921736] \n- Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King) [Orabug: 33921736] \n- Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King) [Orabug: 33921736] \n- Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King) [Orabug: 33921736] \n- Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King) [Orabug: 33921736] \n- Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King) [Orabug: 33921736] \n- x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) [Orabug: 33941936] {CVE-2021-26341}\n- Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp) [Orabug: 33917127] \n- x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp) [Orabug: 33941936] {CVE-2021-26341}\n- x86/speculation: Fix bug in retpoline mode on AMD with (Patrick Colp) [Orabug: 33941936] {CVE-2021-26341}\n- rds/ib: handle posted ACK during connection shutdown (Nagappan Ramasamy Palaniappan) [Orabug: 33820760] \n- rds/ib: reap tx completions during connection shutdown (Nagappan Ramasamy Palaniappan) [Orabug: 33820760] \n- rds/ib: recover rds connection from stuck tx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820760]", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-04-11T00:00:00", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-36516", "CVE-2021-22600", "CVE-2021-26341", "CVE-2021-26401", "CVE-2022-0617", "CVE-2022-1016", "CVE-2022-1158", "CVE-2022-22942", "CVE-2022-23960", "CVE-2022-24448", "CVE-2022-26966"], "modified": "2022-04-11T00:00:00", "id": "ELSA-2022-9273", "href": "http://linux.oracle.com/errata/ELSA-2022-9273.html", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-04-11T23:30:40", "description": "[5.4.17-2136.306.1.3]\n- KVM: x86/mmu: do compare-and-exchange of gPTE via the user address (Paolo\n Bonzini) [Orabug: 34053807] {CVE-2022-1158}\n[5.4.17-2136.306.1.2]\n- Revert 'rds/ib: recover rds connection from stuck rx path' (Rohit Nair)\n [Orabug: 34045203]\n[5.4.17-2136.306.1.1]\n- netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso) [Orabug: 34035701] {CVE-2022-1016}\n- exec, elf: ignore invalid note data (Anthony Yznaga) [Orabug: 34035682]\n[5.4.17-2136.306.1]\n- sr9700: sanity check for packet length (Brian Maly) [Orabug: 33962705] {CVE-2022-26966}\n- net/packet: rx_owner_map depends on pg_vec (Willem de Bruijn) [Orabug: 33835787] {CVE-2021-22600}\n- KVM: SVM: Don't flush cache if hardware enforces cache coherency across encryption domains (Krish Sadhukhan) [Orabug: 33921125]\n- x86/mm/pat: Don't flush cache if hardware enforces cache coherency across encryption domnains (Krish Sadhukhan) [Orabug: 33921125]\n- rds/ib: Resize CQ if send-/recv-ring-size are changed (Hans Westgaard Ry) [Orabug: 33940519]\n- NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust) [Orabug: 33958154] {CVE-2022-24448}\n- Revert 'btrfs: inode: refactor the parameters of insert_reserved_file_extent()' (Srikanth C S) [Orabug: 33958240]\n- Revert 'btrfs: fix metadata reservation for fallocate that leads to transaction aborts' (Srikanth C S) [Orabug: 33958240]\n- ovl: fix WARN_ON nlink drop to zero (Miklos Szeredi) [Orabug: 33687076]\n- panic: reinitialize logbuf locks before notifiers (Stephen Brennan) [Orabug: 33740420]\n- printk: Drop console_sem during panic (Stephen Brennan) [Orabug: 33740420]\n- printk: Avoid livelock with heavy printk during panic (Stephen Brennan) [Orabug: 33740420]\n- printk: disable optimistic spin during panic (Stephen Brennan) [Orabug: 33740420]\n- printk: Add panic_in_progress helper (Stephen Brennan) [Orabug: 33740420]\n- sched: Put vcpu preemption idle check into a SCHED_FEAT. (chris hyser) [Orabug: 33806261]\n- rds/ib: recover rds connection from stuck rx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820776]\n- drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause) [Orabug: 33840432] {CVE-2022-22942}\n- udf: Restore i_lenAlloc when inode expansion fails (Jan Kara) [Orabug: 33870266] {CVE-2022-0617}\n- udf: Fix NULL ptr deref when converting from inline format (Jan Kara) [Orabug: 33870266] {CVE-2022-0617}\n- ACPI: sysfs: copy ACPI data using io memory copying (Colin Ian King) [Orabug: 33876016]\n- Enable CONFIG_DM_DUST and nano for UEK6 (Gulam Mohamed) [Orabug: 33897851]\n- arm64/efi: remove spurious WARN_ON for !4K kernels (Mark Rutland) [Orabug: 33900748]\n- lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33910799]\n- ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet) [Orabug: 33917056] {CVE-2020-36516}\n- ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet) [Orabug: 33917056] {CVE-2020-36516}\n- bpf: fix out-of-tree module build (Alan Maguire) [Orabug: 33919430]\n- ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33925471]\n- arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33921736] {CVE-2022-23960}\n- KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Mitigate spectre style branch history side channels (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- KVM: arm64: Add templates for BHB mitigation sequences (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Add part number for Arm Cortex-A77 (Rob Herring) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: Add percpu vectors for EL1 (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Move trampoline macros out of ifdef'd section (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Move the trampoline data page before the text page (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Free up another register on kpti's tramp_exit path (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry: Make the trampoline cleanup optional (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- arm64: entry.S: Add ventry overflow sanity checks (James Morse) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King) [Orabug: 33921736] {CVE-2022-23960}\n- x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) [Orabug: 33941936] {CVE-2021-26401}\n- Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp) [Orabug: 33917127]\n- x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp) [Orabug: 33941936] {CVE-2021-26401}\n- x86/speculation: Fix bug in retpoline mode on AMD with (Patrick Colp) [Orabug: 33941936] {CVE-2021-26401}\n- Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King) [Orabug: 33921736]\n- rds/ib: recover rds connection from stuck tx path (Nagappan Ramasamy Palaniappan) [Orabug: 33820760]", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-04-11T00:00:00", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel-container security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-36516", "CVE-2021-22600", "CVE-2021-26341", "CVE-2021-26401", "CVE-2022-0617", "CVE-2022-1016", "CVE-2022-1158", "CVE-2022-22942", "CVE-2022-23960", "CVE-2022-24448", "CVE-2022-26966"], "modified": "2022-04-11T00:00:00", "id": "ELSA-2022-9274", "href": "http://linux.oracle.com/errata/ELSA-2022-9274.html", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-07-12T18:39:50", "description": "[4.18.0-348.20.1_5.OL8]\n- Update Oracle Linux certificates (Kevin Lyons)\n- Disable signing for aarch64 (Ilya Okomin)\n- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]\n- Update x509.genkey [Orabug: 24817676]\n- Conflict with shim-ia32 and shim-x64 <= 15-11.0.5\n[4.18.0-348.20.1_5]\n- lib/iov_iter: initialize 'flags' in new pipe_buffer (Jan Stancek) [2060874 2060875] {CVE-2022-0847}\n[4.18.0-348.19.1_5]\n- tipc: improve size validations for received domain records (Xin Long) [2048970 2048971] {CVE-2022-0435}\n- smb3: do not error on fsync when readonly (Ronnie Sahlberg) [2055824 2037811]\n- security: implement sctp_assoc_established hook in selinux (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]\n- security: add sctp_assoc_established hook (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]\n- security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]\n- security: pass asoc to sctp_assoc_request and sctp_sk_clone (Bruno Meneguele) [2054112 2054117 2015525 2048251]\n- net: sctp: Fix some typos (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]\n- RDMA/bnxt_re: Fix stats counters (Selvin Xavier) [2049684 2001893]\n- net: check skb sec_path when re-initializing slow_gro in gro_list_prepare (Xin Long) [2047427 2030476]\n- cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (David Arcari) [2036888 2003695]\n[4.18.0-348.18.1_5]\n- selftests: kvm: Check whether SIDA memop fails for normal guests (Thomas Huth) [2050806 2050807] {CVE-2022-0516}\n- KVM: s390: Return error on SIDA memop on normal guest (Thomas Huth) [2050806 2050807] {CVE-2022-0516}\n- iommu/amd: Remove iommu_init_ga() (Jerry Snitselaar) [2030854 1998265]\n- iommu/amd: Relocate GAMSup check to early_enable_iommus (Jerry Snitselaar) [2030854 1998265]\n[4.18.0-348.17.1_5]\n- vfs: check dentry is still valid in get_link() (Ian Kent) [2052558 2014846]\n- xfs: don't expose internal symlink metadata buffers to the vfs (Brian Foster) [2052558 2014846]\n- CI: Use appropriate zstream builder (Veronika Kabatova)\n- CI: Enable baseline realtime checks (Veronika Kabatova)\n- CI: Rename pipelines to include release names (Veronika Kabatova)\n- cgroup-v1: Require capabilities to set release_agent (Waiman Long) [2052166 2052167] {CVE-2022-0492}\n- ice: Remove boolean vlan_promisc flag from function (Jonathan Toppins) [2051951 2030400]\n- ceph: put the requests/sessions when it fails to alloc memory (Jeffrey Layton) [2053725 2017796]\n- ceph: fix off by one bugs in unsafe_request_wait() (Jeffrey Layton) [2053725 2017796]\n- ceph: flush the mdlog before waiting on unsafe reqs (Jeffrey Layton) [2053725 2017796]\n- ceph: flush mdlog before umounting (Jeffrey Layton) [2053725 2017796]\n- ceph: make iterate_sessions a global symbol (Jeffrey Layton) [2053725 2017796]\n- ceph: make ceph_create_session_msg a global symbol (Jeffrey Layton) [2053725 2017796]\n- xfs: check sb_meta_uuid for dabuf buffer recovery (Bill O'Donnell) [2049292 2020764]\n- drm/i915: Flush TLBs before releasing backing store (Patrick Talbert) [2044328 2044329] {CVE-2022-0330}\n- hugetlb: fix hugetlb cgroup refcounting during vma split (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings (Waiman Long) [2039015 2032811]\n- mm/hugetlb: change hugetlb_reserve_pages() to type bool (Waiman Long) [2039015 2032811]\n- hugetlb: fix an error code in hugetlb_reserve_pages() (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: fix offline of hugetlb cgroup with reservations (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: fix reservation accounting (Waiman Long) [2039015 2032811]\n- mm/hugetlb: narrow the hugetlb_lock protection area during preparing huge page (Waiman Long) [2039015 2032811]\n- mm/hugetlb: a page from buddy is not on any list (Waiman Long) [2039015 2032811]\n- mm/hugetlb: not necessary to coalesce regions recursively (Waiman Long) [2039015 2032811]\n- selftests/vm/write_to_hugetlbfs.c: fix unused variable warning (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: add hugetlb_cgroup reservation tests (Waiman Long) [2039015 2032811]\n- hugetlb: support file_region coalescing again (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: support noreserve mappings (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: add accounting for shared mappings (Waiman Long) [2039015 2032811]\n- hugetlb: disable region_add file_region coalescing (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: add reservation accounting for private mappings (Waiman Long) [2039015 2032811]\n- mm/hugetlb_cgroup: fix hugetlb_cgroup migration (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: add interface for charge/uncharge hugetlb reservations (Waiman Long) [2039015 2032811]\n- hugetlb_cgroup: add hugetlb_cgroup reservation counter (Waiman Long) [2039015 2032811]\n- hugetlb: remove duplicated code (Waiman Long) [2039015 2032811]\n- hugetlb: region_chg provides only cache entry (Waiman Long) [2039015 2032811]\n- hugetlbfs: always use address space in inode for resv_map pointer (Waiman Long) [2039015 2032811]\n- hugetlbfs: fix potential over/underflow setting node specific nr_hugepages (Waiman Long) [2039015 2032811]\n- hugetlb: allow to free gigantic pages regardless of the configuration (Waiman Long) [2039015 2032811]\n- powerpc/pseries: Fix update of LPAR security flavor after LPM (Steve Best) [2027448 1997294]\n[4.18.0-348.16.1_5]\n- drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047601 2047602] {CVE-2022-22942}\n- net: openvswitch: Fix ct_state nat flags for conns arriving from tc (Marcelo Ricardo Leitner) [2043548 2040334]\n- net: openvswitch: Fix matching zone id for invalid conns arriving from tc (Marcelo Ricardo Leitner) [2043550 2040452]\n- net/sched: flow_dissector: Fix matching on zone id for invalid conns (Marcelo Ricardo Leitner) [2043550 2040452]\n- net/sched: Extend qdisc control block with tc control block (Marcelo Ricardo Leitner) [2043550 2040452]\n[4.18.0-348.15.1_5]\n- net/mlx5: DR, Use FW API when updating FW-owned flow table (Michal Schmidt) [2042663 2042651]\n- KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall (Vitaly Kuznetsov) [2043237 1868572]\n- drm/mgag200: Select clock in PLL update functions (Bruno Meneguele) [2034949 1953926]\n- drm/i915: Fix HAS_LSPCON macro for platforms between GEN9 and GEN10 (Bruno Meneguele) [2027335 2005586]\n- crypto: qat - power up 4xxx device (Vladis Dronov) [2016437 1960307]\n- RDMA/core: Fix a double free in add_port error flow (Kamal Heib) [2038724 2008555]\n- powerpc/iommu: Report the correct most efficient DMA mask for PCI devices (Steve Best) [2018928 2007425]\n- powerpc/dma: Fix dma_map_ops::get_required_mask (Steve Best) [2018928 2007425]\n[4.18.0-348.14.1_5]\n- tcp: fix page frag corruption on page fault (Paolo Abeni) [2041529 1996074]\n- net: fix sk_page_frag() recursion from memory reclaim (Paolo Abeni) [2041529 1996074]\n- KVM: s390: index kvm->arch.idle_mask by vcpu_idx (Thomas Huth) [2040769 2026230]\n- redhat: set LC_ALL=C before sorting config content (Frantisek Hrbata)\n[4.18.0-348.13.1_5]\n- vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040585 2040586] {CVE-2022-0185}\n- xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034864 2034865] {CVE-2021-4155}\n- af_unix: fix garbage collect vs MSG_PEEK (Patrick Talbert) [2031974 2031975] {CVE-2021-0920}\n- cgroup: verify that source is a string (Waiman Long) [2034608 2034609] {CVE-2021-4154}", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-03-11T00:00:00", "type": "oraclelinux", "title": "kernel security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-0920", "CVE-2021-4154", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0516", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2022-03-11T00:00:00", "id": "ELSA-2022-0825", "href": "http://linux.oracle.com/errata/ELSA-2022-0825.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-04-07T17:29:38", "description": "[4.1.12-124.61.2]\n- exec, elf: ignore invalid note data (Anthony Yznaga) [Orabug: 34023956]\n[4.1.12-124.61.1]\n- drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin) [Orabug: 33835812] {CVE-2022-0330}\n- drm/i915: Reduce locking in execlist command submission (Chris Wilson) [Orabug: 33835812] {CVE-2022-0330}\n- ipv4: make exception cache less predictible (Eric Dumazet) [Orabug: 33894531] {CVE-2021-20322}\n- route: also update fnhe_genid when updating a route cache (Xin Long) [Orabug: 33894531] {CVE-2021-20322}\n- ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet) [Orabug: 33917058] {CVE-2020-36516}\n- sctp: add vtag check in sctp_sf_violation (Xin Long) [Orabug: 33924717] {CVE-2021-3772}\n- sctp: use init_tag from inithdr for ABORT chunk (Xin Long) [Orabug: 33924717] {CVE-2021-3772}\n- sr9700: sanity check for packet length (Oliver Neukum) [Orabug: 33962995] {CVE-2022-26966}", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-04-05T00:00:00", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-36516", "CVE-2021-20322", "CVE-2021-3772", "CVE-2022-0330", "CVE-2022-26966"], "modified": "2022-04-05T00:00:00", "id": "ELSA-2022-9260", "href": "http://linux.oracle.com/errata/ELSA-2022-9260.html", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2022-04-07T21:33:36", "description": "[5.4.17-2136.305.5.3]\n- bpf: fix out-of-tree module build (Alan Maguire) [Orabug: 33973548] \n- ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33973543] \n- Revert 'btrfs: inode: refactor the parameters of insert_reserved_file_extent()' (Srikanth C S) [Orabug: 33973491] \n- Revert 'btrfs: fix metadata reservation for fallocate that leads to transaction aborts' (Srikanth C S) [Orabug: 33973491]\n[5.4.17-2136.305.5.2]\n- lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33942325] {CVE-2022-0847}\n[5.4.17-2136.305.5.1]\n- arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33937423] {CVE-2022-23960} \n- KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Mitigate spectre style branch history side channels (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- KVM: arm64: Add templates for BHB mitigation sequences (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Add part number for Arm Cortex-A77 (Rob Herring) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Add percpu vectors for EL1 (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Move trampoline macros out of ifdef'd section (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Move the trampoline data page before the text page (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Free up another register on kpti's tramp_exit path (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Make the trampoline cleanup optional (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry.S: Add ventry overflow sanity checks (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) [Orabug: 33937344] {CVE-2021-26401}\n- Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp) [Orabug: 33937389] \n- x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Fix bug in retpoline mode on AMD with (Patrick Colp) [Orabug: 33937344] {CVE-2021-26401}\n[5.4.17-2136.305.5]\n- netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso) [Orabug: 33900416] {CVE-2022-25636}\n[5.4.17-2136.305.4]\n- net/mlx5e: Fix page DMA map/unmap attributes (Aya Levin) [Orabug: 33382242] \n- DMA/rxe: Update default value of RXE_MAX_PDN (Rao Shoaib) [Orabug: 33676597] \n- uek-rpm: enable VIRTIO_PCI_LIB_LEGACY config (Si-Wei Liu) [Orabug: 33749636] \n- vdpa/mlx5: Fix tracking of current number of VQs (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Fix is_index_valid() to refer to features (Eli Cohen) [Orabug: 33749636] \n- vdpa: Protect vdpa reset with cf_mutex (Eli Cohen) [Orabug: 33749636] \n- vdpa: Avoid taking cf_mutex lock on get status (Eli Cohen) [Orabug: 33749636] \n- vdpa/vdpa_sim_net: Report max device capabilities (Eli Cohen) [Orabug: 33749636] \n- vdpa: Use BIT_ULL for bit operations (Eli Cohen) [Orabug: 33749636] \n- vdpa/vdpa_sim: Configure max supported virtqueues (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Report max device capabilities (Eli Cohen) [Orabug: 33749636] \n- vdpa: Support reporting max device capabilities (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps() (Eli Cohen) [Orabug: 33749636] \n- vdpa: Add support for returning device configuration information (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Support configuring max data virtqueue (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Fix config_attr_mask assignment (Eli Cohen) [Orabug: 33749636] \n- vdpa: Allow to configure max data virtqueues (Eli Cohen) [Orabug: 33749636] \n- vdpa: Read device configuration only if FEATURES_OK (Eli Cohen) [Orabug: 33749636] \n- vdpa: Sync calls set/get config/status with cf_mutex (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Distribute RX virtqueues in RQT object (Eli Cohen) [Orabug: 33749636] \n- vdpa: Provide interface to read driver features (Eli Cohen) [Orabug: 33749636] \n- vdpa: clean up get_config_size ret value handling (Laura Abbott) [Orabug: 33749636] \n- vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 (Eli Cohen) [Orabug: 33749636] \n- virtio/virtio_pci_legacy_dev: ensure the correct return value (Peng Hao) [Orabug: 33749636] \n- virtio: fix a typo in function 'vp_modern_remove' comments. (Dapeng Mi) [Orabug: 33749636] \n- virtio-pci: fix the confusing error message [Orabug: 33749636] \n- vdpa: Mark vdpa_config_ops.get_vq_notification as optional (Eugenio Perez) [Orabug: 33749636] \n- vdpa: Avoid duplicate call to vp_vdpa get_status (Eugenio Perez) [Orabug: 33749636] \n- net/mlx5_vdpa: Offer VIRTIO_NET_F_MTU when setting MTU (Eli Cohen) [Orabug: 33749636] \n- vdpa: add driver_override support (Stefano Garzarella) [Orabug: 33749636] \n- docs: document sysfs ABI for vDPA bus (Stefano Garzarella) [Orabug: 33749636] \n- vdpa: Consider device id larger than 31 (Parav Pandit) [Orabug: 33749636] \n- virtio: always enter drivers/virtio/ (Arnd Bergmann) [Orabug: 33749636] \n- vdpa: check that offsets are within bounds (Dan Carpenter) [Orabug: 33749636] \n- vdpa_sim: avoid putting an uninitialized iova_domain (Longpeng) [Orabug: 33749636] \n- vhost-vdpa: clean irqs before reseting vdpa device (Wu Zongyong) [Orabug: 33749636] \n- vdpa/mlx5: Forward only packets with allowed MAC address (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Support configuration of MAC (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit (Parav Pandit) [Orabug: 33749636] \n- vdpa_sim_net: Enable user to set mac address and mtu (Parav Pandit) [Orabug: 33749636] \n- vdpa: Enable user to set mac and mtu of vdpa device (Parav Pandit) [Orabug: 33749636] \n- vdpa: Use kernel coding style for structure comments (Parav Pandit) [Orabug: 33749636] \n- vdpa: Introduce query of device config layout (Parav Pandit) [Orabug: 33749636] \n- vdpa: Introduce and use vdpa device get, set config helpers (Parav Pandit) [Orabug: 33749636] \n- vdpa/mlx5: Propagate link status from device to vdpa driver (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Rename control VQ workqueue to vdpa wq (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Remove mtu field from vdpa net device (Eli Cohen) [Orabug: 33749636] \n- vdpa: add new attribute VDPA_ATTR_DEV_MIN_VQ_SIZE (Wu Zongyong) [Orabug: 33749636] \n- virtio_vdpa: setup correct vq size with callbacks get_vq_num_{max,min} (Wu Zongyong) [Orabug: 33749636] \n- vdpa: min vq num of vdpa device cannot be greater than max vq num (Wu Zongyong) [Orabug: 33749636] \n- vdpa: add new callback get_vq_num_min in vdpa_config_ops (Wu Zongyong) [Orabug: 33749636] \n- vp_vdpa: add vq irq offloading support (Wu Zongyong) [Orabug: 33749636] \n- vdpa: fix typo (Wu Zongyong) [Orabug: 33749636] \n- virtio-pci: introduce legacy device module (Wu Zongyong) [Orabug: 33749636] \n- vhost-vdpa: Fix the wrong input in config_cb (Cindy Lu) [Orabug: 33749636] \n- vhost_vdpa: unset vq irq before freeing irq (Wu Zongyong) [Orabug: 33749636] \n- vdpa: potential uninitialized return in vhost_vdpa_va_map() (Dan Carpenter) [Orabug: 33749636] \n- vdpa/mlx5: Avoid executing set_vq_ready() if device is reset (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Clear ready indication for control VQ (Eli Cohen) [Orabug: 33749636] \n- vdpa: Support transferring virtual addressing during DMA mapping (Xie Yongji) [Orabug: 33749636] \n- vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap() (Xie Yongji) [Orabug: 33749636] \n- vdpa: Add an opaque pointer for vdpa_config_ops.dma_map() (Xie Yongji) [Orabug: 33749636] \n- vhost-iotlb: Add an opaque pointer for vhost IOTLB (Xie Yongji) [Orabug: 33749636] \n- vhost-vdpa: Handle the failure of vdpa_reset() (Xie Yongji) [Orabug: 33749636] \n- vdpa: Add reset callback in vdpa_config_ops (Xie Yongji) [Orabug: 33749636] \n- vdpa: Fix some coding style issues (Xie Yongji) [Orabug: 33749636] \n- vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro (Cai Huoqing) [Orabug: 33749636] \n- vdpa_sim: Use iova_shift() for the size passed to alloc_iova() (Xie Yongji) [Orabug: 33749636] \n- vdpa/mlx5: Add multiqueue support (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Add support for control VQ and MAC setting (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Ensure valid indices are provided (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Decouple virtqueue callback from struct mlx5_vdpa_virtqueue (Eli Cohen) [Orabug: 33749636] \n- Revert 'vdpa/mlx5: fix feature negotiation across device reset' (Si-Wei Liu) [Orabug: 33749636] \n- vdpa/mlx5: function prototype modifications in preparation to control VQ (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Remove redundant header file inclusion (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Fix queue type selection logic (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Avoid destroying MR on empty iotlb (Eli Cohen) [Orabug: 33749636] \n- virtio_vdpa: reject invalid vq indices (Vincent Whitchurch) [Orabug: 33749636] \n- vdpa: Add documentation for vdpa_alloc_device() macro (Xie Yongji) [Orabug: 33749636] \n- vp_vdpa: Fix return value check for vdpa_alloc_device() (Xie Yongji) [Orabug: 33749636] \n- vdpa_sim: Fix return value check for vdpa_alloc_device() (Xie Yongji) [Orabug: 33749636] \n- vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() (Xie Yongji) [Orabug: 33749636] \n- xfs: remove incorrect ASSERT in xfs_rename (Eric Sandeen) [Orabug: 33803847] \n- KVM: nVMX: Filter out all unsupported controls when eVMCS was activated (Vitaly Kuznetsov) [Orabug: 33805849] \n- crypto: ccp - Add support for new CCP/PSP device ID (John Allen) [Orabug: 33805849] \n- KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU (Sean Christopherson) [Orabug: 33805849] \n- KVM: fix avic_set_running for preemptable kernels (Paolo Bonzini) [Orabug: 33805849] \n- KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES (Vitaly Kuznetsov) [Orabug: 33805849] \n- KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall (Vitaly Kuznetsov) [Orabug: 33805849] \n- KVM: x86: Swap order of CPUID entry 'index' vs. 'significant flag' checks (Sean Christopherson) [Orabug: 33805849] \n- KVM: x86: nSVM: don't copy virt_ext from vmcb12 (Maxim Levitsky) [Orabug: 33805849] {CVE-2021-3653} {CVE-2021-3656}\n- KVM: x86: nSVM: restore int_vector in svm_clear_vintr (Maxim Levitsky) [Orabug: 33805849] \n- KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() (Vitaly Kuznetsov) [Orabug: 33805849] \n- KVM: x86: Mark all registers as avail/dirty at vCPU creation (Sean Christopherson) [Orabug: 33805849] \n- KVM: nVMX: Sync all PGDs on nested transition with shadow paging (Sean Christopherson) [Orabug: 33805849] \n- KVM: SVM: Revert clearing of C-bit on GPA in #NPF handler (Sean Christopherson) [Orabug: 33805849] \n- KVM: SVM: Don't strip the C-bit from CR2 on #PF interception (Sean Christopherson) [Orabug: 33805849] \n- rds/ib: Kernel change to extend rds-info functionality (Rohit Nair) [Orabug: 33821340] \n- nvmet-tcp: fix a race condition between release_queue and io_work (Maurizio Lombardi) [Orabug: 33825776] \n- nvmet-tcp: add an helper to free the cmd buffers (Maurizio Lombardi) [Orabug: 33825776] \n- drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin) [Orabug: 33835810] {CVE-2022-0330}\n- rds: ib: Make selection of completion_vector QoS aware (Hakon Bugge) [Orabug: 33845918] \n- tipc: improve size validations for received domain records (Jon Maloy) [Orabug: 33850801] {CVE-2022-0435} {CVE-2022-0435}\n- uek-rpm: Synchronize Module.kabi and lockedlist (Stephen Brennan) [Orabug: 33871538]\n[5.4.17-2136.305.3]\n- net/mlx5: Enable mlx5 IPsec build options on OL7/OL8 (Qing Huang) [Orabug: 32936614] \n- net/mlx5e: Fix SWP offsets when vlan inserted by driver (Moshe Shemesh) [Orabug: 32936614] \n- net/mlx5e: Fix missing IPsec statistics on uplink representor (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: Add IPsec support to uplink representor (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Fix checksum issue of VXLAN and IPsec crypto offload (Huy Nguyen) [Orabug: 32936614] \n- net/xfrm: Add inner_ipproto into sec_path (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: Optimize mlx5e_feature_checks for non IPsec packet (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: Replace spaces with tab at the start of a line (Wenpeng Liang) [Orabug: 32936614] \n- net/mlx5e: Enable XDP for Connect-X IPsec capable devices (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: Enable striding RQ for Connect-X IPsec capable devices (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: Release skb in case of failure in tc update skb (Maor Dickman) [Orabug: 32936614] \n- net/mlx5e: Move set vxlan nic info to profile init (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Fix IPSEC stats (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: IPsec, Remove unnecessary config flag usage (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: IPsec, Inline feature_check fast-path function (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: IPsec, Avoid unreachable return (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: IPsec, Enclose csum logic under ipsec config (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: Split between RX/TX tunnel FW support indication (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Allow RQ outside of channel context (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Allow CQ outside of channel context (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Free drop RQ in a dedicated function (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: kTLS, Enforce HW TX csum offload with kTLS (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5: Expose IP-in-IP TX and RX capability bits (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Fix IPsec packet drop by mlx5e_tc_update_skb (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5e: Set IPsec WAs only in IP's non checksum partial case. (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5e: IPsec: Add Connect-X IPsec Tx data path offload (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: IPsec: Add TX steering rule per IPsec state (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: Add NIC TX domain namespace (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5e: Add tc chains offload support for nic flows (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5: Refactor tc flow attributes structure (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5e: Split nic tc flow allocation and creation (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5e: Tc nic flows to use mlx5_chains flow tables (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5: Refactor multi chains and prios support (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5e: Enhanced TX MPWQE for SKBs (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Move TX code into functions to be used by MPWQE (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Rename xmit-related structs to generalize them (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Generalize TX MPWQE checks for full session (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Support multiple SKBs in a TX WQE (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Move the TLS resync check out of the function (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Unify constants for WQE_EMPTY_DS_COUNT (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Small improvements for XDP TX MPWQE logic (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Refactor xmit functions (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Move mlx5e_tx_wqe_inline_mode to en_tx.c (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Use struct assignment to initialize mlx5e_tx_wqe_info (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Refactor inline header size calculation in the TX path (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Fix endianness when calculating pedit mask first bit (Maor Dickman) [Orabug: 32936614] \n- net/mlx5e: CT: Fix freeing ct_label mapping (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Fix memory leak of tunnel info when rule under multipath not ready (Jianbo Liu) [Orabug: 32936614] \n- net/mlx5e: Use synchronize_rcu to sync with NAPI (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Use RCU to protect rq->xdp_prog (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: RX, Add a prefetch command for small L1_CACHE_BYTES (Tariq Toukan) [Orabug: 32936614] \n- net: Take common prefetch code structure into a function (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: Use indirect call wrappers for RX post WQEs functions (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: CT: Map 128 bits labels to 32 bit map ID (Eli Britstein) [Orabug: 32936614] \n- net/mlx5e: XDP, Avoid indirect call in TX flow (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: IPsec: Add Connect-X IPsec ESN update offload support (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: IPsec: Add IPsec steering in local NIC RX (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: Add IPsec related Flow steering entry's fields (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: IPsec: Add HW crypto offload support (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Accel, Add core IPsec support for the Connect-X family (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: Fix build break when CONFIG_XPS is not set (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: CT: Fix releasing ft entries (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: CT: Remove unused function param (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: CT: Return err_ptr from internal functions (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: CT: Use mapping for zone restore register (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Re-use tuple modify headers for identical modify actions (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: Export sharing of mod headers to a new file (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Restore ct state from lookup in zone instead of tupleid (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Don't offload tuple rewrites for established tuples (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: Use netdev_info instead of pr_info (Oz Shlomo) [Orabug: 32936614] \n- net/mlx5e: CT: Allow header rewrite of 5-tuple and ct clear action (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Save ct entries tuples in hashtables (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: Fix VXLAN configuration restore after function reload (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Enhance TX timeout recovery (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Enhance ICOSQ data on RX reporter's diagnose (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Add EQ info to TX/RX reporter's diagnose (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Rename reporter's helpers (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Add helper to get the RQ WQE counter (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Add helper to get RQ WQE's head (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Align RX/TX reporters diagnose output format (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Refactor build channel params (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: vxlan: Use RCU for vxlan table lookup (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: Move TC-specific function definitions into MLX5_CLS_ACT (Vlad Buslov) [Orabug: 32936614] \n- net/mlx5e: CT: Fix ipv6 nat header rewrite actions (Oz Shlomo) [Orabug: 32936614] \n- net/mlx5e: en_tc: Fix cast to restricted __be32 warning (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: Don't use err uninitialized in mlx5e_attach_decap (Nathan Chancellor) [Orabug: 32936614] \n- net/mlx5e: Optimize performance for IPv4/IPv6 ethertype (Eli Britstein) [Orabug: 32936614] \n- net/mlx5e: Helper function to set ethertype (Eli Britstein) [Orabug: 32936614] \n- net/mlx5e: CT: Correctly get flow rule (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Support pedit on mpls over UDP decap (Eli Cohen) [Orabug: 32936614] \n- xsk: Fix xsk_umem_xdp_frame_sz() (Bjorn Topel) [Orabug: 32936614] \n- net/mlx5e: CT: Fix offload with CT action after CT NAT action (Roi Dayan) [Orabug: 32936614] \n- mlx5: Rx queue setup time determine frame_sz for XDP (Jesper Dangaard Brouer) [Orabug: 32936614] \n- xdp: For Intel AF_XDP drivers add XDP frame_sz (Jesper Dangaard Brouer) [Orabug: 32936614] \n- xdp: Add frame size to xdp_buff (Jesper Dangaard Brouer) [Orabug: 32936614] \n- net: remove newlines in NL_SET_ERR_MSG_MOD (Jacob Keller) [Orabug: 32936614] \n- net/mlx5: CT: Remove unused variables (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Avoid false warning about rule may be used uninitialized (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Remove unneeded semicolon (Zheng Bin) [Orabug: 32936614] \n- net/mlx5: IPsec, Fix coverity issue (Raed Salem) [Orabug: 32936614] \n- net/mlx5: TX WQE Add trailer insertion field (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Introduce IPsec Connect-X offload hardware bits and structures (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Update vxlan.c new cmd interface (Leon Romanovsky) [Orabug: 32936614] \n- net/mlx5: Update cq.c to new cmd interface (Leon Romanovsky) [Orabug: 32936614] \n- net/mlx5: CT: Change idr to xarray to protect parallel tuple id allocation (Paul Blakey) [Orabug: 32936614] \n- net/mlx5: IPsec, Refactor SA handle creation and destruction (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: IPSec, Expose IPsec HW stat only for supporting HW (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Refactor mlx5_accel_esp_create_hw_context parameter list (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Use the correct IPsec capability function for FPGA ops (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: CT: Use rhashtable's ct entries instead of a separate list (Paul Blakey) [Orabug: 32936614] \n- net/mlx5: Add support for RDMA TX steering (Michael Guralnik) [Orabug: 32936614] \n- net/mlx5e: Fix actions_match_supported() return (Dan Carpenter) [Orabug: 32936614] \n- net/mlx5: Eswitch, enable forwarding back to uplink port (Eli Cohen) [Orabug: 32936614] \n- net/mlx5e: Add support for offloading traffic from uplink to uplink (Eli Cohen) [Orabug: 32936614] \n- net/mlx5e: Fix rejecting all egress rules not on vlan (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: CT: Fix stack usage compiler warning (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: CT: remove set but not used variable 'unnew' (YueHaibing) [Orabug: 32936614] \n- net/mlx5e: Fix an IS_ERR() vs NULL check (Dan Carpenter) [Orabug: 32936614] \n- net/mlx5: Introduce TLS and IPSec objects enums (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: Fix endianness handling in pedit mask (Sebastian Hense) [Orabug: 32936614] \n- net/mlx5e: Remove redundant comment about goto slow path (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Reduce number of arguments in slow path handling (Eli Cohen) [Orabug: 32936614] \n- net/mlx5e: Use netdev_warn() instead of pr_err() for errors (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Add devlink fdb_large_groups parameter (Jianbo Liu) [Orabug: 32936614] \n- net/mlx5: Change the name of steering mode param id (Jianbo Liu) [Orabug: 32936614] \n- net/mlx5: Eswitch, avoid redundant mask (Eli Cohen) [Orabug: 32936614] \n- net/mlx5: Fix header guard in rsc_dump.h (Nathan Chancellor) [Orabug: 32936614] \n- net/mlx5e: Add context to the preactivate hook (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Allow mlx5e_switch_priv_channels to fail and recover (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Remove unneeded netif_set_real_num_tx_queues (Maxim Mikityanskiy) [Orabug: 32936614] \n- ESP: Export esp_output_fill_trailer function (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Remove a useless 'drain_workqueue()' call in 'mlx5e_ipsec_cleanup()' (Christophe JAILLET) [Orabug: 32936614] \n- mlx5: Use proper logging and tracing line terminations (Joe Perches) [Orabug: 32936614] \n- net/mlx5e: Support dump callback in RX reporter (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Support dump callback in TX reporter (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Gather reporters APIs together (Aya Levin) [Orabug: 32936614] \n- net/mlx5: Add support for resource dump (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Create q counters on uplink representors (Vlad Buslov) [Orabug: 32936614] \n- net/mlx5: Expose resource dump register mapping (Aya Levin) [Orabug: 32936614] \n- net/mlx5: Add structures and defines for MIRC register (Eran Ben Elisha) [Orabug: 32936614] \n- net/mlx5: WQ, Move short getters into header file (Tariq Toukan) [Orabug: 32936614] \n- Revert 'net/mlx5e: Fix SWP offsets when vlan inserted by driver' (Mikhael Goikhman) [Orabug: 32936614] \n- uek-rpm: ensure BPF Type Format (BTF) section is retained in modules (Alan Maguire) [Orabug: 33774133] \n- kbuild: Skip module BTF generation for out-of-tree external modules (Andrii Nakryiko) [Orabug: 33774133] \n- bpf: Load and verify kernel module BTFs (Andrii Nakryiko) [Orabug: 33774133] \n- kbuild: Build kernel module BTFs if BTF is enabled and pahole supports it (Andrii Nakryiko) [Orabug: 33774133] \n- arm64: Add assembly annotations for weak-PI-alias madness (Robin Murphy) [Orabug: 33816089] \n- arm64: Import updated version of Cortex Strings' strlen (Sam Tebbs) [Orabug: 33816089] \n- arm64: Import latest memcpy()/memmove() implementation (Robin Murphy) [Orabug: 33816089] \n- arm64: Import latest version of Cortex Strings' memcmp (Sam Tebbs) [Orabug: 33816089] \n- arm64: Better optimised memchr() (Robin Murphy) [Orabug: 33816089] \n- net/rds: Fix memory leak in __rds_conn_create() on alloc_ordered_workqueue fail (Freddy Carrillo) [Orabug: 33821540] \n- x86/smpboot: check cpu_initialized_mask first after returning from schedule() (Dongli Zhang) [Orabug: 33825645] \n- uek-rpm/ol/config-aarch64: Enable CONFIG_ARM_RASPBERRYPI_CPUFREQ for RPi (Vijay Kumar) \n- KVM: x86: Initialize tdp_level during vCPU creation (Sean Christopherson) [Orabug: 33841857] \n- KVM: x86/mmu: Capture TDP level when updating CPUID (Sean Christopherson) [Orabug: 33841857] \n- xen/netback: don't queue unlimited number of packages (Juergen Gross) [Orabug: 33851834] \n- xen/netback: fix rx queue stall detection (Juergen Gross) [Orabug: 33851834] \n- Fix conflict of LTS commit 'PCI: aardvark: Configure PCIe resources from 'ranges' DT property' (Sherry Yang) [Orabug: 33862617]\n[5.4.17-2136.305.2]\n- LTS tag: v5.4.163 (Sherry Yang) \n- tty: hvc: replace BUG_ON() with negative return value (Juergen Gross) \n- xen/netfront: don't trust the backend response data blindly (Juergen Gross) \n- xen/netfront: disentangle tx_skb_freelist (Juergen Gross) \n- xen/netfront: don't read data from request on the ring page (Juergen Gross) \n- xen/netfront: read response from backend only once (Juergen Gross) \n- xen/blkfront: don't trust the backend response data blindly (Juergen Gross) \n- xen/blkfront: don't take local copy of a request from the ring page (Juergen Gross) \n- xen/blkfront: read response from backend only once (Juergen Gross) \n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (Juergen Gross) \n- fuse: release pipe buf after last use (Miklos Szeredi) \n- NFC: add NCI_UNREG flag to eliminate the race (Lin Ma) \n- shm: extend forced shm destroy to support objects from several IPC nses (Alexander Mikhalitsyn) \n- s390/mm: validate VMA in PGSTE manipulation functions (David Hildenbrand) \n- tracing: Check pid filtering when creating events (Steven Rostedt (VMware)) \n- vhost/vsock: fix incorrect used length reported to the guest (Stefano Garzarella) \n- smb3: do not error on fsync when readonly (Steve French) \n- f2fs: set SBI_NEED_FSCK flag when inconsistent node block found (Weichao Guo) \n- net: mscc: ocelot: correctly report the timestamping RX filters in ethtool (Vladimir Oltean) \n- net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP (Vladimir Oltean) \n- net: hns3: fix VF RSS failed problem after PF enable multi-TCs (Guangbin Huang) \n- net/smc: Don't call clcsock shutdown twice when smc shutdown (Tony Lu) \n- net: vlan: fix underflow for the real_dev refcnt (Ziyang Xuan) \n- MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 (Huang Pei) \n- igb: fix netpoll exit with traffic (Jesse Brandeburg) \n- nvmet: use IOCB_NOWAIT only if the filesystem supports it (Maurizio Lombardi) \n- tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows (Eric Dumazet) \n- PM: hibernate: use correct mode for swsusp_close() (Thomas Zeitlhofer) \n- net/ncsi : Add payload to be 32-bit aligned to fix dropped packets (Kumar Thangavel) \n- nvmet-tcp: fix incomplete data digest send (Varun Prakash) \n- net/smc: Ensure the active closing peer first closes clcsock (Tony Lu) \n- scsi: core: sysfs: Fix setting device state to SDEV_RUNNING (Mike Christie) \n- net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group (Nikolay Aleksandrov) \n- net: ipv6: add fib6_nh_release_dsts stub (Nikolay Aleksandrov) \n- nfp: checking parameter process for rx-usecs/tx-usecs is invalid (Diana Wang) \n- ipv6: fix typos in __ip6_finish_output() (Eric Dumazet) \n- iavf: Prevent changing static ITR values if adaptive moderation is on (Nitesh B Venkatesh) \n- drm/vc4: fix error code in vc4_create_object() (Dan Carpenter) \n- scsi: mpt3sas: Fix kernel panic during drive powercycle test (Sreekanth Reddy) \n- ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (Takashi Iwai) \n- NFSv42: Don't fail clone() unless the OP_CLONE operation failed (Trond Myklebust) \n- firmware: arm_scmi: pm: Propagate return value to caller (Peng Fan) \n- net: ieee802154: handle iftypes as u32 (Alexander Aring) \n- ASoC: topology: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer (Srinivas Kandagatla) \n- ARM: dts: BCM5301X: Add interrupt properties to GPIO node (Florian Fainelli) \n- ARM: dts: BCM5301X: Fix I2C controller interrupt (Florian Fainelli) \n- netfilter: ipvs: Fix reuse connection if RS weight is 0 (yangxingwu) \n- proc/vmcore: fix clearing user buffer by properly using clear_user() (David Hildenbrand) \n- arm64: dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function (Marek Behun) \n- pinctrl: armada-37xx: Correct PWM pins definitions (Marek Behun) \n- PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge (Pali Rohar) \n- PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge (Pali Rohar) \n- PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge (Pali Rohar) \n- PCI: aardvark: Fix link training (Pali Rohar) \n- PCI: aardvark: Simplify initialization of rootcap on virtual bridge (Pali Rohar) \n- PCI: aardvark: Implement re-issuing config requests on CRS response (Pali Rohar) \n- PCI: aardvark: Fix PCIe Max Payload Size setting (Pali Rohar) \n- PCI: aardvark: Configure PCIe resources from 'ranges' DT property (Pali Rohar) \n- PCI: pci-bridge-emul: Fix array overruns, improve safety (Russell King) \n- PCI: aardvark: Update comment about disabling link training (Pali Rohar) \n- PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link() (Pali Rohar) \n- PCI: aardvark: Fix compilation on s390 (Pali Rohar) \n- PCI: aardvark: Don't touch PCIe registers if no card connected (Pali Rohar) \n- PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros (Pali Rohar) \n- PCI: aardvark: Issue PERST via GPIO (Pali Rohar) \n- PCI: aardvark: Improve link training (Marek Behun) \n- PCI: aardvark: Train link immediately after enabling training (Pali Rohar) \n- PCI: aardvark: Fix big endian support (Grzegorz Jaszczyk) \n- PCI: aardvark: Wait for endpoint to be ready before training link (Remi Pommarel) \n- PCI: aardvark: Deduplicate code in advk_pcie_rd_conf() (Marek Behun) \n- mdio: aspeed: Fix 'Link is Down' issue (Dylan Hung) \n- mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB (Adrian Hunter) \n- tracing: Fix pid filtering when triggers are attached (Steven Rostedt (VMware)) \n- tracing/uprobe: Fix uprobe_perf_open probes iteration (Jiri Olsa) \n- KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB (Nicholas Piggin) \n- xen: detect uninitialized xenbus in xenbus_init (Stefano Stabellini) \n- xen: don't continue xenstore initialization in case of errors (Stefano Stabellini) \n- staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (Dan Carpenter) \n- staging/fbtft: Fix backlight (Noralf Tronnes) \n- HID: wacom: Use 'Confidence' flag to prevent reporting invalid contacts (Jason Gerecke) \n- Revert 'parisc: Fix backtrace to always include init funtion names' (Helge Deller) \n- media: cec: copy sequence field for the reply (Hans Verkuil) \n- ALSA: ctxfi: Fix out-of-range access (Takashi Iwai) \n- binder: fix test regression due to sender_euid change (Todd Kjos) \n- usb: hub: Fix locking issues with address0_mutex (Mathias Nyman) \n- usb: hub: Fix usb enumeration issue due to address0 race (Mathias Nyman) \n- usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts (Ondrej Jirman) \n- net: nexthop: fix null pointer dereference when IPv6 is not enabled (Nikolay Aleksandrov) \n- usb: dwc2: hcd_queue: Fix use of floating point literal (Nathan Chancellor) \n- usb: dwc2: gadget: Fix ISOC flow for elapsed frames (Minas Harutyunyan) \n- USB: serial: option: add Fibocom FM101-GL variants (Mingjie Zhang) \n- USB: serial: option: add Telit LE910S1 0x9200 composition (Daniele Palmas) \n- LTS tag: v5.4.162 (Sherry Yang) \n- ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (Pierre-Louis Bossart) \n- ALSA: hda: hdac_ext_stream: fix potential locking issues (Pierre-Louis Bossart) \n- hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit) \n- tlb: mmu_gather: add tlb_flush_*_range APIs (Peter Zijlstra (Intel)) \n- ice: Delete always true check of PF pointer (Leon Romanovsky) \n- usb: max-3421: Use driver data instead of maintaining a list of bound devices (Uwe Kleine-Konig) \n- ASoC: DAPM: Cover regression by kctl change notification fix (Takashi Iwai) \n- batman-adv: Don't always reallocate the fragmentation skb head (Sven Eckelmann) \n- batman-adv: Reserve needed_*room for fragments (Sven Eckelmann) \n- batman-adv: Consider fragmentation for needed_headroom (Sven Eckelmann) \n- perf/core: Avoid put_page() when GUP fails (Greg Thelen) \n- Revert 'net: mvpp2: disable force link UP during port init procedure' (Greg Kroah-Hartman) \n- drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors (hongao) \n- drm/i915/dp: Ensure sink rate values are always valid (Imre Deak) \n- drm/nouveau: use drm_dev_unplug() during device removal (Jeremy Cline) \n- drm/udl: fix control-message timeout (Johan Hovold) \n- cfg80211: call cfg80211_stop_ap when switch from P2P_GO type (Nguyen Dinh Phi) \n- parisc/sticon: fix reverse colors (Sven Schnelle) \n- btrfs: fix memory ordering between normal and ordered work functions (Nikolay Borisov) \n- udf: Fix crash after seekdir (Jan Kara) \n- s390/kexec: fix memory leak of ipl report buffer (Baoquan He) \n- x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails (Sean Christopherson) \n- mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag (Rustam Kovhaev) \n- ipc: WARN if trying to remove ipc object which is absent (Alexander Mikhalitsyn) \n- hexagon: export raw I/O routines for modules (Nathan Chancellor) \n- tun: fix bonding active backup with arp monitoring (Nicolas Dichtel) \n- arm64: vdso32: suppress error message for 'make mrproper' (Nick Desaulniers) \n- s390/kexec: fix return code handling (Heiko Carstens) \n- perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server (Alexander Antonov) \n- perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server (Alexander Antonov) \n- KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr() (Michael Ellerman) \n- NFC: reorder the logic in nfc_{un,}register_device (Lin Ma) \n- drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame (Hans Verkuil) \n- NFC: reorganize the functions in nci_request (Lin Ma) \n- i40e: Fix display error code in dmesg (Grzegorz Szczurek) \n- i40e: Fix creation of first queue by omitting it if is not power of two (Jedrzej Jagielski) \n- i40e: Fix ping is lost after configuring ADq on VF (Eryk Rybak) \n- i40e: Fix changing previously set num_queue_pairs for PFs (Eryk Rybak) \n- i40e: Fix NULL ptr dereference on VSI filter sync (Michal Maloszewski) \n- i40e: Fix correct max_pkt_size on VF RX queue (Eryk Rybak) \n- net: virtio_net_hdr_to_skb: count transport header in UFO (Jonathan Davies) \n- net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove (Pavel Skripkin) \n- net: sched: act_mirred: drop dst for the direction from egress to ingress (Xin Long) \n- scsi: core: sysfs: Fix hang when device state is set via sysfs (Mike Christie) \n- platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' (Christophe JAILLET) \n- mips: lantiq: add support for clk_get_parent() (Randy Dunlap) \n- mips: bcm63xx: add support for clk_get_parent() (Randy Dunlap) \n- MIPS: generic/yamon-dt: fix uninitialized variable error (Colin Ian King) \n- iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset (Surabhi Boob) \n- iavf: validate pointers (Mitch Williams) \n- iavf: prevent accidental free of filter structure (Jacob Keller) \n- iavf: Fix failure to exit out from last all-multicast mode (Piotr Marczak) \n- iavf: free q_vectors before queues in iavf_disable_vf (Nicholas Nunley) \n- iavf: check for null in iavf_fix_features (Nicholas Nunley) \n- net: bnx2x: fix variable dereferenced before check (Pavel Skripkin) \n- perf tests: Remove bash construct from record+zstd_comp_decomp.sh (James Clark) \n- perf bench futex: Fix memory leak of perf_cpu_map__new() (Sohaib Mohamed) \n- perf bpf: Avoid memory leak from perf_env__insert_btf() (Ian Rogers) \n- RDMA/netlink: Add __maybe_unused to static inline in C file (Leon Romanovsky) \n- tracing/histogram: Do not copy the fixed-size char array field over the field size (Masami Hiramatsu) \n- tracing: Save normal string variables (Tom Zanussi) \n- sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() (Vincent Donnefort) \n- mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set (Randy Dunlap) \n- clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk (Dmitry Baryshkov) \n- clk/ast2600: Fix soc revision for AHB (Joel Stanley) \n- clk: ingenic: Fix bugs with divided dividers (Paul Cercueil) \n- sh: define __BIG_ENDIAN for math-emu (Randy Dunlap) \n- sh: math-emu: drop unused functions (Randy Dunlap) \n- sh: fix kconfig unmet dependency warning for FRAME_POINTER (Randy Dunlap) \n- f2fs: fix up f2fs_lookup tracepoints (Gao Xiang) \n- maple: fix wrong return value of maple_bus_init(). (Lu Wei) \n- sh: check return code of request_irq (Nick Desaulniers) \n- powerpc/dcr: Use cmplwi instead of 3-argument cmpli (Michael Ellerman) \n- ALSA: gus: fix null pointer dereference on pointer block (Chengfeng Ye) \n- powerpc/5200: dts: fix memory node unit name (Anatolij Gustschin) \n- iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr() (Teng Qi) \n- scsi: target: Fix alua_tg_pt_gps_count tracking (Mike Christie) \n- scsi: target: Fix ordered tag handling (Mike Christie) \n- MIPS: sni: Fix the build (Bart Van Assche) \n- tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Guanghui Feng) \n- ALSA: ISA: not for M68K (Randy Dunlap) \n- ARM: dts: ls1021a-tsn: use generic 'jedec,spi-nor' compatible for flash (Li Yang) \n- ARM: dts: ls1021a: move thermal-zones node out of soc/ (Li Yang) \n- usb: host: ohci-tmio: check return value after calling platform_get_resource() (Yang Yingliang) \n- ARM: dts: omap: fix gpmc,mux-add-data type (Roger Quadros) \n- firmware_loader: fix pre-allocated buf built-in firmware use (Luis Chamberlain) \n- scsi: advansys: Fix kernel pointer leak (Guo Zhi) \n- ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect (Hans de Goede) \n- clk: imx: imx6ul: Move csi_sel mux to correct base register (Stefan Riedmueller) \n- ASoC: SOF: Intel: hda-dai: fix potential locking issue (Pierre-Louis Bossart) \n- arm64: dts: freescale: fix arm,sp805 compatible string (Michael Walle) \n- arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency (AngeloGioacchino Del Regno) \n- usb: typec: tipd: Remove WARN_ON in tps6598x_block_read (Sven Peter) \n- usb: musb: tusb6010: check return value after calling platform_get_resource() (Yang Yingliang) \n- RDMA/bnxt_re: Check if the vlan is valid before reporting (Selvin Xavier) \n- arm64: dts: hisilicon: fix arm,sp805 compatible string (Michael Walle) \n- ARM: dts: NSP: Fix mpcore, mmc node names (Matthew Hagan) \n- arm64: zynqmp: Fix serial compatible string (Michal Simek) \n- arm64: zynqmp: Do not duplicate flash partition label property (Amit Kumar Mahapatra) \n- net/mlx5: Add back multicast stats for uplink representor (Huy Nguyen) [Orabug: 33519567] \n- net/mlx5: E-Switch, Protect changing mode while adding rules (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Do not reload ethernet ports when changing eswitch mode (Roi Dayan) [Orabug: 33519567] \n- net/mlx5: Move devlink port from mlx5e priv to mlx5e resources (Roi Dayan) [Orabug: 33519567] \n- net/mlx5: Move mlx5e hw resources into a sub object (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Move devlink port register and unregister calls (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Verify dev is present in some ndos (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Use nic mode netdev ndos and ethtool ops for uplink representor (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Add offload stats ndos to nic netdev ops (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Distinguish nic and esw offload in tc setup block cb (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Allow legacy vf ndos only if in legacy mode (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Same max num channels for both nic and uplink profiles (Saeed Mahameed) [Orabug: 33519567] \n- net: Change dev parameter to const in netif_device_present() (Roi Dayan) [Orabug: 33519567] \n- net/mlx5: Cleanup prototype warning (Saeed Mahameed) [Orabug: 33519567] \n- net/mxl5e: Add change profile method (Saeed Mahameed) [Orabug: 33519567] \n- net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled (Maor Dickman) [Orabug: 33519567] \n- net/tls: Fix wrong record sn in async mode of device resync (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Fix multicast counter not up-to-date in 'ip -s' (Ron Diskin) [Orabug: 33519567] \n- net/mlx5e: Add support for PCI relaxed ordering (Aya Levin) [Orabug: 33519567] \n- net/mlx5e: Move exposure of datapath function to txrx header (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: RX, Re-work initializaiton of RX function pointers (Tariq Toukan) [Orabug: 33519567] \n- RDMA/mlx5: ConnectX-7 new capabilities to set relaxed ordering by UMR (Meir Lichtinger) [Orabug: 33519567] \n- net/mlx5e: IPsec: Add Connect-X IPsec Rx data path offload (Raed Salem) [Orabug: 33519567] \n- net/mlx5e: Fix usage of rcu-protected pointer (Vlad Buslov) [Orabug: 33519567] \n- net/mlx5e: Move RQ helpers to txrx.h (Aya Levin) [Orabug: 33519567] \n- net/mlx5e: Remove redundant RQ state query (Aya Levin) [Orabug: 33519567] \n- net/mlx5e: Change reporters create functions to return void (Eran Ben Elisha) [Orabug: 33519567] \n- net/tls: fix sign extension issue when left shifting u16 value (Colin Ian King) [Orabug: 33519567] \n- net/mlx5e: kTLS, Improve rx handler function call (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Add kTLS RX stats (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Add kTLS RX resync support (Tariq Toukan) [Orabug: 33519567] \n- net/tls: Add asynchronous resync (Boris Pismenny) [Orabug: 33519567] \n- Revert 'net/tls: Add force_resync for driver resync' (Boris Pismenny) [Orabug: 33519567] \n- net/mlx5e: kTLS, Add kTLS RX HW offload support (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Improve TLS feature modularity (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Accel, Expose flow steering API for rules add/del (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Receive flow steering framework for accelerated TCP flows (Boris Pismenny) [Orabug: 33519567] \n- net/mlx5e: API to manipulate TTC rules destinations (Saeed Mahameed) [Orabug: 33519567] \n- net/mlx5e: Turn XSK ICOSQ into a general asynchronous one (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5: kTLS, Improve TLS params layout structures (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Support tc block sharing for representors (Vu Pham) [Orabug: 33519567] \n- net/tls: Add force_resync for driver resync (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Calculate SQ stop room in a robust way (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: IPoIB, Enable loopback packets for IPoIB interfaces (Erez Shitrit) [Orabug: 33519567] \n- net/mlx5e: Enhance ICOSQ WQE info fields (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Use struct assignment for WQE info updates (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Take TX WQE info structures out of general EN header (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Do not fill edge for the DUMP WQEs in TX flow (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Fill work queue edge separately in TX flow (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Split TX acceleration offloads into two phases (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Update UDP fields of the SKB for GSO first (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Make TLS offload independent of wqe and pi (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Pass only eseg to IPSEC offload (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Return void from mlx5e_sq_xmit and mlx5i_sq_xmit (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Unify checks of TLS offloads (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Return bool from TLS and IPSEC offloads (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Unify reserving space for WQEs (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Rename ICOSQ WQE info struct and field (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Fetch WQE: reuse code and enforce typing (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: TX, Generalise code and usage of error CQE dump (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5: Introduce TLS RX offload hardware bits (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5: Update transobj.c new cmd interface (Leon Romanovsky) [Orabug: 33519567] \n- net/mlx5e: en_accel, Add missing net/geneve.h include (Raed Salem) [Orabug: 33519567] \n- net/mlx5e: Show/set Rx network flow classification rules on ul rep (Vlad Buslov) [Orabug: 33519567] \n- net/mlx5e: Show/set Rx flow indir table and RSS hash key on ul rep (Vlad Buslov) [Orabug: 33519567] \n- mlx5: reject unsupported coalescing params (Jakub Kicinski) [Orabug: 33519567] \n- net/mlx5e: RX, Use indirect calls wrapper for posting descriptors (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Replace zero-length array with flexible-array member (Gustavo A. R. Silva) [Orabug: 33519567] \n- net/mlx5e: TX, Error completion is for last WQE in batch (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5: Expose relaxed ordering bits (Michael Guralnik) [Orabug: 33519567] \n- net/mlx5e: TX, Dump WQs wqe descriptors on CQE with error events (Saeed Mahameed) [Orabug: 33519567]\n[5.4.17-2136.305.1]\n- btrfs: fix metadata reservation for fallocate that leads to transaction aborts (Filipe Manana) [Orabug: 32675999] \n- btrfs: inode: refactor the parameters of insert_reserved_file_extent() (Qu Wenruo) [Orabug: 32675999] \n- uek-rpm: Enable QAT 4XXX device (Thomas Tai) [Orabug: 33440215] \n- crypto: qat - power up 4xxx device (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - fix naming of PF/VF enable functions (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - complete all the init steps before service notification (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - move IO virtualization functions (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - rename compatibility version definition (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - enable interrupts only after ISR allocation (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - simplify code and axe the use of a deprecated API (Christophe JAILLET) [Orabug: 33440215] \n- crypto: qat - enable detection of accelerators hang (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - configure arbiter mapping based on engines enabled (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - replace CRYPTO_AES with CRYPTO_LIB_AES in Kconfig (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add CRYPTO_AES to Kconfig dependencies (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add capability detection logic in qat_4xxx (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add AES-XTS support for QAT GEN4 devices (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add AES-CTR support for QAT GEN4 devices (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add qat_4xxx driver (Thomas Tai) [Orabug: 33440215] \n- crypto: qat - add hook to initialize vector routing table (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - target fw images to specific AEs (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - add gen4 firmware loader (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add support for broadcasting mode (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add support for shared ustore (Jack Xu) [Orabug: 33440215] \n- crypto: qat - allow to target specific AEs (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add FCU CSRs to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add CSS3K support (Jack Xu) [Orabug: 33440215] \n- crypto: qat - use ae_mask (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add misc control CSR to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add wake up event to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add clock enable CSR to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add reset CSR and mask to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add local memory size to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add support for lm2 and lm3 (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add next neighbor to chip_info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - introduce chip info structure (Jack Xu) [Orabug: 33440215] \n- crypto: qat - refactor long expressions (Jack Xu) [Orabug: 33440215] \n- crypto: qat - refactor qat_uclo_set_ae_mode() (Jack Xu) [Orabug: 33440215] \n- crypto: qat - move defines to header files (Jack Xu) [Orabug: 33440215] \n- crypto: qat - remove global CSRs helpers (Jack Xu) [Orabug: 33440215] \n- crypto: qat - refactor AE start (Jack Xu) [Orabug: 33440215] \n- crypto: qat - rename qat_uclo_del_uof_obj() (Jack Xu) [Orabug: 33440215] \n- crypto: qat - remove unnecessary parenthesis (Jack Xu) [Orabug: 33440215] \n- crypto: qat - support for mof format in fw loader (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - allow for instances in different banks (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - refactor qat_crypto_dev_config() (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - refactor qat_crypto_create_instances() (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - remove unnecessary void* casts (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - call functions in adf_sriov if available (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - abstract writes to arbiter enable (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - use BIT_ULL() - 1 pattern for masks (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - replace constant masks with GENMASK (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - abstract build ring base (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - enable ring after pair is programmed (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - register crypto instances based on capability (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - add support for capability detection (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - abstract arbiter access (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - remove unused macros in arbiter module (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - remove writes into WQCFG (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - update constants table (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - use admin mask to send fw constants (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - change admin sequence (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - rename ME in AE (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - add packed to init admin structures (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - abstract admin interface (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - relocate GEN2 CSR access code (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - split transport CSR access logic (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - fix configuration of iov threads (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - num_rings_per_bank is device dependent (Ahsan Atta) [Orabug: 33440215] \n- crypto: qat - mask device capabilities with soft straps (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - update IV in software (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - drop input parameter from adf_enable_aer() (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - replace device ids defines (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - add delay before polling mailbox (Giovanni Cabiddu) [Orabug: 33440215] \n- PCI: Add Intel QuickAssist device IDs (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - fallback for xts with 192 bit keys (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - remove unused field in skcipher ctx (Thomas Tai) [Orabug: 33440215] \n- crypto: qat - validate xts key (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - allow xts requests not multiple of block (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - update timeout logic in put admin msg (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - send admin messages to set of AEs (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - update fw init admin msg (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - replace user types with kernel ABI __u types (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - replace user types with kernel u types (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - convert to SPDX License Identifiers (Giovanni Cabiddu) [Orabug: 33440215] \n- iopoll: introduce read_poll_timeout macro (Dejin Zheng) [Orabug: 33440215] \n- crypto: qat - simplify the qat_crypto function (Tianjia Zhang) [Orabug: 33440215] \n- crypto: qat - switch to skcipher API (Ard Biesheuvel) [Orabug: 33440215] \n- io_uring: fix false WARN_ONCE (Pavel Begunkov) [Orabug: 33731046] \n- scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix link down processing to address NULL pointer dereference (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Allow PLOGI retry if previous PLOGI was aborted (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Revert LOG_TRACE_EVENT back to LOG_INIT prior to driver_resource_setup() (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix memory overwrite during FC-GS I/O abort handling (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Add support for optional PLDV handling (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix mailbox command failure during driver initialization (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Improve PBDE checks during SGL processing (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix FCP I/O flush functionality for TMF routines (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix NVMe I/O failover to non-optimized path (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Don't remove ndlp on PRLI errors in P2P mode (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix rediscovery of tape device after LIP (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (Ewan D. Milne) [Orabug: 33731165] \n- scsi: lpfc: Fix possible ABBA deadlock in nvmet_xri_aborted() (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Revise Topology and RAS support checks for new adapters (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Copyright updates for 12.8.0.11 patches (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Update lpfc version to 12.8.0.11 (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Skip issuing ADISC when node is in NPR state (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Call discovery state machine when handling PLOGI/ADISC completions (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Delay unregistering from transport until GIDFT or ADISC completes (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Clear outstanding active mailbox during PCI function reset (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix target reset handler from falsely returning FAILURE (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Discovery state machine fixes for LOGO handling (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Remove use of kmalloc() in trace event logging (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix failure to transmit ABTS on FC link (James Smart) [Orabug: 33731165] \n- bpf: Disallow unprivileged bpf by default (Pawan Gupta) [Orabug: 33734681] \n- bpf: Add kconfig knob for disabling unpriv bpf by default (Daniel Borkmann) [Orabug: 33734681] \n- USB: gadget: bRequestType is a bitfield, not a enum (Greg Kroah-Hartman) [Orabug: 33739525] {CVE-2021-39685}\n- USB: gadget: zero allocate endpoint 0 buffers (Greg Kroah-Hartman) [Orabug: 33739525] {CVE-2021-39685}\n- USB: gadget: detect too-big endpoint 0 requests (Greg Kroah-Hartman) [Orabug: 33739525] {CVE-2021-39685}\n- scsi: vmw_pvscsi: Set residual data length conditionally (Alexey Makhalov) [Orabug: 33761343] \n- hwmon: (k10temp) Add support for Zen3 CPUs (Rahul Rohit) [Orabug: 33782833] \n- Revert 'rds/ib: Kernel upgrade to rds_ib_conns info displayed by rds-info' (Rohit Nair) [Orabug: 33812555] \n- uek-rpm: Add missing dax modules to kernel-ueknano (Somasundaram Krishnasamy) [Orabug: 33821042] \n- cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33825687] {CVE-2022-0492}", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-03-23T00:00:00", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel-container security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26401", "CVE-2021-3653", "CVE-2021-3656", "CVE-2021-39685", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0847", "CVE-2022-23960", "CVE-2022-25636"], "modified": "2022-03-23T00:00:00", "id": "ELSA-2022-9245", "href": "http://linux.oracle.com/errata/ELSA-2022-9245.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-04-07T21:33:45", "description": "[5.4.17-2136.305.5.3]\n- bpf: fix out-of-tree module build (Alan Maguire) [Orabug: 33973548] \n- ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33973543] \n- Revert 'btrfs: inode: refactor the parameters of insert_reserved_file_extent()' (Srikanth C S) [Orabug: 33973491] \n- Revert 'btrfs: fix metadata reservation for fallocate that leads to transaction aborts' (Srikanth C S) [Orabug: 33973491]\n[5.4.17-2136.305.5.2]\n- lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33942325] {CVE-2022-0847}\n[5.4.17-2136.305.5.1]\n- arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33937423] {CVE-2022-23960} \n- KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Mitigate spectre style branch history side channels (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- KVM: arm64: Add templates for BHB mitigation sequences (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Add part number for Arm Cortex-A77 (Rob Herring) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: Add percpu vectors for EL1 (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Move trampoline macros out of ifdef'd section (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Move the trampoline data page before the text page (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Free up another register on kpti's tramp_exit path (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry: Make the trampoline cleanup optional (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- arm64: entry.S: Add ventry overflow sanity checks (James Morse) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King) [Orabug: 33937423] {CVE-2022-23960} \n- x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) [Orabug: 33937344] {CVE-2021-26401}\n- Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: The choice of retpoline mode is sometimes ignored (Patrick Colp) [Orabug: 33937389] \n- x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp) [Orabug: 33937344] {CVE-2021-26401}\n- x86/speculation: Fix bug in retpoline mode on AMD with (Patrick Colp) [Orabug: 33937344] {CVE-2021-26401}\n[5.4.17-2136.305.5]\n- netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso) [Orabug: 33900416] {CVE-2022-25636}\n[5.4.17-2136.305.4]\n- net/mlx5e: Fix page DMA map/unmap attributes (Aya Levin) [Orabug: 33382242] \n- DMA/rxe: Update default value of RXE_MAX_PDN (Rao Shoaib) [Orabug: 33676597] \n- uek-rpm: enable VIRTIO_PCI_LIB_LEGACY config (Si-Wei Liu) [Orabug: 33749636] \n- vdpa/mlx5: Fix tracking of current number of VQs (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Fix is_index_valid() to refer to features (Eli Cohen) [Orabug: 33749636] \n- vdpa: Protect vdpa reset with cf_mutex (Eli Cohen) [Orabug: 33749636] \n- vdpa: Avoid taking cf_mutex lock on get status (Eli Cohen) [Orabug: 33749636] \n- vdpa/vdpa_sim_net: Report max device capabilities (Eli Cohen) [Orabug: 33749636] \n- vdpa: Use BIT_ULL for bit operations (Eli Cohen) [Orabug: 33749636] \n- vdpa/vdpa_sim: Configure max supported virtqueues (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Report max device capabilities (Eli Cohen) [Orabug: 33749636] \n- vdpa: Support reporting max device capabilities (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps() (Eli Cohen) [Orabug: 33749636] \n- vdpa: Add support for returning device configuration information (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Support configuring max data virtqueue (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Fix config_attr_mask assignment (Eli Cohen) [Orabug: 33749636] \n- vdpa: Allow to configure max data virtqueues (Eli Cohen) [Orabug: 33749636] \n- vdpa: Read device configuration only if FEATURES_OK (Eli Cohen) [Orabug: 33749636] \n- vdpa: Sync calls set/get config/status with cf_mutex (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Distribute RX virtqueues in RQT object (Eli Cohen) [Orabug: 33749636] \n- vdpa: Provide interface to read driver features (Eli Cohen) [Orabug: 33749636] \n- vdpa: clean up get_config_size ret value handling (Laura Abbott) [Orabug: 33749636] \n- vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 (Eli Cohen) [Orabug: 33749636] \n- virtio/virtio_pci_legacy_dev: ensure the correct return value (Peng Hao) [Orabug: 33749636] \n- virtio: fix a typo in function 'vp_modern_remove' comments. (Dapeng Mi) [Orabug: 33749636] \n- virtio-pci: fix the confusing error message [Orabug: 33749636] \n- vdpa: Mark vdpa_config_ops.get_vq_notification as optional (Eugenio Perez) [Orabug: 33749636] \n- vdpa: Avoid duplicate call to vp_vdpa get_status (Eugenio Perez) [Orabug: 33749636] \n- net/mlx5_vdpa: Offer VIRTIO_NET_F_MTU when setting MTU (Eli Cohen) [Orabug: 33749636] \n- vdpa: add driver_override support (Stefano Garzarella) [Orabug: 33749636] \n- docs: document sysfs ABI for vDPA bus (Stefano Garzarella) [Orabug: 33749636] \n- vdpa: Consider device id larger than 31 (Parav Pandit) [Orabug: 33749636] \n- virtio: always enter drivers/virtio/ (Arnd Bergmann) [Orabug: 33749636] \n- vdpa: check that offsets are within bounds (Dan Carpenter) [Orabug: 33749636] \n- vdpa_sim: avoid putting an uninitialized iova_domain (Longpeng) [Orabug: 33749636] \n- vhost-vdpa: clean irqs before reseting vdpa device (Wu Zongyong) [Orabug: 33749636] \n- vdpa/mlx5: Forward only packets with allowed MAC address (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Support configuration of MAC (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit (Parav Pandit) [Orabug: 33749636] \n- vdpa_sim_net: Enable user to set mac address and mtu (Parav Pandit) [Orabug: 33749636] \n- vdpa: Enable user to set mac and mtu of vdpa device (Parav Pandit) [Orabug: 33749636] \n- vdpa: Use kernel coding style for structure comments (Parav Pandit) [Orabug: 33749636] \n- vdpa: Introduce query of device config layout (Parav Pandit) [Orabug: 33749636] \n- vdpa: Introduce and use vdpa device get, set config helpers (Parav Pandit) [Orabug: 33749636] \n- vdpa/mlx5: Propagate link status from device to vdpa driver (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Rename control VQ workqueue to vdpa wq (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Remove mtu field from vdpa net device (Eli Cohen) [Orabug: 33749636] \n- vdpa: add new attribute VDPA_ATTR_DEV_MIN_VQ_SIZE (Wu Zongyong) [Orabug: 33749636] \n- virtio_vdpa: setup correct vq size with callbacks get_vq_num_{max,min} (Wu Zongyong) [Orabug: 33749636] \n- vdpa: min vq num of vdpa device cannot be greater than max vq num (Wu Zongyong) [Orabug: 33749636] \n- vdpa: add new callback get_vq_num_min in vdpa_config_ops (Wu Zongyong) [Orabug: 33749636] \n- vp_vdpa: add vq irq offloading support (Wu Zongyong) [Orabug: 33749636] \n- vdpa: fix typo (Wu Zongyong) [Orabug: 33749636] \n- virtio-pci: introduce legacy device module (Wu Zongyong) [Orabug: 33749636] \n- vhost-vdpa: Fix the wrong input in config_cb (Cindy Lu) [Orabug: 33749636] \n- vhost_vdpa: unset vq irq before freeing irq (Wu Zongyong) [Orabug: 33749636] \n- vdpa: potential uninitialized return in vhost_vdpa_va_map() (Dan Carpenter) [Orabug: 33749636] \n- vdpa/mlx5: Avoid executing set_vq_ready() if device is reset (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Clear ready indication for control VQ (Eli Cohen) [Orabug: 33749636] \n- vdpa: Support transferring virtual addressing during DMA mapping (Xie Yongji) [Orabug: 33749636] \n- vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap() (Xie Yongji) [Orabug: 33749636] \n- vdpa: Add an opaque pointer for vdpa_config_ops.dma_map() (Xie Yongji) [Orabug: 33749636] \n- vhost-iotlb: Add an opaque pointer for vhost IOTLB (Xie Yongji) [Orabug: 33749636] \n- vhost-vdpa: Handle the failure of vdpa_reset() (Xie Yongji) [Orabug: 33749636] \n- vdpa: Add reset callback in vdpa_config_ops (Xie Yongji) [Orabug: 33749636] \n- vdpa: Fix some coding style issues (Xie Yongji) [Orabug: 33749636] \n- vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro (Cai Huoqing) [Orabug: 33749636] \n- vdpa_sim: Use iova_shift() for the size passed to alloc_iova() (Xie Yongji) [Orabug: 33749636] \n- vdpa/mlx5: Add multiqueue support (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Add support for control VQ and MAC setting (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Ensure valid indices are provided (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Decouple virtqueue callback from struct mlx5_vdpa_virtqueue (Eli Cohen) [Orabug: 33749636] \n- Revert 'vdpa/mlx5: fix feature negotiation across device reset' (Si-Wei Liu) [Orabug: 33749636] \n- vdpa/mlx5: function prototype modifications in preparation to control VQ (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Remove redundant header file inclusion (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Fix queue type selection logic (Eli Cohen) [Orabug: 33749636] \n- vdpa/mlx5: Avoid destroying MR on empty iotlb (Eli Cohen) [Orabug: 33749636] \n- virtio_vdpa: reject invalid vq indices (Vincent Whitchurch) [Orabug: 33749636] \n- vdpa: Add documentation for vdpa_alloc_device() macro (Xie Yongji) [Orabug: 33749636] \n- vp_vdpa: Fix return value check for vdpa_alloc_device() (Xie Yongji) [Orabug: 33749636] \n- vdpa_sim: Fix return value check for vdpa_alloc_device() (Xie Yongji) [Orabug: 33749636] \n- vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() (Xie Yongji) [Orabug: 33749636] \n- xfs: remove incorrect ASSERT in xfs_rename (Eric Sandeen) [Orabug: 33803847] \n- KVM: nVMX: Filter out all unsupported controls when eVMCS was activated (Vitaly Kuznetsov) [Orabug: 33805849] \n- crypto: ccp - Add support for new CCP/PSP device ID (John Allen) [Orabug: 33805849] \n- KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU (Sean Christopherson) [Orabug: 33805849] \n- KVM: fix avic_set_running for preemptable kernels (Paolo Bonzini) [Orabug: 33805849] \n- KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES (Vitaly Kuznetsov) [Orabug: 33805849] \n- KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall (Vitaly Kuznetsov) [Orabug: 33805849] \n- KVM: x86: Swap order of CPUID entry 'index' vs. 'significant flag' checks (Sean Christopherson) [Orabug: 33805849] \n- KVM: x86: nSVM: don't copy virt_ext from vmcb12 (Maxim Levitsky) [Orabug: 33805849] {CVE-2021-3653} {CVE-2021-3656}\n- KVM: x86: nSVM: restore int_vector in svm_clear_vintr (Maxim Levitsky) [Orabug: 33805849] \n- KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() (Vitaly Kuznetsov) [Orabug: 33805849] \n- KVM: x86: Mark all registers as avail/dirty at vCPU creation (Sean Christopherson) [Orabug: 33805849] \n- KVM: nVMX: Sync all PGDs on nested transition with shadow paging (Sean Christopherson) [Orabug: 33805849] \n- KVM: SVM: Revert clearing of C-bit on GPA in #NPF handler (Sean Christopherson) [Orabug: 33805849] \n- KVM: SVM: Don't strip the C-bit from CR2 on #PF interception (Sean Christopherson) [Orabug: 33805849] \n- rds/ib: Kernel change to extend rds-info functionality (Rohit Nair) [Orabug: 33821340] \n- nvmet-tcp: fix a race condition between release_queue and io_work (Maurizio Lombardi) [Orabug: 33825776] \n- nvmet-tcp: add an helper to free the cmd buffers (Maurizio Lombardi) [Orabug: 33825776] \n- drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin) [Orabug: 33835810] {CVE-2022-0330}\n- rds: ib: Make selection of completion_vector QoS aware (Hakon Bugge) [Orabug: 33845918] \n- tipc: improve size validations for received domain records (Jon Maloy) [Orabug: 33850801] {CVE-2022-0435} {CVE-2022-0435}\n- uek-rpm: Synchronize Module.kabi and lockedlist (Stephen Brennan) [Orabug: 33871538]\n[5.4.17-2136.305.3]\n- net/mlx5: Enable mlx5 IPsec build options on OL7/OL8 (Qing Huang) [Orabug: 32936614] \n- net/mlx5e: Fix SWP offsets when vlan inserted by driver (Moshe Shemesh) [Orabug: 32936614] \n- net/mlx5e: Fix missing IPsec statistics on uplink representor (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: Add IPsec support to uplink representor (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Fix checksum issue of VXLAN and IPsec crypto offload (Huy Nguyen) [Orabug: 32936614] \n- net/xfrm: Add inner_ipproto into sec_path (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: Optimize mlx5e_feature_checks for non IPsec packet (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: Replace spaces with tab at the start of a line (Wenpeng Liang) [Orabug: 32936614] \n- net/mlx5e: Enable XDP for Connect-X IPsec capable devices (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: Enable striding RQ for Connect-X IPsec capable devices (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: Release skb in case of failure in tc update skb (Maor Dickman) [Orabug: 32936614] \n- net/mlx5e: Move set vxlan nic info to profile init (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Fix IPSEC stats (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: IPsec, Remove unnecessary config flag usage (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: IPsec, Inline feature_check fast-path function (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: IPsec, Avoid unreachable return (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: IPsec, Enclose csum logic under ipsec config (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: Split between RX/TX tunnel FW support indication (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Allow RQ outside of channel context (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Allow CQ outside of channel context (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Free drop RQ in a dedicated function (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: kTLS, Enforce HW TX csum offload with kTLS (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5: Expose IP-in-IP TX and RX capability bits (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Fix IPsec packet drop by mlx5e_tc_update_skb (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5e: Set IPsec WAs only in IP's non checksum partial case. (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5e: IPsec: Add Connect-X IPsec Tx data path offload (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: IPsec: Add TX steering rule per IPsec state (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: Add NIC TX domain namespace (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5e: Add tc chains offload support for nic flows (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5: Refactor tc flow attributes structure (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5e: Split nic tc flow allocation and creation (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5e: Tc nic flows to use mlx5_chains flow tables (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5: Refactor multi chains and prios support (Ariel Levkovich) [Orabug: 32936614] \n- net/mlx5e: Enhanced TX MPWQE for SKBs (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Move TX code into functions to be used by MPWQE (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Rename xmit-related structs to generalize them (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Generalize TX MPWQE checks for full session (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Support multiple SKBs in a TX WQE (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Move the TLS resync check out of the function (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Unify constants for WQE_EMPTY_DS_COUNT (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Small improvements for XDP TX MPWQE logic (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Refactor xmit functions (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Move mlx5e_tx_wqe_inline_mode to en_tx.c (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Use struct assignment to initialize mlx5e_tx_wqe_info (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Refactor inline header size calculation in the TX path (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Fix endianness when calculating pedit mask first bit (Maor Dickman) [Orabug: 32936614] \n- net/mlx5e: CT: Fix freeing ct_label mapping (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Fix memory leak of tunnel info when rule under multipath not ready (Jianbo Liu) [Orabug: 32936614] \n- net/mlx5e: Use synchronize_rcu to sync with NAPI (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Use RCU to protect rq->xdp_prog (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: RX, Add a prefetch command for small L1_CACHE_BYTES (Tariq Toukan) [Orabug: 32936614] \n- net: Take common prefetch code structure into a function (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: Use indirect call wrappers for RX post WQEs functions (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: CT: Map 128 bits labels to 32 bit map ID (Eli Britstein) [Orabug: 32936614] \n- net/mlx5e: XDP, Avoid indirect call in TX flow (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: IPsec: Add Connect-X IPsec ESN update offload support (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: IPsec: Add IPsec steering in local NIC RX (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: Add IPsec related Flow steering entry's fields (Huy Nguyen) [Orabug: 32936614] \n- net/mlx5: IPsec: Add HW crypto offload support (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Accel, Add core IPsec support for the Connect-X family (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: Fix build break when CONFIG_XPS is not set (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: CT: Fix releasing ft entries (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: CT: Remove unused function param (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: CT: Return err_ptr from internal functions (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: CT: Use mapping for zone restore register (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Re-use tuple modify headers for identical modify actions (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: Export sharing of mod headers to a new file (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Restore ct state from lookup in zone instead of tupleid (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Don't offload tuple rewrites for established tuples (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: Use netdev_info instead of pr_info (Oz Shlomo) [Orabug: 32936614] \n- net/mlx5e: CT: Allow header rewrite of 5-tuple and ct clear action (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Save ct entries tuples in hashtables (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: Fix VXLAN configuration restore after function reload (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Enhance TX timeout recovery (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Enhance ICOSQ data on RX reporter's diagnose (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Add EQ info to TX/RX reporter's diagnose (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Rename reporter's helpers (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Add helper to get the RQ WQE counter (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Add helper to get RQ WQE's head (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Align RX/TX reporters diagnose output format (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Refactor build channel params (Tariq Toukan) [Orabug: 32936614] \n- net/mlx5e: vxlan: Use RCU for vxlan table lookup (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: Move TC-specific function definitions into MLX5_CLS_ACT (Vlad Buslov) [Orabug: 32936614] \n- net/mlx5e: CT: Fix ipv6 nat header rewrite actions (Oz Shlomo) [Orabug: 32936614] \n- net/mlx5e: en_tc: Fix cast to restricted __be32 warning (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: Don't use err uninitialized in mlx5e_attach_decap (Nathan Chancellor) [Orabug: 32936614] \n- net/mlx5e: Optimize performance for IPv4/IPv6 ethertype (Eli Britstein) [Orabug: 32936614] \n- net/mlx5e: Helper function to set ethertype (Eli Britstein) [Orabug: 32936614] \n- net/mlx5e: CT: Correctly get flow rule (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Support pedit on mpls over UDP decap (Eli Cohen) [Orabug: 32936614] \n- xsk: Fix xsk_umem_xdp_frame_sz() (Bjorn Topel) [Orabug: 32936614] \n- net/mlx5e: CT: Fix offload with CT action after CT NAT action (Roi Dayan) [Orabug: 32936614] \n- mlx5: Rx queue setup time determine frame_sz for XDP (Jesper Dangaard Brouer) [Orabug: 32936614] \n- xdp: For Intel AF_XDP drivers add XDP frame_sz (Jesper Dangaard Brouer) [Orabug: 32936614] \n- xdp: Add frame size to xdp_buff (Jesper Dangaard Brouer) [Orabug: 32936614] \n- net: remove newlines in NL_SET_ERR_MSG_MOD (Jacob Keller) [Orabug: 32936614] \n- net/mlx5: CT: Remove unused variables (Paul Blakey) [Orabug: 32936614] \n- net/mlx5e: CT: Avoid false warning about rule may be used uninitialized (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Remove unneeded semicolon (Zheng Bin) [Orabug: 32936614] \n- net/mlx5: IPsec, Fix coverity issue (Raed Salem) [Orabug: 32936614] \n- net/mlx5: TX WQE Add trailer insertion field (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Introduce IPsec Connect-X offload hardware bits and structures (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Update vxlan.c new cmd interface (Leon Romanovsky) [Orabug: 32936614] \n- net/mlx5: Update cq.c to new cmd interface (Leon Romanovsky) [Orabug: 32936614] \n- net/mlx5: CT: Change idr to xarray to protect parallel tuple id allocation (Paul Blakey) [Orabug: 32936614] \n- net/mlx5: IPsec, Refactor SA handle creation and destruction (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: IPSec, Expose IPsec HW stat only for supporting HW (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Refactor mlx5_accel_esp_create_hw_context parameter list (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Use the correct IPsec capability function for FPGA ops (Raed Salem) [Orabug: 32936614] \n- net/mlx5e: CT: Use rhashtable's ct entries instead of a separate list (Paul Blakey) [Orabug: 32936614] \n- net/mlx5: Add support for RDMA TX steering (Michael Guralnik) [Orabug: 32936614] \n- net/mlx5e: Fix actions_match_supported() return (Dan Carpenter) [Orabug: 32936614] \n- net/mlx5: Eswitch, enable forwarding back to uplink port (Eli Cohen) [Orabug: 32936614] \n- net/mlx5e: Add support for offloading traffic from uplink to uplink (Eli Cohen) [Orabug: 32936614] \n- net/mlx5e: Fix rejecting all egress rules not on vlan (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: CT: Fix stack usage compiler warning (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: CT: remove set but not used variable 'unnew' (YueHaibing) [Orabug: 32936614] \n- net/mlx5e: Fix an IS_ERR() vs NULL check (Dan Carpenter) [Orabug: 32936614] \n- net/mlx5: Introduce TLS and IPSec objects enums (Saeed Mahameed) [Orabug: 32936614] \n- net/mlx5e: Fix endianness handling in pedit mask (Sebastian Hense) [Orabug: 32936614] \n- net/mlx5e: Remove redundant comment about goto slow path (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Reduce number of arguments in slow path handling (Eli Cohen) [Orabug: 32936614] \n- net/mlx5e: Use netdev_warn() instead of pr_err() for errors (Roi Dayan) [Orabug: 32936614] \n- net/mlx5e: Add devlink fdb_large_groups parameter (Jianbo Liu) [Orabug: 32936614] \n- net/mlx5: Change the name of steering mode param id (Jianbo Liu) [Orabug: 32936614] \n- net/mlx5: Eswitch, avoid redundant mask (Eli Cohen) [Orabug: 32936614] \n- net/mlx5: Fix header guard in rsc_dump.h (Nathan Chancellor) [Orabug: 32936614] \n- net/mlx5e: Add context to the preactivate hook (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Allow mlx5e_switch_priv_channels to fail and recover (Maxim Mikityanskiy) [Orabug: 32936614] \n- net/mlx5e: Remove unneeded netif_set_real_num_tx_queues (Maxim Mikityanskiy) [Orabug: 32936614] \n- ESP: Export esp_output_fill_trailer function (Raed Salem) [Orabug: 32936614] \n- net/mlx5: Remove a useless 'drain_workqueue()' call in 'mlx5e_ipsec_cleanup()' (Christophe JAILLET) [Orabug: 32936614] \n- mlx5: Use proper logging and tracing line terminations (Joe Perches) [Orabug: 32936614] \n- net/mlx5e: Support dump callback in RX reporter (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Support dump callback in TX reporter (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Gather reporters APIs together (Aya Levin) [Orabug: 32936614] \n- net/mlx5: Add support for resource dump (Aya Levin) [Orabug: 32936614] \n- net/mlx5e: Create q counters on uplink representors (Vlad Buslov) [Orabug: 32936614] \n- net/mlx5: Expose resource dump register mapping (Aya Levin) [Orabug: 32936614] \n- net/mlx5: Add structures and defines for MIRC register (Eran Ben Elisha) [Orabug: 32936614] \n- net/mlx5: WQ, Move short getters into header file (Tariq Toukan) [Orabug: 32936614] \n- Revert 'net/mlx5e: Fix SWP offsets when vlan inserted by driver' (Mikhael Goikhman) [Orabug: 32936614] \n- uek-rpm: ensure BPF Type Format (BTF) section is retained in modules (Alan Maguire) [Orabug: 33774133] \n- kbuild: Skip module BTF generation for out-of-tree external modules (Andrii Nakryiko) [Orabug: 33774133] \n- bpf: Load and verify kernel module BTFs (Andrii Nakryiko) [Orabug: 33774133] \n- kbuild: Build kernel module BTFs if BTF is enabled and pahole supports it (Andrii Nakryiko) [Orabug: 33774133] \n- arm64: Add assembly annotations for weak-PI-alias madness (Robin Murphy) [Orabug: 33816089] \n- arm64: Import updated version of Cortex Strings' strlen (Sam Tebbs) [Orabug: 33816089] \n- arm64: Import latest memcpy()/memmove() implementation (Robin Murphy) [Orabug: 33816089] \n- arm64: Import latest version of Cortex Strings' memcmp (Sam Tebbs) [Orabug: 33816089] \n- arm64: Better optimised memchr() (Robin Murphy) [Orabug: 33816089] \n- net/rds: Fix memory leak in __rds_conn_create() on alloc_ordered_workqueue fail (Freddy Carrillo) [Orabug: 33821540] \n- x86/smpboot: check cpu_initialized_mask first after returning from schedule() (Dongli Zhang) [Orabug: 33825645] \n- uek-rpm/ol/config-aarch64: Enable CONFIG_ARM_RASPBERRYPI_CPUFREQ for RPi (Vijay Kumar) \n- KVM: x86: Initialize tdp_level during vCPU creation (Sean Christopherson) [Orabug: 33841857] \n- KVM: x86/mmu: Capture TDP level when updating CPUID (Sean Christopherson) [Orabug: 33841857] \n- xen/netback: don't queue unlimited number of packages (Juergen Gross) [Orabug: 33851834] \n- xen/netback: fix rx queue stall detection (Juergen Gross) [Orabug: 33851834] \n- Fix conflict of LTS commit 'PCI: aardvark: Configure PCIe resources from 'ranges' DT property' (Sherry Yang) [Orabug: 33862617]\n[5.4.17-2136.305.2]\n- LTS tag: v5.4.163 (Sherry Yang) \n- tty: hvc: replace BUG_ON() with negative return value (Juergen Gross) \n- xen/netfront: don't trust the backend response data blindly (Juergen Gross) \n- xen/netfront: disentangle tx_skb_freelist (Juergen Gross) \n- xen/netfront: don't read data from request on the ring page (Juergen Gross) \n- xen/netfront: read response from backend only once (Juergen Gross) \n- xen/blkfront: don't trust the backend response data blindly (Juergen Gross) \n- xen/blkfront: don't take local copy of a request from the ring page (Juergen Gross) \n- xen/blkfront: read response from backend only once (Juergen Gross) \n- xen: sync include/xen/interface/io/ring.h with Xen's newest version (Juergen Gross) \n- fuse: release pipe buf after last use (Miklos Szeredi) \n- NFC: add NCI_UNREG flag to eliminate the race (Lin Ma) \n- shm: extend forced shm destroy to support objects from several IPC nses (Alexander Mikhalitsyn) \n- s390/mm: validate VMA in PGSTE manipulation functions (David Hildenbrand) \n- tracing: Check pid filtering when creating events (Steven Rostedt (VMware)) \n- vhost/vsock: fix incorrect used length reported to the guest (Stefano Garzarella) \n- smb3: do not error on fsync when readonly (Steve French) \n- f2fs: set SBI_NEED_FSCK flag when inconsistent node block found (Weichao Guo) \n- net: mscc: ocelot: correctly report the timestamping RX filters in ethtool (Vladimir Oltean) \n- net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP (Vladimir Oltean) \n- net: hns3: fix VF RSS failed problem after PF enable multi-TCs (Guangbin Huang) \n- net/smc: Don't call clcsock shutdown twice when smc shutdown (Tony Lu) \n- net: vlan: fix underflow for the real_dev refcnt (Ziyang Xuan) \n- MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 (Huang Pei) \n- igb: fix netpoll exit with traffic (Jesse Brandeburg) \n- nvmet: use IOCB_NOWAIT only if the filesystem supports it (Maurizio Lombardi) \n- tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows (Eric Dumazet) \n- PM: hibernate: use correct mode for swsusp_close() (Thomas Zeitlhofer) \n- net/ncsi : Add payload to be 32-bit aligned to fix dropped packets (Kumar Thangavel) \n- nvmet-tcp: fix incomplete data digest send (Varun Prakash) \n- net/smc: Ensure the active closing peer first closes clcsock (Tony Lu) \n- scsi: core: sysfs: Fix setting device state to SDEV_RUNNING (Mike Christie) \n- net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group (Nikolay Aleksandrov) \n- net: ipv6: add fib6_nh_release_dsts stub (Nikolay Aleksandrov) \n- nfp: checking parameter process for rx-usecs/tx-usecs is invalid (Diana Wang) \n- ipv6: fix typos in __ip6_finish_output() (Eric Dumazet) \n- iavf: Prevent changing static ITR values if adaptive moderation is on (Nitesh B Venkatesh) \n- drm/vc4: fix error code in vc4_create_object() (Dan Carpenter) \n- scsi: mpt3sas: Fix kernel panic during drive powercycle test (Sreekanth Reddy) \n- ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (Takashi Iwai) \n- NFSv42: Don't fail clone() unless the OP_CLONE operation failed (Trond Myklebust) \n- firmware: arm_scmi: pm: Propagate return value to caller (Peng Fan) \n- net: ieee802154: handle iftypes as u32 (Alexander Aring) \n- ASoC: topology: Add missing rwsem around snd_ctl_remove() calls (Takashi Iwai) \n- ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer (Srinivas Kandagatla) \n- ARM: dts: BCM5301X: Add interrupt properties to GPIO node (Florian Fainelli) \n- ARM: dts: BCM5301X: Fix I2C controller interrupt (Florian Fainelli) \n- netfilter: ipvs: Fix reuse connection if RS weight is 0 (yangxingwu) \n- proc/vmcore: fix clearing user buffer by properly using clear_user() (David Hildenbrand) \n- arm64: dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function (Marek Behun) \n- pinctrl: armada-37xx: Correct PWM pins definitions (Marek Behun) \n- PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge (Pali Rohar) \n- PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge (Pali Rohar) \n- PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge (Pali Rohar) \n- PCI: aardvark: Fix link training (Pali Rohar) \n- PCI: aardvark: Simplify initialization of rootcap on virtual bridge (Pali Rohar) \n- PCI: aardvark: Implement re-issuing config requests on CRS response (Pali Rohar) \n- PCI: aardvark: Fix PCIe Max Payload Size setting (Pali Rohar) \n- PCI: aardvark: Configure PCIe resources from 'ranges' DT property (Pali Rohar) \n- PCI: pci-bridge-emul: Fix array overruns, improve safety (Russell King) \n- PCI: aardvark: Update comment about disabling link training (Pali Rohar) \n- PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link() (Pali Rohar) \n- PCI: aardvark: Fix compilation on s390 (Pali Rohar) \n- PCI: aardvark: Don't touch PCIe registers if no card connected (Pali Rohar) \n- PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros (Pali Rohar) \n- PCI: aardvark: Issue PERST via GPIO (Pali Rohar) \n- PCI: aardvark: Improve link training (Marek Behun) \n- PCI: aardvark: Train link immediately after enabling training (Pali Rohar) \n- PCI: aardvark: Fix big endian support (Grzegorz Jaszczyk) \n- PCI: aardvark: Wait for endpoint to be ready before training link (Remi Pommarel) \n- PCI: aardvark: Deduplicate code in advk_pcie_rd_conf() (Marek Behun) \n- mdio: aspeed: Fix 'Link is Down' issue (Dylan Hung) \n- mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB (Adrian Hunter) \n- tracing: Fix pid filtering when triggers are attached (Steven Rostedt (VMware)) \n- tracing/uprobe: Fix uprobe_perf_open probes iteration (Jiri Olsa) \n- KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB (Nicholas Piggin) \n- xen: detect uninitialized xenbus in xenbus_init (Stefano Stabellini) \n- xen: don't continue xenstore initialization in case of errors (Stefano Stabellini) \n- staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (Dan Carpenter) \n- staging/fbtft: Fix backlight (Noralf Tronnes) \n- HID: wacom: Use 'Confidence' flag to prevent reporting invalid contacts (Jason Gerecke) \n- Revert 'parisc: Fix backtrace to always include init funtion names' (Helge Deller) \n- media: cec: copy sequence field for the reply (Hans Verkuil) \n- ALSA: ctxfi: Fix out-of-range access (Takashi Iwai) \n- binder: fix test regression due to sender_euid change (Todd Kjos) \n- usb: hub: Fix locking issues with address0_mutex (Mathias Nyman) \n- usb: hub: Fix usb enumeration issue due to address0 race (Mathias Nyman) \n- usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts (Ondrej Jirman) \n- net: nexthop: fix null pointer dereference when IPv6 is not enabled (Nikolay Aleksandrov) \n- usb: dwc2: hcd_queue: Fix use of floating point literal (Nathan Chancellor) \n- usb: dwc2: gadget: Fix ISOC flow for elapsed frames (Minas Harutyunyan) \n- USB: serial: option: add Fibocom FM101-GL variants (Mingjie Zhang) \n- USB: serial: option: add Telit LE910S1 0x9200 composition (Daniele Palmas) \n- LTS tag: v5.4.162 (Sherry Yang) \n- ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (Pierre-Louis Bossart) \n- ALSA: hda: hdac_ext_stream: fix potential locking issues (Pierre-Louis Bossart) \n- hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit) \n- tlb: mmu_gather: add tlb_flush_*_range APIs (Peter Zijlstra (Intel)) \n- ice: Delete always true check of PF pointer (Leon Romanovsky) \n- usb: max-3421: Use driver data instead of maintaining a list of bound devices (Uwe Kleine-Konig) \n- ASoC: DAPM: Cover regression by kctl change notification fix (Takashi Iwai) \n- batman-adv: Don't always reallocate the fragmentation skb head (Sven Eckelmann) \n- batman-adv: Reserve needed_*room for fragments (Sven Eckelmann) \n- batman-adv: Consider fragmentation for needed_headroom (Sven Eckelmann) \n- perf/core: Avoid put_page() when GUP fails (Greg Thelen) \n- Revert 'net: mvpp2: disable force link UP during port init procedure' (Greg Kroah-Hartman) \n- drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors (hongao) \n- drm/i915/dp: Ensure sink rate values are always valid (Imre Deak) \n- drm/nouveau: use drm_dev_unplug() during device removal (Jeremy Cline) \n- drm/udl: fix control-message timeout (Johan Hovold) \n- cfg80211: call cfg80211_stop_ap when switch from P2P_GO type (Nguyen Dinh Phi) \n- parisc/sticon: fix reverse colors (Sven Schnelle) \n- btrfs: fix memory ordering between normal and ordered work functions (Nikolay Borisov) \n- udf: Fix crash after seekdir (Jan Kara) \n- s390/kexec: fix memory leak of ipl report buffer (Baoquan He) \n- x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails (Sean Christopherson) \n- mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag (Rustam Kovhaev) \n- ipc: WARN if trying to remove ipc object which is absent (Alexander Mikhalitsyn) \n- hexagon: export raw I/O routines for modules (Nathan Chancellor) \n- tun: fix bonding active backup with arp monitoring (Nicolas Dichtel) \n- arm64: vdso32: suppress error message for 'make mrproper' (Nick Desaulniers) \n- s390/kexec: fix return code handling (Heiko Carstens) \n- perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server (Alexander Antonov) \n- perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server (Alexander Antonov) \n- KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr() (Michael Ellerman) \n- NFC: reorder the logic in nfc_{un,}register_device (Lin Ma) \n- drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame (Hans Verkuil) \n- NFC: reorganize the functions in nci_request (Lin Ma) \n- i40e: Fix display error code in dmesg (Grzegorz Szczurek) \n- i40e: Fix creation of first queue by omitting it if is not power of two (Jedrzej Jagielski) \n- i40e: Fix ping is lost after configuring ADq on VF (Eryk Rybak) \n- i40e: Fix changing previously set num_queue_pairs for PFs (Eryk Rybak) \n- i40e: Fix NULL ptr dereference on VSI filter sync (Michal Maloszewski) \n- i40e: Fix correct max_pkt_size on VF RX queue (Eryk Rybak) \n- net: virtio_net_hdr_to_skb: count transport header in UFO (Jonathan Davies) \n- net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove (Pavel Skripkin) \n- net: sched: act_mirred: drop dst for the direction from egress to ingress (Xin Long) \n- scsi: core: sysfs: Fix hang when device state is set via sysfs (Mike Christie) \n- platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' (Christophe JAILLET) \n- mips: lantiq: add support for clk_get_parent() (Randy Dunlap) \n- mips: bcm63xx: add support for clk_get_parent() (Randy Dunlap) \n- MIPS: generic/yamon-dt: fix uninitialized variable error (Colin Ian King) \n- iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset (Surabhi Boob) \n- iavf: validate pointers (Mitch Williams) \n- iavf: prevent accidental free of filter structure (Jacob Keller) \n- iavf: Fix failure to exit out from last all-multicast mode (Piotr Marczak) \n- iavf: free q_vectors before queues in iavf_disable_vf (Nicholas Nunley) \n- iavf: check for null in iavf_fix_features (Nicholas Nunley) \n- net: bnx2x: fix variable dereferenced before check (Pavel Skripkin) \n- perf tests: Remove bash construct from record+zstd_comp_decomp.sh (James Clark) \n- perf bench futex: Fix memory leak of perf_cpu_map__new() (Sohaib Mohamed) \n- perf bpf: Avoid memory leak from perf_env__insert_btf() (Ian Rogers) \n- RDMA/netlink: Add __maybe_unused to static inline in C file (Leon Romanovsky) \n- tracing/histogram: Do not copy the fixed-size char array field over the field size (Masami Hiramatsu) \n- tracing: Save normal string variables (Tom Zanussi) \n- sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() (Vincent Donnefort) \n- mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set (Randy Dunlap) \n- clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk (Dmitry Baryshkov) \n- clk/ast2600: Fix soc revision for AHB (Joel Stanley) \n- clk: ingenic: Fix bugs with divided dividers (Paul Cercueil) \n- sh: define __BIG_ENDIAN for math-emu (Randy Dunlap) \n- sh: math-emu: drop unused functions (Randy Dunlap) \n- sh: fix kconfig unmet dependency warning for FRAME_POINTER (Randy Dunlap) \n- f2fs: fix up f2fs_lookup tracepoints (Gao Xiang) \n- maple: fix wrong return value of maple_bus_init(). (Lu Wei) \n- sh: check return code of request_irq (Nick Desaulniers) \n- powerpc/dcr: Use cmplwi instead of 3-argument cmpli (Michael Ellerman) \n- ALSA: gus: fix null pointer dereference on pointer block (Chengfeng Ye) \n- powerpc/5200: dts: fix memory node unit name (Anatolij Gustschin) \n- iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr() (Teng Qi) \n- scsi: target: Fix alua_tg_pt_gps_count tracking (Mike Christie) \n- scsi: target: Fix ordered tag handling (Mike Christie) \n- MIPS: sni: Fix the build (Bart Van Assche) \n- tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Guanghui Feng) \n- ALSA: ISA: not for M68K (Randy Dunlap) \n- ARM: dts: ls1021a-tsn: use generic 'jedec,spi-nor' compatible for flash (Li Yang) \n- ARM: dts: ls1021a: move thermal-zones node out of soc/ (Li Yang) \n- usb: host: ohci-tmio: check return value after calling platform_get_resource() (Yang Yingliang) \n- ARM: dts: omap: fix gpmc,mux-add-data type (Roger Quadros) \n- firmware_loader: fix pre-allocated buf built-in firmware use (Luis Chamberlain) \n- scsi: advansys: Fix kernel pointer leak (Guo Zhi) \n- ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect (Hans de Goede) \n- clk: imx: imx6ul: Move csi_sel mux to correct base register (Stefan Riedmueller) \n- ASoC: SOF: Intel: hda-dai: fix potential locking issue (Pierre-Louis Bossart) \n- arm64: dts: freescale: fix arm,sp805 compatible string (Michael Walle) \n- arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency (AngeloGioacchino Del Regno) \n- usb: typec: tipd: Remove WARN_ON in tps6598x_block_read (Sven Peter) \n- usb: musb: tusb6010: check return value after calling platform_get_resource() (Yang Yingliang) \n- RDMA/bnxt_re: Check if the vlan is valid before reporting (Selvin Xavier) \n- arm64: dts: hisilicon: fix arm,sp805 compatible string (Michael Walle) \n- ARM: dts: NSP: Fix mpcore, mmc node names (Matthew Hagan) \n- arm64: zynqmp: Fix serial compatible string (Michal Simek) \n- arm64: zynqmp: Do not duplicate flash partition label property (Amit Kumar Mahapatra) \n- net/mlx5: Add back multicast stats for uplink representor (Huy Nguyen) [Orabug: 33519567] \n- net/mlx5: E-Switch, Protect changing mode while adding rules (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Do not reload ethernet ports when changing eswitch mode (Roi Dayan) [Orabug: 33519567] \n- net/mlx5: Move devlink port from mlx5e priv to mlx5e resources (Roi Dayan) [Orabug: 33519567] \n- net/mlx5: Move mlx5e hw resources into a sub object (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Move devlink port register and unregister calls (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Verify dev is present in some ndos (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Use nic mode netdev ndos and ethtool ops for uplink representor (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Add offload stats ndos to nic netdev ops (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Distinguish nic and esw offload in tc setup block cb (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Allow legacy vf ndos only if in legacy mode (Roi Dayan) [Orabug: 33519567] \n- net/mlx5e: Same max num channels for both nic and uplink profiles (Saeed Mahameed) [Orabug: 33519567] \n- net: Change dev parameter to const in netif_device_present() (Roi Dayan) [Orabug: 33519567] \n- net/mlx5: Cleanup prototype warning (Saeed Mahameed) [Orabug: 33519567] \n- net/mxl5e: Add change profile method (Saeed Mahameed) [Orabug: 33519567] \n- net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled (Maor Dickman) [Orabug: 33519567] \n- net/tls: Fix wrong record sn in async mode of device resync (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Fix multicast counter not up-to-date in 'ip -s' (Ron Diskin) [Orabug: 33519567] \n- net/mlx5e: Add support for PCI relaxed ordering (Aya Levin) [Orabug: 33519567] \n- net/mlx5e: Move exposure of datapath function to txrx header (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: RX, Re-work initializaiton of RX function pointers (Tariq Toukan) [Orabug: 33519567] \n- RDMA/mlx5: ConnectX-7 new capabilities to set relaxed ordering by UMR (Meir Lichtinger) [Orabug: 33519567] \n- net/mlx5e: IPsec: Add Connect-X IPsec Rx data path offload (Raed Salem) [Orabug: 33519567] \n- net/mlx5e: Fix usage of rcu-protected pointer (Vlad Buslov) [Orabug: 33519567] \n- net/mlx5e: Move RQ helpers to txrx.h (Aya Levin) [Orabug: 33519567] \n- net/mlx5e: Remove redundant RQ state query (Aya Levin) [Orabug: 33519567] \n- net/mlx5e: Change reporters create functions to return void (Eran Ben Elisha) [Orabug: 33519567] \n- net/tls: fix sign extension issue when left shifting u16 value (Colin Ian King) [Orabug: 33519567] \n- net/mlx5e: kTLS, Improve rx handler function call (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Add kTLS RX stats (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Add kTLS RX resync support (Tariq Toukan) [Orabug: 33519567] \n- net/tls: Add asynchronous resync (Boris Pismenny) [Orabug: 33519567] \n- Revert 'net/tls: Add force_resync for driver resync' (Boris Pismenny) [Orabug: 33519567] \n- net/mlx5e: kTLS, Add kTLS RX HW offload support (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Improve TLS feature modularity (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Accel, Expose flow steering API for rules add/del (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Receive flow steering framework for accelerated TCP flows (Boris Pismenny) [Orabug: 33519567] \n- net/mlx5e: API to manipulate TTC rules destinations (Saeed Mahameed) [Orabug: 33519567] \n- net/mlx5e: Turn XSK ICOSQ into a general asynchronous one (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5: kTLS, Improve TLS params layout structures (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Support tc block sharing for representors (Vu Pham) [Orabug: 33519567] \n- net/tls: Add force_resync for driver resync (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Calculate SQ stop room in a robust way (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: IPoIB, Enable loopback packets for IPoIB interfaces (Erez Shitrit) [Orabug: 33519567] \n- net/mlx5e: Enhance ICOSQ WQE info fields (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Use struct assignment for WQE info updates (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Take TX WQE info structures out of general EN header (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Do not fill edge for the DUMP WQEs in TX flow (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: kTLS, Fill work queue edge separately in TX flow (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Split TX acceleration offloads into two phases (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Update UDP fields of the SKB for GSO first (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Make TLS offload independent of wqe and pi (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Pass only eseg to IPSEC offload (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Return void from mlx5e_sq_xmit and mlx5i_sq_xmit (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Unify checks of TLS offloads (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Return bool from TLS and IPSEC offloads (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Unify reserving space for WQEs (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Rename ICOSQ WQE info struct and field (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: Fetch WQE: reuse code and enforce typing (Maxim Mikityanskiy) [Orabug: 33519567] \n- net/mlx5e: TX, Generalise code and usage of error CQE dump (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5: Introduce TLS RX offload hardware bits (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5: Update transobj.c new cmd interface (Leon Romanovsky) [Orabug: 33519567] \n- net/mlx5e: en_accel, Add missing net/geneve.h include (Raed Salem) [Orabug: 33519567] \n- net/mlx5e: Show/set Rx network flow classification rules on ul rep (Vlad Buslov) [Orabug: 33519567] \n- net/mlx5e: Show/set Rx flow indir table and RSS hash key on ul rep (Vlad Buslov) [Orabug: 33519567] \n- mlx5: reject unsupported coalescing params (Jakub Kicinski) [Orabug: 33519567] \n- net/mlx5e: RX, Use indirect calls wrapper for posting descriptors (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5e: Replace zero-length array with flexible-array member (Gustavo A. R. Silva) [Orabug: 33519567] \n- net/mlx5e: TX, Error completion is for last WQE in batch (Tariq Toukan) [Orabug: 33519567] \n- net/mlx5: Expose relaxed ordering bits (Michael Guralnik) [Orabug: 33519567] \n- net/mlx5e: TX, Dump WQs wqe descriptors on CQE with error events (Saeed Mahameed) [Orabug: 33519567]\n[5.4.17-2136.305.1]\n- btrfs: fix metadata reservation for fallocate that leads to transaction aborts (Filipe Manana) [Orabug: 32675999] \n- btrfs: inode: refactor the parameters of insert_reserved_file_extent() (Qu Wenruo) [Orabug: 32675999] \n- uek-rpm: Enable QAT 4XXX device (Thomas Tai) [Orabug: 33440215] \n- crypto: qat - power up 4xxx device (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - fix naming of PF/VF enable functions (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - complete all the init steps before service notification (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - move IO virtualization functions (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - rename compatibility version definition (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - enable interrupts only after ISR allocation (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - simplify code and axe the use of a deprecated API (Christophe JAILLET) [Orabug: 33440215] \n- crypto: qat - enable detection of accelerators hang (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - configure arbiter mapping based on engines enabled (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - replace CRYPTO_AES with CRYPTO_LIB_AES in Kconfig (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add CRYPTO_AES to Kconfig dependencies (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add capability detection logic in qat_4xxx (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add AES-XTS support for QAT GEN4 devices (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add AES-CTR support for QAT GEN4 devices (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - add qat_4xxx driver (Thomas Tai) [Orabug: 33440215] \n- crypto: qat - add hook to initialize vector routing table (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - target fw images to specific AEs (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - add gen4 firmware loader (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add support for broadcasting mode (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add support for shared ustore (Jack Xu) [Orabug: 33440215] \n- crypto: qat - allow to target specific AEs (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add FCU CSRs to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add CSS3K support (Jack Xu) [Orabug: 33440215] \n- crypto: qat - use ae_mask (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add misc control CSR to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add wake up event to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add clock enable CSR to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add reset CSR and mask to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add local memory size to chip info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add support for lm2 and lm3 (Jack Xu) [Orabug: 33440215] \n- crypto: qat - add next neighbor to chip_info (Jack Xu) [Orabug: 33440215] \n- crypto: qat - introduce chip info structure (Jack Xu) [Orabug: 33440215] \n- crypto: qat - refactor long expressions (Jack Xu) [Orabug: 33440215] \n- crypto: qat - refactor qat_uclo_set_ae_mode() (Jack Xu) [Orabug: 33440215] \n- crypto: qat - move defines to header files (Jack Xu) [Orabug: 33440215] \n- crypto: qat - remove global CSRs helpers (Jack Xu) [Orabug: 33440215] \n- crypto: qat - refactor AE start (Jack Xu) [Orabug: 33440215] \n- crypto: qat - rename qat_uclo_del_uof_obj() (Jack Xu) [Orabug: 33440215] \n- crypto: qat - remove unnecessary parenthesis (Jack Xu) [Orabug: 33440215] \n- crypto: qat - support for mof format in fw loader (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - allow for instances in different banks (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - refactor qat_crypto_dev_config() (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - refactor qat_crypto_create_instances() (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - remove unnecessary void* casts (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - call functions in adf_sriov if available (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - abstract writes to arbiter enable (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - use BIT_ULL() - 1 pattern for masks (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - replace constant masks with GENMASK (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - abstract build ring base (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - enable ring after pair is programmed (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - register crypto instances based on capability (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - add support for capability detection (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - abstract arbiter access (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - remove unused macros in arbiter module (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - remove writes into WQCFG (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - update constants table (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - use admin mask to send fw constants (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - change admin sequence (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - rename ME in AE (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - add packed to init admin structures (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - abstract admin interface (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - relocate GEN2 CSR access code (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - split transport CSR access logic (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - fix configuration of iov threads (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - num_rings_per_bank is device dependent (Ahsan Atta) [Orabug: 33440215] \n- crypto: qat - mask device capabilities with soft straps (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - update IV in software (Marco Chiappero) [Orabug: 33440215] \n- crypto: qat - drop input parameter from adf_enable_aer() (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - replace device ids defines (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - add delay before polling mailbox (Giovanni Cabiddu) [Orabug: 33440215] \n- PCI: Add Intel QuickAssist device IDs (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - fallback for xts with 192 bit keys (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - remove unused field in skcipher ctx (Thomas Tai) [Orabug: 33440215] \n- crypto: qat - validate xts key (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - allow xts requests not multiple of block (Giovanni Cabiddu) [Orabug: 33440215] \n- crypto: qat - update timeout logic in put admin msg (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - send admin messages to set of AEs (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - update fw init admin msg (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - replace user types with kernel ABI __u types (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - replace user types with kernel u types (Wojciech Ziemba) [Orabug: 33440215] \n- crypto: qat - convert to SPDX License Identifiers (Giovanni Cabiddu) [Orabug: 33440215] \n- iopoll: introduce read_poll_timeout macro (Dejin Zheng) [Orabug: 33440215] \n- crypto: qat - simplify the qat_crypto function (Tianjia Zhang) [Orabug: 33440215] \n- crypto: qat - switch to skcipher API (Ard Biesheuvel) [Orabug: 33440215] \n- io_uring: fix false WARN_ONCE (Pavel Begunkov) [Orabug: 33731046] \n- scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix link down processing to address NULL pointer dereference (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Allow PLOGI retry if previous PLOGI was aborted (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Revert LOG_TRACE_EVENT back to LOG_INIT prior to driver_resource_setup() (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix memory overwrite during FC-GS I/O abort handling (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Add support for optional PLDV handling (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix mailbox command failure during driver initialization (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Improve PBDE checks during SGL processing (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix FCP I/O flush functionality for TMF routines (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix NVMe I/O failover to non-optimized path (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Don't remove ndlp on PRLI errors in P2P mode (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix rediscovery of tape device after LIP (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (Ewan D. Milne) [Orabug: 33731165] \n- scsi: lpfc: Fix possible ABBA deadlock in nvmet_xri_aborted() (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Revise Topology and RAS support checks for new adapters (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Copyright updates for 12.8.0.11 patches (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Update lpfc version to 12.8.0.11 (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Skip issuing ADISC when node is in NPR state (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Call discovery state machine when handling PLOGI/ADISC completions (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Delay unregistering from transport until GIDFT or ADISC completes (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Clear outstanding active mailbox during PCI function reset (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix target reset handler from falsely returning FAILURE (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Discovery state machine fixes for LOGO handling (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Remove use of kmalloc() in trace event logging (James Smart) [Orabug: 33731165] \n- scsi: lpfc: Fix failure to transmit ABTS on FC link (James Smart) [Orabug: 33731165] \n- bpf: Disallow unprivileged bpf by default (Pawan Gupta) [Orabug: 33734681] \n- bpf: Add kconfig knob for disabling unpriv bpf by default (Daniel Borkmann) [Orabug: 33734681] \n- USB: gadget: bRequestType is a bitfield, not a enum (Greg Kroah-Hartman) [Orabug: 33739525] {CVE-2021-39685}\n- USB: gadget: zero allocate endpoint 0 buffers (Greg Kroah-Hartman) [Orabug: 33739525] {CVE-2021-39685}\n- USB: gadget: detect too-big endpoint 0 requests (Greg Kroah-Hartman) [Orabug: 33739525] {CVE-2021-39685}\n- scsi: vmw_pvscsi: Set residual data length conditionally (Alexey Makhalov) [Orabug: 33761343] \n- hwmon: (k10temp) Add support for Zen3 CPUs (Rahul Rohit) [Orabug: 33782833] \n- Revert 'rds/ib: Kernel upgrade to rds_ib_conns info displayed by rds-info' (Rohit Nair) [Orabug: 33812555] \n- uek-rpm: Add missing dax modules to kernel-ueknano (Somasundaram Krishnasamy) [Orabug: 33821042] \n- cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33825687] {CVE-2022-0492}", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-03-23T00:00:00", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-26401", "CVE-2021-3653", "CVE-2021-3656", "CVE-2021-39685", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0847", "CVE-2022-23960", "CVE-2022-25636"], "modified": "2022-03-23T00:00:00", "id": "ELSA-2022-9244", "href": "http://linux.oracle.com/errata/ELSA-2022-9244.html", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2022-05-03T16:58:29", "description": "[4.1.12-124.62.3]\n- fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabug: 33679806] {CVE-2021-0920}\n- fs: add fget_many() and fput_many() (Jens Axboe) [Orabug: 33679806] \n- af_unix: fix garbage collect vs MSG_PEEK (Miklos Szeredi) [Orabug: 33679806] {CVE-2021-0920}\n- net: split out functions related to registering inflight socket files (Jens Axboe) [Orabug: 33679806]\n[4.1.12-124.62.2]\n- netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso) [Orabug: 34012926] {CVE-2022-1016}\n- pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() (Nikola Livic) [Orabug: 34020970] {CVE-2021-4157}\n[4.1.12-124.62.1]\n- Bluetooth: use correct lock to prevent UAF of hdev object (Lin Ma) [Orabug: 33014054] {CVE-2021-3573}\n- hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit) [Orabug: 33617221] {CVE-2021-4002}\n- udf: Restore i_lenAlloc when inode expansion fails (Jan Kara) [Orabug: 33870269] {CVE-2022-0617}\n- udf: Fix NULL ptr deref when converting from inline format (Jan Kara) [Orabug: 33870269] {CVE-2022-0617}\n- phonet: refcount leak in pep_sock_accep (Hangyu Hua) [Orabug: 33962762] {CVE-2021-45095}\n- btrfs: unlock newly allocated extent buffer after error (Qu Wenruo) [Orabug: 33997139] {CVE-2021-4149}\n- quota: correct error number in free_dqentry() (Zhang Yi) [Orabug: 33997256] {CVE-2021-45868}\n- quota: check block number when reading the block in quota file (Zhang Yi) [Orabug: 33997256] {CVE-2021-45868}\n- af_unix: fix races in sk_peer_pid and sk_peer_cred accesses (Eric Dumazet) [Orabug: 34006847] {CVE-2021-4203}", "cvss3": {"exploitabilityScore": 2.1, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.0, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-05-03T00:00:00", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.4, "vectorString": "AV:A/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-0920", "CVE-2021-3573", "CVE-2021-4002", "CVE-2021-4149", "CVE-2021-4157", "CVE-2021-4203", "CVE-2021-45095", "CVE-2021-45868", "CVE-2022-0617", "CVE-2022-1016"], "modified": "2022-05-03T00:00:00", "id": "ELSA-2022-9348", "href": "http://linux.oracle.com/errata/ELSA-2022-9348.html", "cvss": {"score": 7.4, "vector": "AV:A/AC:M/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2021-11-26T18:28:08", "description": "[4.18.0-348.2.1_5.OL8]\n- Update Oracle Linux certificates (Kevin Lyons)\n- Disable signing for aarch64 (Ilya Okomin)\n- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]\n- Update x509.genkey [Orabug: 24817676]\n- Conflict with shim-ia32 and shim-x64 <= 15-11.0.5\n[4.18.0-348.2.1_5]\n- tipc: fix size validations for the MSG_CRYPTO type (Bruno Meneguele) [2020506 2020507] {CVE-2021-43267}\n- net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005981 1975193]\n[4.18.0-348.1.1_5]\n- lib/timerqueue: Rely on rbtree semantics for next timer (Phil Auld) [2014677 2007099] {CVE-2021-20317}\n- mm/hmm: make HMM_MIRROR an implicit option (Rafael Aquini) [2017519 1998534]\n- mm/hmm: allow HMM_MIRROR on all architectures with MMU (Rafael Aquini) [2017519 1998534]\n- mm: don't select MIGRATE_VMA_HELPER from HMM_MIRROR (Rafael Aquini) [2017519 1998534]\n- mm: sort out the DEVICE_PRIVATE Kconfig mess (Rafael Aquini) [2017519 1998534]\n- ceph: skip existing superblocks that are blocklisted or shut down when mounting (Jeffrey Layton) [2017071 2011462]\n- redhat: switch release to zstream (Bruno Meneguele)", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-11-18T00:00:00", "type": "oraclelinux", "title": "kernel security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-20317", "CVE-2021-43267"], "modified": "2021-11-18T00:00:00", "id": "ELSA-2021-4647", "href": "http://linux.oracle.com/errata/ELSA-2021-4647.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2023-05-18T14:44:05", "description": "The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9313 advisory.\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network. (CVE-2022-0435)\n\n - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.\n (CVE-2021-26401)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. (CVE-2020-36516)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\n - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.\n This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015) (CVE-2022-1016)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. (CVE-2022-24448)\n\n - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)\n\n - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem. (CVE-2021-4149)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\n - A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.\n (CVE-2021-20317)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-04-25T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2022-9313)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-5715", "CVE-2020-36516", "CVE-2021-20317", "CVE-2021-26401", "CVE-2021-4002", "CVE-2021-4149", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0617", "CVE-2022-0847", "CVE-2022-1015", "CVE-2022-1016", "CVE-2022-22942", "CVE-2022-24448", "CVE-2022-26966"], "modified": "2023-01-13T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek-headers", "p-cpe:/a:oracle:linux:kernel-uek-tools", "p-cpe:/a:oracle:linux:kernel-uek-tools-libs", "p-cpe:/a:oracle:linux:kernel-uek-tools-libs-devel", "p-cpe:/a:oracle:linux:perf", "p-cpe:/a:oracle:linux:python-perf", "cpe:/o:oracle:linux:7"], "id": "ORACLELINUX_ELSA-2022-9313.NASL", "href": "https://www.tenable.com/plugins/nessus/160190", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2022-9313.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(160190);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/13\");\n\n script_cve_id(\n \"CVE-2020-36516\",\n \"CVE-2021-4002\",\n \"CVE-2021-4149\",\n \"CVE-2021-20317\",\n \"CVE-2021-26401\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0617\",\n \"CVE-2022-0847\",\n \"CVE-2022-1016\",\n \"CVE-2022-22942\",\n \"CVE-2022-24448\",\n \"CVE-2022-26966\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2022-9313)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2022-9313 advisory.\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper\n initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus\n contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache\n backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends\n a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have\n access to the TIPC network. (CVE-2022-0435)\n\n - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.\n (CVE-2021-26401)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the\n hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session\n or terminate that session. (CVE-2020-36516)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to\n obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\n - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.\n This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015) (CVE-2022-1016)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way\n user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw\n to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the\n O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a\n regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file\n descriptor. (CVE-2022-24448)\n\n - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some\n regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the\n memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)\n\n - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an\n improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of\n service (DOS) due to a deadlock problem. (CVE-2021-4149)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the\n kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups\n v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the\n way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or\n escalate their privileges on the system. (CVE-2022-0330)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\n - A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the\n timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user\n privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.\n (CVE-2021-20317)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2022-9313.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/09/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/04/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/04/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['4.14.35-2047.512.6.el7uek'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2022-9313');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '4.14';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.14.35'},\n {'reference':'kernel-uek-4.14.35-2047.512.6.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.14.35'},\n {'reference':'kernel-uek-debug-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.14.35'},\n {'reference':'kernel-uek-debug-4.14.35-2047.512.6.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.14.35'},\n {'reference':'kernel-uek-debug-devel-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.14.35'},\n {'reference':'kernel-uek-debug-devel-4.14.35-2047.512.6.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.14.35'},\n {'reference':'kernel-uek-devel-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.14.35'},\n {'reference':'kernel-uek-devel-4.14.35-2047.512.6.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.14.35'},\n {'reference':'kernel-uek-doc-4.14.35-2047.512.6.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.14.35'},\n {'reference':'kernel-uek-headers-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-headers-4.14.35'},\n {'reference':'kernel-uek-tools-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-tools-4.14.35'},\n {'reference':'kernel-uek-tools-4.14.35-2047.512.6.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-tools-4.14.35'},\n {'reference':'kernel-uek-tools-libs-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-tools-libs-4.14.35'},\n {'reference':'kernel-uek-tools-libs-devel-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-tools-libs-devel-4.14.35'},\n {'reference':'perf-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python-perf-4.14.35-2047.512.6.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek / kernel-uek-debug / kernel-uek-debug-devel / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-20T14:17:19", "description": "The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-9314 advisory.\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network. (CVE-2022-0435)\n\n - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.\n (CVE-2021-26401)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. (CVE-2020-36516)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\n - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.\n This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015) (CVE-2022-1016)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. (CVE-2022-24448)\n\n - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)\n\n - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem. (CVE-2021-4149)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\n - A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.\n (CVE-2021-20317)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-04-25T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2022-9314)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-5715", "CVE-2020-36516", "CVE-2021-20317", "CVE-2021-26401", "CVE-2021-4002", "CVE-2021-4149", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0617", "CVE-2022-0847", "CVE-2022-1015", "CVE-2022-1016", "CVE-2022-22942", "CVE-2022-24448", "CVE-2022-26966"], "modified": "2023-01-13T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:kernel-uek-container", "cpe:/o:oracle:linux:7"], "id": "ORACLELINUX_ELSA-2022-9314.NASL", "href": "https://www.tenable.com/plugins/nessus/160189", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2022-9314.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(160189);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/13\");\n\n script_cve_id(\n \"CVE-2020-36516\",\n \"CVE-2021-4002\",\n \"CVE-2021-4149\",\n \"CVE-2021-20317\",\n \"CVE-2021-26401\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0617\",\n \"CVE-2022-0847\",\n \"CVE-2022-1016\",\n \"CVE-2022-22942\",\n \"CVE-2022-24448\",\n \"CVE-2022-26966\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2022-9314)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the\nELSA-2022-9314 advisory.\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper\n initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus\n contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache\n backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends\n a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have\n access to the TIPC network. (CVE-2022-0435)\n\n - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.\n (CVE-2021-26401)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the\n hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session\n or terminate that session. (CVE-2020-36516)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to\n obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\n - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.\n This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015) (CVE-2022-1016)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way\n user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw\n to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the\n O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a\n regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file\n descriptor. (CVE-2022-24448)\n\n - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some\n regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the\n memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)\n\n - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an\n improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of\n service (DOS) due to a deadlock problem. (CVE-2021-4149)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the\n kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups\n v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the\n way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or\n escalate their privileges on the system. (CVE-2022-0330)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\n - A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the\n timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user\n privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.\n (CVE-2021-20317)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2022-9314.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel-uek-container package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/09/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/04/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/04/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-container\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['4.14.35-2047.512.6.el7'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2022-9314');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '4.14';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-container-4.14.35-2047.512.6.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-4.14.35'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek-container');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:43:06", "description": "The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:825 advisory.\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network. (CVE-2022-0435)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-12T00:00:00", "type": "nessus", "title": "Rocky Linux 8 : kernel (RLSA-2022:825)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0847"], "modified": "2023-01-13T00:00:00", "cpe": ["p-cpe:/a:rocky:linux:bpftool", "p-cpe:/a:rocky:linux:bpftool-debuginfo", "p-cpe:/a:rocky:linux:kernel", "p-cpe:/a:rocky:linux:kernel-abi-stablelists", "p-cpe:/a:rocky:linux:kernel-core", "p-cpe:/a:rocky:linux:kernel-cross-headers", "p-cpe:/a:rocky:linux:kernel-debug", "p-cpe:/a:rocky:linux:kernel-debug-core", "p-cpe:/a:rocky:linux:kernel-debug-debuginfo", "p-cpe:/a:rocky:linux:kernel-debug-devel", "p-cpe:/a:rocky:linux:kernel-debug-modules", "p-cpe:/a:rocky:linux:kernel-debug-modules-extra", "p-cpe:/a:rocky:linux:kernel-debuginfo", "p-cpe:/a:rocky:linux:kernel-debuginfo-common-aarch64", "p-cpe:/a:rocky:linux:kernel-debuginfo-common-x86_64", "p-cpe:/a:rocky:linux:kernel-devel", "p-cpe:/a:rocky:linux:kernel-headers", "p-cpe:/a:rocky:linux:kernel-modules", "p-cpe:/a:rocky:linux:kernel-modules-extra", "p-cpe:/a:rocky:linux:kernel-rt", "p-cpe:/a:rocky:linux:kernel-rt-core", "p-cpe:/a:rocky:linux:kernel-rt-debug", "p-cpe:/a:rocky:linux:kernel-rt-debug-core", "p-cpe:/a:rocky:linux:kernel-rt-debug-debuginfo", "p-cpe:/a:rocky:linux:kernel-rt-debug-devel", "p-cpe:/a:rocky:linux:kernel-rt-debug-modules", "p-cpe:/a:rocky:linux:kernel-rt-modules", "p-cpe:/a:rocky:linux:kernel-rt-debug-modules-extra", "p-cpe:/a:rocky:linux:kernel-rt-debuginfo", "p-cpe:/a:rocky:linux:kernel-rt-debuginfo-common-x86_64", "p-cpe:/a:rocky:linux:kernel-rt-modules-extra", "p-cpe:/a:rocky:linux:kernel-rt-devel", "p-cpe:/a:rocky:linux:kernel-rt-kvm", "p-cpe:/a:rocky:linux:kernel-tools", "p-cpe:/a:rocky:linux:kernel-tools-debuginfo", "p-cpe:/a:rocky:linux:kernel-tools-libs", "p-cpe:/a:rocky:linux:kernel-tools-libs-devel", "p-cpe:/a:rocky:linux:perf", "p-cpe:/a:rocky:linux:perf-debuginfo", "p-cpe:/a:rocky:linux:python3-perf", "p-cpe:/a:rocky:linux:python3-perf-debuginfo", "cpe:/o:rocky:linux:8"], "id": "ROCKY_LINUX_RLSA-2022-825.NASL", "href": "https://www.tenable.com/plugins/nessus/158877", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# Rocky Linux Security Advisory RLSA-2022:825.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158877);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/13\");\n\n script_cve_id(\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0847\"\n );\n script_xref(name:\"RLSA\", value:\"2022:825\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"Rocky Linux 8 : kernel (RLSA-2022:825)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Rocky Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nRLSA-2022:825 advisory.\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper\n initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus\n contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache\n backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the\n way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or\n escalate their privileges on the system. (CVE-2022-0330)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends\n a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have\n access to the TIPC network. (CVE-2022-0435)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the\n kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups\n v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.rockylinux.org/RLSA-2022:825\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2031930\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2034514\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2048738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2050237\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2051505\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2060795\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/02/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:bpftool-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-abi-stablelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-cross-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debuginfo-common-aarch64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:perf-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:python3-perf-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:rocky:linux:8\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Rocky Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RockyLinux/release\", \"Host/RockyLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/RockyLinux/release');\nif (isnull(release) || 'Rocky Linux' >!< release) audit(AUDIT_OS_NOT, 'Rocky Linux');\nvar os_ver = pregmatch(pattern: \"Rocky(?: Linux)? release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Rocky Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Rocky Linux 8.x', 'Rocky Linux ' + os_ver);\n\nif (!get_kb_item('Host/RockyLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Rocky Linux', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2022-0330', 'CVE-2022-0435', 'CVE-2022-0492', 'CVE-2022-0847');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for RLSA-2022:825');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nvar pkgs = [\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-abi-stablelists-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debuginfo-common-aarch64-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debuginfo-common-x86_64-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-headers-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-headers-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-core-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-core-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-debuginfo-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-devel-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-extra-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debuginfo-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debuginfo-common-x86_64-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-devel-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-kvm-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-extra-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'Rocky-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release && (!exists_check || rpm_exists(release:release, rpm:exists_check))) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:43:21", "description": "The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:819 advisory.\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network. (CVE-2022-0435)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-11T00:00:00", "type": "nessus", "title": "Rocky Linux 8 : kernel-rt (RLSA-2022:819)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0847"], "modified": "2023-01-16T00:00:00", "cpe": ["p-cpe:/a:rocky:linux:bpftool", "p-cpe:/a:rocky:linux:bpftool-debuginfo", "p-cpe:/a:rocky:linux:kernel", "p-cpe:/a:rocky:linux:kernel-abi-stablelists", "p-cpe:/a:rocky:linux:kernel-core", "p-cpe:/a:rocky:linux:kernel-cross-headers", "p-cpe:/a:rocky:linux:kernel-debug", "p-cpe:/a:rocky:linux:kernel-debug-core", "p-cpe:/a:rocky:linux:kernel-debug-debuginfo", "p-cpe:/a:rocky:linux:kernel-debug-devel", "p-cpe:/a:rocky:linux:kernel-debug-modules", "p-cpe:/a:rocky:linux:kernel-debug-modules-extra", "p-cpe:/a:rocky:linux:kernel-debuginfo", "p-cpe:/a:rocky:linux:kernel-debuginfo-common-aarch64", "p-cpe:/a:rocky:linux:kernel-debuginfo-common-x86_64", "p-cpe:/a:rocky:linux:kernel-devel", "p-cpe:/a:rocky:linux:kernel-headers", "p-cpe:/a:rocky:linux:kernel-modules", "p-cpe:/a:rocky:linux:kernel-modules-extra", "p-cpe:/a:rocky:linux:kernel-rt", "p-cpe:/a:rocky:linux:kernel-rt-core", "p-cpe:/a:rocky:linux:kernel-rt-debug", "p-cpe:/a:rocky:linux:kernel-rt-debug-core", "p-cpe:/a:rocky:linux:kernel-rt-debug-debuginfo", "p-cpe:/a:rocky:linux:kernel-rt-debug-devel", "p-cpe:/a:rocky:linux:kernel-rt-debug-modules", "p-cpe:/a:rocky:linux:kernel-rt-debug-modules-extra", "p-cpe:/a:rocky:linux:kernel-rt-debuginfo", "p-cpe:/a:rocky:linux:kernel-rt-debuginfo-common-x86_64", "p-cpe:/a:rocky:linux:kernel-rt-devel", "p-cpe:/a:rocky:linux:kernel-rt-kvm", "p-cpe:/a:rocky:linux:kernel-rt-modules", "p-cpe:/a:rocky:linux:kernel-rt-modules-extra", "p-cpe:/a:rocky:linux:kernel-tools", "p-cpe:/a:rocky:linux:kernel-tools-debuginfo", "p-cpe:/a:rocky:linux:kernel-tools-libs", "p-cpe:/a:rocky:linux:kernel-tools-libs-devel", "p-cpe:/a:rocky:linux:perf", "p-cpe:/a:rocky:linux:perf-debuginfo", "p-cpe:/a:rocky:linux:python3-perf", "p-cpe:/a:rocky:linux:python3-perf-debuginfo", "cpe:/o:rocky:linux:8"], "id": "ROCKY_LINUX_RLSA-2022-819.NASL", "href": "https://www.tenable.com/plugins/nessus/158842", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# Rocky Linux Security Advisory RLSA-2022:819.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158842);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/16\");\n\n script_cve_id(\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0847\"\n );\n script_xref(name:\"RLSA\", value:\"2022:819\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"Rocky Linux 8 : kernel-rt (RLSA-2022:819)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Rocky Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nRLSA-2022:819 advisory.\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper\n initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus\n contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache\n backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the\n way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or\n escalate their privileges on the system. (CVE-2022-0330)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends\n a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have\n access to the TIPC network. (CVE-2022-0435)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the\n kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups\n v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.rockylinux.org/RLSA-2022:819\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2031930\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2034514\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2048738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2051505\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=2060795\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/02/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:bpftool-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-abi-stablelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-cross-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debuginfo-common-aarch64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-rt-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:perf-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:rocky:linux:python3-perf-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:rocky:linux:8\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Rocky Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RockyLinux/release\", \"Host/RockyLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/RockyLinux/release');\nif (isnull(release) || 'Rocky Linux' >!< release) audit(AUDIT_OS_NOT, 'Rocky Linux');\nvar os_ver = pregmatch(pattern: \"Rocky(?: Linux)? release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Rocky Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Rocky Linux 8.x', 'Rocky Linux ' + os_ver);\n\nif (!get_kb_item('Host/RockyLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Rocky Linux', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2022-0330', 'CVE-2022-0435', 'CVE-2022-0492', 'CVE-2022-0847');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for RLSA-2022:819');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nvar pkgs = [\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-abi-stablelists-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debuginfo-common-aarch64-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debuginfo-common-x86_64-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-headers-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-headers-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-core-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-core-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-debuginfo-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-devel-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-extra-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debuginfo-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debuginfo-common-x86_64-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-devel-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-kvm-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-extra-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-debuginfo-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'Rocky-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release && (!exists_check || rpm_exists(release:release, rpm:exists_check))) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-19T14:49:51", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0819 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-11T00:00:00", "type": "nessus", "title": "RHEL 8 : kernel-rt (RHSA-2022:0819)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-0920", "CVE-2021-4154", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:kernel-rt", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-core", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-core", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-kvm", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules-extra", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-kvm", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules-extra"], "id": "REDHAT-RHSA-2022-0819.NASL", "href": "https://www.tenable.com/plugins/nessus/158808", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:0819. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158808);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\n \"CVE-2021-0920\",\n \"CVE-2021-4154\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0819\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"RHEL 8 : kernel-rt (RHSA-2022:0819)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:0819 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container\n breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-0920\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0435\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0492\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0847\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-22942\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0819\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2031930\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2034514\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2048738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2051505\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2060795\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n script_cwe_id(120, 281, 287, 416, 665, 787);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules-extra\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2021-0920', 'CVE-2021-4154', 'CVE-2022-0330', 'CVE-2022-0435', 'CVE-2022-0492', 'CVE-2022-0847', 'CVE-2022-22942');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for RHSA-2022:0819');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'kernel-rt-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-core-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-core-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-devel-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-kvm-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-extra-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-devel-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-kvm-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-extra-4.18.0-348.20.1.rt7.150.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'kernel-rt-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-core-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-core-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-devel-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-kvm-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-extra-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-devel-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-kvm-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-extra-4.18.0-348.20.1.rt7.150.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp']) && !enterprise_linux_flag) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:38:26", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0820 advisory.\n\n - kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-11T00:00:00", "type": "nessus", "title": "RHEL 8 : kernel (RHSA-2022:0820)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-4083", "CVE-2022-0330", "CVE-2022-0492", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:rhel_aus:8.2", "cpe:/o:redhat:rhel_e4s:8.2", "cpe:/o:redhat:rhel_eus:8.2", "cpe:/o:redhat:rhel_tus:8.2", "p-cpe:/a:redhat:enterprise_linux:bpftool", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra", "p-cpe:/a:redhat:enterprise_linux:kernel-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-headers", "p-cpe:/a:redhat:enterprise_linux:kernel-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra", "p-cpe:/a:redhat:enterprise_linux:kernel-tools", "p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs", "p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-core", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel", "p-cpe:/a:redhat:enterprise_linux:kernel", "p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists", "p-cpe:/a:redhat:enterprise_linux:kernel-core", "p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers", "p-cpe:/a:redhat:enterprise_linux:kernel-debug", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-core", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-extra", "p-cpe:/a:redhat:enterprise_linux:perf", "p-cpe:/a:redhat:enterprise_linux:python3-perf"], "id": "REDHAT-RHSA-2022-0820.NASL", "href": "https://www.tenable.com/plugins/nessus/158807", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:0820. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158807);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\n \"CVE-2021-4083\",\n \"CVE-2022-0330\",\n \"CVE-2022-0492\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0820\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"RHEL 8 : kernel (RHSA-2022:0820)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:0820 advisory.\n\n - kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4083\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0492\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0847\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-22942\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0820\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2029923\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2051505\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2060795\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0847\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n script_cwe_id(281, 287, 416, 665);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/01/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python3-perf\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '8.2')) audit(AUDIT_OS_NOT, 'Red Hat 8.2', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2021-4083', 'CVE-2022-0330', 'CVE-2022-0492', 'CVE-2022-0847', 'CVE-2022-22942');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for RHSA-2022:0820');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.2/x86_64/appstream/debug',\n 'content/aus/rhel8/8.2/x86_64/appstream/os',\n 'content/aus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.2/x86_64/baseos/debug',\n 'content/aus/rhel8/8.2/x86_64/baseos/os',\n 'content/aus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.2/ppc64le/sap/os',\n 'content/e4s/rhel8/8.2/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.2/x86_64/appstream/os',\n 'content/e4s/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.2/x86_64/baseos/os',\n 'content/e4s/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap/os',\n 'content/e4s/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/appstream/debug',\n 'content/eus/rhel8/8.2/aarch64/appstream/os',\n 'content/eus/rhel8/8.2/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/baseos/debug',\n 'content/eus/rhel8/8.2/aarch64/baseos/os',\n 'content/eus/rhel8/8.2/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.2/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.2/aarch64/highavailability/os',\n 'content/eus/rhel8/8.2/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.2/aarch64/supplementary/os',\n 'content/eus/rhel8/8.2/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.2/ppc64le/appstream/os',\n 'content/eus/rhel8/8.2/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.2/ppc64le/baseos/os',\n 'content/eus/rhel8/8.2/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/sap/debug',\n 'content/eus/rhel8/8.2/ppc64le/sap/os',\n 'content/eus/rhel8/8.2/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/appstream/debug',\n 'content/eus/rhel8/8.2/s390x/appstream/os',\n 'content/eus/rhel8/8.2/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/baseos/debug',\n 'content/eus/rhel8/8.2/s390x/baseos/os',\n 'content/eus/rhel8/8.2/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.2/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/highavailability/debug',\n 'content/eus/rhel8/8.2/s390x/highavailability/os',\n 'content/eus/rhel8/8.2/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.2/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/sap/debug',\n 'content/eus/rhel8/8.2/s390x/sap/os',\n 'content/eus/rhel8/8.2/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/s390x/supplementary/debug',\n 'content/eus/rhel8/8.2/s390x/supplementary/os',\n 'content/eus/rhel8/8.2/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/appstream/debug',\n 'content/eus/rhel8/8.2/x86_64/appstream/os',\n 'content/eus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/baseos/debug',\n 'content/eus/rhel8/8.2/x86_64/baseos/os',\n 'content/eus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.2/x86_64/highavailability/os',\n 'content/eus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap/debug',\n 'content/eus/rhel8/8.2/x86_64/sap/os',\n 'content/eus/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.2/x86_64/supplementary/os',\n 'content/eus/rhel8/8.2/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/appstream/debug',\n 'content/tus/rhel8/8.2/x86_64/appstream/os',\n 'content/tus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/baseos/debug',\n 'content/tus/rhel8/8.2/x86_64/baseos/os',\n 'content/tus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.2/x86_64/highavailability/os',\n 'content/tus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/nfv/debug',\n 'content/tus/rhel8/8.2/x86_64/nfv/os',\n 'content/tus/rhel8/8.2/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/rt/debug',\n 'content/tus/rhel8/8.2/x86_64/rt/os',\n 'content/tus/rhel8/8.2/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'bpftool-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-abi-whitelists-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-headers-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-core-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-devel-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-modules-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-modules-extra-4.18.0-193.79.1.el8_2', 'sp':'2', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-193.79.1.el8_2', 'sp':'2', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Advanced Update Support, Extended Update Support, Telco Extended Update Support or Update Services for SAP Solutions repositories.\\n' +\n 'Access to these repositories requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-whitelists / kernel-core / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:42:46", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0821 advisory.\n\n - kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-11T00:00:00", "type": "nessus", "title": "RHEL 8 : kernel-rt (RHSA-2022:0821)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-4083", "CVE-2022-0330", "CVE-2022-0492", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:rhel_aus:8.2", "cpe:/o:redhat:rhel_e4s:8.2", "cpe:/o:redhat:rhel_eus:8.2", "cpe:/o:redhat:rhel_tus:8.2", "p-cpe:/a:redhat:enterprise_linux:kernel-rt", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-core", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-core", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-kvm", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules-extra", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-kvm", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules-extra"], "id": "REDHAT-RHSA-2022-0821.NASL", "href": "https://www.tenable.com/plugins/nessus/158813", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:0821. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158813);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\n \"CVE-2021-4083\",\n \"CVE-2022-0330\",\n \"CVE-2022-0492\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0821\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"RHEL 8 : kernel-rt (RHSA-2022:0821)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:0821 advisory.\n\n - kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4083\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0492\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0847\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-22942\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0821\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2029923\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2051505\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2060795\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0847\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n script_cwe_id(281, 287, 416, 665);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/01/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules-extra\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '8.2')) audit(AUDIT_OS_NOT, 'Red Hat 8.2', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2021-4083', 'CVE-2022-0330', 'CVE-2022-0492', 'CVE-2022-0847', 'CVE-2022-22942');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for RHSA-2022:0821');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.2/x86_64/appstream/debug',\n 'content/aus/rhel8/8.2/x86_64/appstream/os',\n 'content/aus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.2/x86_64/baseos/debug',\n 'content/aus/rhel8/8.2/x86_64/baseos/os',\n 'content/aus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.2/x86_64/appstream/os',\n 'content/e4s/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.2/x86_64/baseos/os',\n 'content/e4s/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap/os',\n 'content/e4s/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/appstream/debug',\n 'content/eus/rhel8/8.2/x86_64/appstream/os',\n 'content/eus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/baseos/debug',\n 'content/eus/rhel8/8.2/x86_64/baseos/os',\n 'content/eus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.2/x86_64/highavailability/os',\n 'content/eus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap/debug',\n 'content/eus/rhel8/8.2/x86_64/sap/os',\n 'content/eus/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.2/x86_64/supplementary/os',\n 'content/eus/rhel8/8.2/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/appstream/debug',\n 'content/tus/rhel8/8.2/x86_64/appstream/os',\n 'content/tus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/baseos/debug',\n 'content/tus/rhel8/8.2/x86_64/baseos/os',\n 'content/tus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.2/x86_64/highavailability/os',\n 'content/tus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/nfv/debug',\n 'content/tus/rhel8/8.2/x86_64/nfv/os',\n 'content/tus/rhel8/8.2/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/rt/debug',\n 'content/tus/rhel8/8.2/x86_64/rt/os',\n 'content/tus/rhel8/8.2/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'kernel-rt-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-core-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-core-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-devel-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-kvm-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-debug-modules-extra-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-devel-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-kvm-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-rt-modules-extra-4.18.0-193.79.1.rt13.129.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Advanced Update Support, Extended Update Support, Telco Extended Update Support or Update Services for SAP Solutions repositories.\\n' +\n 'Access to these repositories requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-09T15:22:19", "description": "The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9273 advisory.\n\n - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. (CVE-2021-26341)\n\n - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.\n (CVE-2021-26401)\n\n - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information. (CVE-2022-23960)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. (CVE-2020-36516)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\n - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.\n This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015) (CVE-2022-1016)\n\n - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. (CVE-2022-24448)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-04-11T00:00:00", "type": "nessus", "title": "Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2022-9273)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-5715", "CVE-2020-36516", "CVE-2021-22600", "CVE-2021-26341", "CVE-2021-26401", "CVE-2022-0617", "CVE-2022-1015", "CVE-2022-1016", "CVE-2022-1158", "CVE-2022-22942", "CVE-2022-23960", "CVE-2022-24448", "CVE-2022-26966"], "modified": "2023-04-25T00:00:00", "cpe": ["cpe:/o:oracle:linux:7", "cpe:/o:oracle:linux:8", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek-tools", "p-cpe:/a:oracle:linux:kernel-uek-tools-libs", "p-cpe:/a:oracle:linux:perf", "p-cpe:/a:oracle:linux:python-perf"], "id": "ORACLELINUX_ELSA-2022-9273.NASL", "href": "https://www.tenable.com/plugins/nessus/159642", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2022-9273.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(159642);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/04/25\");\n\n script_cve_id(\n \"CVE-2020-36516\",\n \"CVE-2021-22600\",\n \"CVE-2021-26341\",\n \"CVE-2021-26401\",\n \"CVE-2022-0617\",\n \"CVE-2022-1016\",\n \"CVE-2022-1158\",\n \"CVE-2022-22942\",\n \"CVE-2022-23960\",\n \"CVE-2022-24448\",\n \"CVE-2022-26966\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/02\");\n\n script_name(english:\"Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2022-9273)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe ELSA-2022-9273 advisory.\n\n - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result\n in data leakage. (CVE-2021-26341)\n\n - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.\n (CVE-2021-26401)\n\n - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,\n aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to\n influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive\n information. (CVE-2022-23960)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the\n hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session\n or terminate that session. (CVE-2020-36516)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to\n obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\n - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.\n This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015) (CVE-2022-1016)\n\n - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through\n crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected\n versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way\n user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw\n to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the\n O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a\n regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file\n descriptor. (CVE-2022-24448)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2022-9273.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-22600\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2022-1158\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'vmwgfx Driver File Descriptor Handling Priv Esc');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/01/26\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/04/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/04/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:python-perf\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^(7|8)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7 / 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['5.4.17-2136.306.1.3.el7uek', '5.4.17-2136.306.1.3.el8uek'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2022-9273');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '5.4';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-5.4.17-2136.306.1.3.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-5.4.17'},\n {'reference':'kernel-uek-5.4.17-2136.306.1.3.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-5.4.17'},\n {'reference':'kernel-uek-debug-5.4.17-2136.306.1.3.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-5.4.17'},\n {'reference':'kernel-uek-debug-5.4.17-2136.306.1.3.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-5.4.17'},\n {'reference':'kernel-uek-debug-devel-5.4.17-2136.306.1.3.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-5.4.17'},\n {'reference':'kernel-uek-debug-devel-5.4.17-2136.306.1.3.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-5.4.17'},\n {'reference':'kernel-uek-devel-5.4.17-2136.306.1.3.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-5.4.17'},\n {'reference':'kernel-uek-devel-5.4.17-2136.306.1.3.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-5.4.17'},\n {'reference':'kernel-uek-doc-5.4.17-2136.306.1.3.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-5.4.17'},\n {'reference':'kernel-uek-tools-5.4.17-2136.306.1.3.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-tools-5.4.17'},\n {'reference':'kernel-uek-tools-5.4.17-2136.306.1.3.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-tools-5.4.17'},\n {'reference':'kernel-uek-tools-libs-5.4.17-2136.306.1.3.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-tools-libs-5.4.17'},\n {'reference':'perf-5.4.17-2136.306.1.3.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python-perf-5.4.17-2136.306.1.3.el7uek', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-uek-5.4.17-2136.306.1.3.el8uek', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-5.4.17'},\n {'reference':'kernel-uek-5.4.17-2136.306.1.3.el8uek', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-5.4.17'},\n {'reference':'kernel-uek-debug-5.4.17-2136.306.1.3.el8uek', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-5.4.17'},\n {'reference':'kernel-uek-debug-5.4.17-2136.306.1.3.el8uek', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-5.4.17'},\n {'reference':'kernel-uek-debug-devel-5.4.17-2136.306.1.3.el8uek', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-5.4.17'},\n {'reference':'kernel-uek-debug-devel-5.4.17-2136.306.1.3.el8uek', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-5.4.17'},\n {'reference':'kernel-uek-devel-5.4.17-2136.306.1.3.el8uek', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-5.4.17'},\n {'reference':'kernel-uek-devel-5.4.17-2136.306.1.3.el8uek', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-5.4.17'},\n {'reference':'kernel-uek-doc-5.4.17-2136.306.1.3.el8uek', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-5.4.17'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek / kernel-uek-debug / kernel-uek-debug-devel / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-17T16:29:56", "description": "According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - A flaw was found in the way the 'flags' member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2022-06-01T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-1781)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2022-0492", "CVE-2022-0617", "CVE-2022-0847"], "modified": "2023-01-13T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-abi-stablelists", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:python3-perf", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2022-1781.NASL", "href": "https://www.tenable.com/plugins/nessus/161752", "sourceData": "##\n# (C) Tenable, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(161752);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/13\");\n\n script_cve_id(\"CVE-2022-0492\", \"CVE-2022-0617\", \"CVE-2022-0847\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-1781)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by\nthe following vulnerabilities :\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the\n kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups\n v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way\n user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw\n to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - A flaw was found in the way the 'flags' member of the new pipe buffer structure was lacking proper\n initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus\n contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache\n backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security\nadvisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional\nissues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2022-1781\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?a3f23d2e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0847\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/06/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/06/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-abi-stablelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar release = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nvar uvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP10\");\n\nvar sp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(10)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP10\");\n\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP10\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nvar flag = 0;\n\nvar pkgs = [\n \"kernel-4.19.90-vhulk2201.1.0.h1035.eulerosv2r10\",\n \"kernel-abi-stablelists-4.19.90-vhulk2201.1.0.h1035.eulerosv2r10\",\n \"kernel-tools-4.19.90-vhulk2201.1.0.h1035.eulerosv2r10\",\n \"kernel-tools-libs-4.19.90-vhulk2201.1.0.h1035.eulerosv2r10\",\n \"python3-perf-4.19.90-vhulk2201.1.0.h1035.eulerosv2r10\"\n];\n\nforeach (var pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"10\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-05T15:56:30", "description": "The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9274 advisory.\n\n - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. (CVE-2021-26341)\n\n - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.\n (CVE-2021-26401)\n\n - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information. (CVE-2022-23960)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. (CVE-2020-36516)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\n - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.\n This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015) (CVE-2022-1016)\n\n - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. (CVE-2022-24448)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-04-11T00:00:00", "type": "nessus", "title": "Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9274)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-5715", "CVE-2020-36516", "CVE-2021-22600", "CVE-2021-26341", "CVE-2021-26401", "CVE-2022-0617", "CVE-2022-1015", "CVE-2022-1016", "CVE-2022-1158", "CVE-2022-22942", "CVE-2022-23960", "CVE-2022-24448", "CVE-2022-26966"], "modified": "2023-04-25T00:00:00", "cpe": ["cpe:/o:oracle:linux:7", "cpe:/o:oracle:linux:8", "p-cpe:/a:oracle:linux:kernel-uek-container", "p-cpe:/a:oracle:linux:kernel-uek-container-debug"], "id": "ORACLELINUX_ELSA-2022-9274.NASL", "href": "https://www.tenable.com/plugins/nessus/159644", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2022-9274.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(159644);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/04/25\");\n\n script_cve_id(\n \"CVE-2020-36516\",\n \"CVE-2021-22600\",\n \"CVE-2021-26341\",\n \"CVE-2021-26401\",\n \"CVE-2022-0617\",\n \"CVE-2022-1016\",\n \"CVE-2022-1158\",\n \"CVE-2022-22942\",\n \"CVE-2022-23960\",\n \"CVE-2022-24448\",\n \"CVE-2022-26966\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/02\");\n\n script_name(english:\"Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9274)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe ELSA-2022-9274 advisory.\n\n - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result\n in data leakage. (CVE-2021-26341)\n\n - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.\n (CVE-2021-26401)\n\n - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,\n aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to\n influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive\n information. (CVE-2022-23960)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the\n hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session\n or terminate that session. (CVE-2020-36516)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to\n obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\n - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.\n This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015) (CVE-2022-1016)\n\n - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through\n crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected\n versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way\n user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw\n to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the\n O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a\n regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file\n descriptor. (CVE-2022-24448)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2022-9274.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel-uek-container and / or kernel-uek-container-debug packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-22600\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2022-1158\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'vmwgfx Driver File Descriptor Handling Priv Esc');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/01/26\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/04/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/04/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-container\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-container-debug\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^(7|8)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7 / 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['5.4.17-2136.306.1.3.el7', '5.4.17-2136.306.1.3.el8'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2022-9274');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '5.4';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-container-5.4.17-2136.306.1.3.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-5.4.17'},\n {'reference':'kernel-uek-container-debug-5.4.17-2136.306.1.3.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-debug-5.4.17'},\n {'reference':'kernel-uek-container-5.4.17-2136.306.1.3.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-5.4.17'},\n {'reference':'kernel-uek-container-debug-5.4.17-2136.306.1.3.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-debug-5.4.17'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek-container / kernel-uek-container-debug');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:42:46", "description": "The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0825 advisory.\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\n - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.\n (CVE-2022-0516)\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:\n Upstream kernel (CVE-2021-0920)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.\n (CVE-2021-4154)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-10T00:00:00", "type": "nessus", "title": "Oracle Linux 8 : kernel (ELSA-2022-0825)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-0920", "CVE-2021-4154", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0516", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2023-01-16T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:bpftool", "p-cpe:/a:oracle:linux:kernel", "p-cpe:/a:oracle:linux:kernel-abi-stablelists", "p-cpe:/a:oracle:linux:kernel-core", "p-cpe:/a:oracle:linux:kernel-cross-headers", "p-cpe:/a:oracle:linux:kernel-debug", "p-cpe:/a:oracle:linux:kernel-debug-core", "p-cpe:/a:oracle:linux:kernel-debug-devel", "p-cpe:/a:oracle:linux:kernel-debug-modules", "p-cpe:/a:oracle:linux:kernel-debug-modules-extra", "p-cpe:/a:oracle:linux:kernel-devel", "p-cpe:/a:oracle:linux:kernel-headers", "p-cpe:/a:oracle:linux:kernel-modules", "p-cpe:/a:oracle:linux:kernel-modules-extra", "p-cpe:/a:oracle:linux:kernel-tools", "p-cpe:/a:oracle:linux:kernel-tools-libs", "p-cpe:/a:oracle:linux:kernel-tools-libs-devel", "p-cpe:/a:oracle:linux:perf", "p-cpe:/a:oracle:linux:python3-perf", "cpe:/o:oracle:linux:8"], "id": "ORACLELINUX_ELSA-2022-0825.NASL", "href": "https://www.tenable.com/plugins/nessus/158794", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2022-0825.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158794);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/16\");\n\n script_cve_id(\n \"CVE-2021-0920\",\n \"CVE-2021-4154\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0516\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"Oracle Linux 8 : kernel (ELSA-2022-0825)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2022-0825 advisory.\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the\n kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups\n v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\n - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for\n s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain\n unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.\n (CVE-2022-0516)\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper\n initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus\n contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache\n backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This\n could lead to local escalation of privilege with System execution privileges needed. User interaction is\n not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:\n Upstream kernel (CVE-2021-0920)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's\n cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting\n the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.\n (CVE-2021-4154)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2022-0825.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-abi-stablelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-cross-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['4.18.0-348.20.1.el8_5'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2022-0825');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '4.18';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-4.18.0'},\n {'reference':'kernel-abi-stablelists-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-abi-stablelists-4.18.0'},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-core-4.18.0'},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-cross-headers-4.18.0'},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-cross-headers-4.18.0'},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debug-4.18.0'},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debug-core-4.18.0'},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debug-devel-4.18.0'},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debug-modules-4.18.0'},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debug-modules-extra-4.18.0'},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-devel-4.18.0'},\n {'reference':'kernel-headers-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-headers-4.18.0'},\n {'reference':'kernel-headers-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-headers-4.18.0'},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-4.18.0'},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-4.18.0'},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-4.18.0'},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-4.18.0'},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-libs-4.18.0'},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-libs-4.18.0'},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-libs-devel-4.18.0'},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-libs-devel-4.18.0'},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-stablelists / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:37:05", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0825 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-11T00:00:00", "type": "nessus", "title": "RHEL 8 : kernel (RHSA-2022:0825)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-0920", "CVE-2021-4154", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0516", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:bpftool", "p-cpe:/a:redhat:enterprise_linux:kernel", "p-cpe:/a:redhat:enterprise_linux:kernel-abi-stablelists", "p-cpe:/a:redhat:enterprise_linux:kernel-core", "p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers", "p-cpe:/a:redhat:enterprise_linux:kernel-debug", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-core", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra", "p-cpe:/a:redhat:enterprise_linux:kernel-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra", "p-cpe:/a:redhat:enterprise_linux:kernel-tools", "p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs", "p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-core", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-extra", "p-cpe:/a:redhat:enterprise_linux:perf", "p-cpe:/a:redhat:enterprise_linux:python3-perf"], "id": "REDHAT-RHSA-2022-0825.NASL", "href": "https://www.tenable.com/plugins/nessus/158822", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:0825. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158822);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\n \"CVE-2021-0920\",\n \"CVE-2021-4154\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0516\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0825\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"RHEL 8 : kernel (RHSA-2022:0825)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:0825 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container\n breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-0920\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0435\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0492\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0516\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0847\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-22942\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0825\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2031930\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2034514\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2048738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2050237\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2051505\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2060795\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n script_cwe_id(120, 200, 201, 281, 287, 416, 665, 787);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-abi-stablelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python3-perf\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2021-0920', 'CVE-2021-4154', 'CVE-2022-0330', 'CVE-2022-0435', 'CVE-2022-0492', 'CVE-2022-0516', 'CVE-2022-0847', 'CVE-2022-22942');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for RHSA-2022:0825');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-abi-stablelists-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-core-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-devel-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-modules-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-modules-extra-4.18.0-348.20.1.el8_5', 'sp':'6', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'sp':'6', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-abi-stablelists-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-4.18.0-348.20.1.el8_5', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-core-4.18.0-348.20.1.el8_5', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-devel-4.18.0-348.20.1.el8_5', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-modules-4.18.0-348.20.1.el8_5', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-zfcpdump-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp']) && !enterprise_linux_flag) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-stablelists / kernel-core / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-05T07:44:15", "description": "The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0825 advisory.\n\n - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:\n Upstream kernel (CVE-2021-0920)\n\n - A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.\n (CVE-2021-4154)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network. (CVE-2022-0435)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.\n (CVE-2022-0516)\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2023-08-07T00:00:00", "type": "nessus", "title": "AlmaLinux 8 : kernel (ALSA-2022:0825)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-0920", "CVE-2021-4154", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0516", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2023-08-08T00:00:00", "cpe": ["p-cpe:/a:alma:linux:bpftool", "p-cpe:/a:alma:linux:kernel", "p-cpe:/a:alma:linux:kernel-abi-stablelists", "p-cpe:/a:alma:linux:kernel-core", "p-cpe:/a:alma:linux:kernel-cross-headers", "p-cpe:/a:alma:linux:kernel-debug", "p-cpe:/a:alma:linux:kernel-debug-core", "p-cpe:/a:alma:linux:kernel-debug-devel", "p-cpe:/a:alma:linux:kernel-debug-modules", "p-cpe:/a:alma:linux:kernel-debug-modules-extra", "p-cpe:/a:alma:linux:kernel-devel", "p-cpe:/a:alma:linux:kernel-modules", "p-cpe:/a:alma:linux:kernel-modules-extra", "p-cpe:/a:alma:linux:kernel-tools", "p-cpe:/a:alma:linux:kernel-tools-libs", "p-cpe:/a:alma:linux:kernel-tools-libs-devel", "p-cpe:/a:alma:linux:kernel-zfcpdump", "p-cpe:/a:alma:linux:kernel-zfcpdump-core", "p-cpe:/a:alma:linux:kernel-zfcpdump-devel", "p-cpe:/a:alma:linux:kernel-zfcpdump-modules", "p-cpe:/a:alma:linux:kernel-zfcpdump-modules-extra", "p-cpe:/a:alma:linux:perf", "p-cpe:/a:alma:linux:python3-perf", "cpe:/o:alma:linux:8", "cpe:/o:alma:linux:8::baseos", "cpe:/o:alma:linux:8::powertools"], "id": "ALMA_LINUX_ALSA-2022-0825.NASL", "href": "https://www.tenable.com/plugins/nessus/179417", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# AlmaLinux Security Advisory ALSA-2022:0825.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(179417);\n script_version(\"1.1\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/08/08\");\n\n script_cve_id(\n \"CVE-2021-0920\",\n \"CVE-2021-4154\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0516\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"ALSA\", value:\"2022:0825\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"AlmaLinux 8 : kernel (ALSA-2022:0825)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote AlmaLinux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nALSA-2022:0825 advisory.\n\n - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This\n could lead to local escalation of privilege with System execution privileges needed. User interaction is\n not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:\n Upstream kernel (CVE-2021-0920)\n\n - A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's\n cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting\n the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.\n (CVE-2021-4154)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the\n way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or\n escalate their privileges on the system. (CVE-2022-0330)\n\n - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends\n a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.\n This flaw allows a remote user to crash the system or possibly escalate their privileges if they have\n access to the TIPC network. (CVE-2022-0435)\n\n - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the\n kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups\n v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.\n (CVE-2022-0492)\n\n - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for\n s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain\n unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.\n (CVE-2022-0516)\n\n - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper\n initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus\n contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache\n backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.almalinux.org/8/ALSA-2022-0825.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'vmwgfx Driver File Descriptor Handling Priv Esc');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n script_cwe_id(120, 200, 281, 287, 416, 665);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/08/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-abi-stablelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-cross-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-zfcpdump\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-zfcpdump-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-zfcpdump-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-zfcpdump-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:kernel-zfcpdump-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:alma:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:alma:linux:8::baseos\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:alma:linux:8::powertools\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Alma Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AlmaLinux/release\", \"Host/AlmaLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/AlmaLinux/release');\nif (isnull(os_release) || 'AlmaLinux' >!< os_release) audit(AUDIT_OS_NOT, 'AlmaLinux');\nvar os_ver = pregmatch(pattern: \"AlmaLinux release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'AlmaLinux 8.x', 'AlmaLinux ' + os_ver);\n\nif (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2021-0920', 'CVE-2021-4154', 'CVE-2022-0330', 'CVE-2022-0435', 'CVE-2022-0492', 'CVE-2022-0516', 'CVE-2022-0847', 'CVE-2022-22942');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ALSA-2022:0825');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\nvar pkgs = [\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-abi-stablelists-4.18.0-348.20.1.el8_5', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-devel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'Alma-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-stablelists / kernel-core / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:43:30", "description": "The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:0825 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-29T00:00:00", "type": "nessus", "title": "CentOS 8 : kernel (CESA-2022:0825)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-0920", "CVE-2021-4154", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-0516", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2023-01-13T00:00:00", "cpe": ["cpe:/o:centos:centos:8", "cpe:/o:centos:centos:8-stream", "p-cpe:/a:centos:centos:kernel"], "id": "CENTOS8_RHSA-2022-0825.NASL", "href": "https://www.tenable.com/plugins/nessus/159302", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# Red Hat Security Advisory RHSA-2022:0825. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(159302);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/13\");\n\n script_cve_id(\n \"CVE-2021-0920\",\n \"CVE-2021-4154\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-0516\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0825\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"CentOS 8 : kernel (CESA-2022:0825)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the\nCESA-2022:0825 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container\n breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0825\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/29\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:8-stream\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:kernel\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nvar os_ver = pregmatch(pattern: \"CentOS(?: Stream)?(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nvar os_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2021-0920', 'CVE-2021-4154', 'CVE-2022-0330', 'CVE-2022-0435', 'CVE-2022-0492', 'CVE-2022-0516', 'CVE-2022-0847', 'CVE-2022-22942');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for CESA-2022:0825');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nvar pkgs = [\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-348.20.1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'CentOS-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-05T15:47:37", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0849 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-15T00:00:00", "type": "nessus", "title": "RHEL 8 : kpatch-patch (RHSA-2022:0849)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-0920", "CVE-2021-4154", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0492", "CVE-2022-22942"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-348", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-348_12_2", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-348_2_1", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-348_7_1"], "id": "REDHAT-RHSA-2022-0849.NASL", "href": "https://www.tenable.com/plugins/nessus/158912", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:0849. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158912);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\n \"CVE-2021-0920\",\n \"CVE-2021-4154\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0492\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0849\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"RHEL 8 : kpatch-patch (RHSA-2022:0849)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:0849 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container\n breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-0920\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0435\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0492\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-22942\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0849\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2031930\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2034514\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2048738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2051505\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'vmwgfx Driver File Descriptor Handling Priv Esc');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_cwe_id(120, 281, 287, 416, 787);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/15\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-348\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-348_12_2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-348_2_1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-348_7_1\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar uname_r = get_kb_item(\"Host/uname-r\");\nif (empty_or_null(uname_r)) audit(AUDIT_UNKNOWN_APP_VER, \"kernel\");\n\nvar kernel_live_checks = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'kernels': {\n '4.18.0-348.el8.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348-1-3.el8', 'sp':'6', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.el8.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348-1-3.el8', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.12.2.el8_5.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_12_2-1-1.el8_5', 'sp':'6', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.12.2.el8_5.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_12_2-1-1.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.2.1.el8_5.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_2_1-1-2.el8_5', 'sp':'6', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.2.1.el8_5.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_2_1-1-2.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.7.1.el8_5.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_7_1-1-2.el8_5', 'sp':'6', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.7.1.el8_5.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_7_1-1-2.el8_5', 'sp':'6', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n }\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'kernels': {\n '4.18.0-348.el8.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348-1-3.el8', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.el8.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348-1-3.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.12.2.el8_5.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_12_2-1-1.el8_5', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.12.2.el8_5.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_12_2-1-1.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.2.1.el8_5.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_2_1-1-2.el8_5', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.2.1.el8_5.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_2_1-1-2.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.7.1.el8_5.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_7_1-1-2.el8_5', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-348.7.1.el8_5.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-348_7_1-1-2.el8_5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n }\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:kernel_live_checks);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nvar kernel_affected = FALSE;\nforeach var kernel_array ( kernel_live_checks ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(kernel_array['repo_relative_urls'])) repo_relative_urls = kernel_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n var kpatch_details = kernel_array['kernels'][uname_r];\n if (empty_or_null(kpatch_details)) continue;\n kernel_affected = TRUE;\n foreach var pkg ( kpatch_details['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp']) && !enterprise_linux_flag) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n# No kpatch details found for the running kernel version\nif (!kernel_affected) audit(AUDIT_INST_VER_NOT_VULN, 'kernel', uname_r);\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kpatch-patch-4_18_0-348 / kpatch-patch-4_18_0-348_12_2 / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-05T15:50:12", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0925 advisory.\n\n - kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-15T00:00:00", "type": "nessus", "title": "RHEL 8 : kpatch-patch (RHSA-2022:0925)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-4083", "CVE-2022-0330", "CVE-2022-0492", "CVE-2022-22942"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:rhel_aus:8.2", "cpe:/o:redhat:rhel_e4s:8.2", "cpe:/o:redhat:rhel_eus:8.2", "cpe:/o:redhat:rhel_tus:8.2", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_47_1", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_51_1", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_56_1", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_60_2", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_64_1", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_65_2", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_68_1", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_70_1", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_71_1", "p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_75_1"], "id": "REDHAT-RHSA-2022-0925.NASL", "href": "https://www.tenable.com/plugins/nessus/158951", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:0925. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158951);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\n \"CVE-2021-4083\",\n \"CVE-2022-0330\",\n \"CVE-2022-0492\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0925\");\n\n script_name(english:\"RHEL 8 : kpatch-patch (RHSA-2022:0925)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:0925 advisory.\n\n - kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4083\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0492\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-22942\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0925\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2029923\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2051505\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0492\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'vmwgfx Driver File Descriptor Handling Priv Esc');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_cwe_id(281, 287, 416);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/01/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/15\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_47_1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_51_1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_56_1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_60_2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_64_1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_65_2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_68_1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_70_1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_71_1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kpatch-patch-4_18_0-193_75_1\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '8.2')) audit(AUDIT_OS_NOT, 'Red Hat 8.2', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar uname_r = get_kb_item(\"Host/uname-r\");\nif (empty_or_null(uname_r)) audit(AUDIT_UNKNOWN_APP_VER, \"kernel\");\n\nvar kernel_live_checks = [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.2/x86_64/appstream/debug',\n 'content/aus/rhel8/8.2/x86_64/appstream/os',\n 'content/aus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.2/x86_64/baseos/debug',\n 'content/aus/rhel8/8.2/x86_64/baseos/os',\n 'content/aus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.2/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.2/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.2/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.2/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.2/ppc64le/sap/os',\n 'content/e4s/rhel8/8.2/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.2/x86_64/appstream/os',\n 'content/e4s/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.2/x86_64/baseos/os',\n 'content/e4s/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.2/x86_64/sap/debug',\n 'content/e4s/rhel8/8.2/x86_64/sap/os',\n 'content/e4s/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.2/ppc64le/appstream/os',\n 'content/eus/rhel8/8.2/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.2/ppc64le/baseos/os',\n 'content/eus/rhel8/8.2/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.2/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.2/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.2/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.2/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/sap/debug',\n 'content/eus/rhel8/8.2/ppc64le/sap/os',\n 'content/eus/rhel8/8.2/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.2/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/appstream/debug',\n 'content/eus/rhel8/8.2/x86_64/appstream/os',\n 'content/eus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/baseos/debug',\n 'content/eus/rhel8/8.2/x86_64/baseos/os',\n 'content/eus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.2/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.2/x86_64/highavailability/os',\n 'content/eus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.2/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.2/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/sap/debug',\n 'content/eus/rhel8/8.2/x86_64/sap/os',\n 'content/eus/rhel8/8.2/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.2/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.2/x86_64/supplementary/os',\n 'content/eus/rhel8/8.2/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/appstream/debug',\n 'content/tus/rhel8/8.2/x86_64/appstream/os',\n 'content/tus/rhel8/8.2/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/baseos/debug',\n 'content/tus/rhel8/8.2/x86_64/baseos/os',\n 'content/tus/rhel8/8.2/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.2/x86_64/highavailability/os',\n 'content/tus/rhel8/8.2/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/nfv/debug',\n 'content/tus/rhel8/8.2/x86_64/nfv/os',\n 'content/tus/rhel8/8.2/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.2/x86_64/rt/debug',\n 'content/tus/rhel8/8.2/x86_64/rt/os',\n 'content/tus/rhel8/8.2/x86_64/rt/source/SRPMS'\n ],\n 'kernels': {\n '4.18.0-193.47.1.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_47_1-1-10.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.47.1.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_47_1-1-10.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.51.1.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_51_1-1-7.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.51.1.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_51_1-1-7.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.56.1.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_56_1-1-6.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.56.1.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_56_1-1-6.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.60.2.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_60_2-1-5.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.60.2.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_60_2-1-5.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.64.1.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_64_1-1-4.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.64.1.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_64_1-1-4.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.65.2.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_65_2-1-3.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.65.2.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_65_2-1-3.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.68.1.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_68_1-1-3.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.68.1.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_68_1-1-3.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.70.1.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_70_1-1-2.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.70.1.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_70_1-1-2.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.71.1.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_71_1-1-2.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.71.1.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_71_1-1-2.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.75.1.el8_2.ppc64le': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_75_1-1-1.el8_2', 'sp':'2', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n ]\n },\n '4.18.0-193.75.1.el8_2.x86_64': {\n 'pkgs': [\n {'reference':'kpatch-patch-4_18_0-193_75_1-1-1.el8_2', 'sp':'2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n }\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:kernel_live_checks);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nvar kernel_affected = FALSE;\nforeach var kernel_array ( kernel_live_checks ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(kernel_array['repo_relative_urls'])) repo_relative_urls = kernel_array['repo_relative_urls'];\n var kpatch_details = kernel_array['kernels'][uname_r];\n if (empty_or_null(kpatch_details)) continue;\n kernel_affected = TRUE;\n foreach var pkg ( kpatch_details['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n# No kpatch details found for the running kernel version\nif (!kernel_affected) audit(AUDIT_INST_VER_NOT_VULN, 'kernel', uname_r);\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Advanced Update Support, Extended Update Support, Telco Extended Update Support or Update Services for SAP Solutions repositories.\\n' +\n 'Access to these repositories requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kpatch-patch-4_18_0-193_47_1 / kpatch-patch-4_18_0-193_51_1 / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:44:05", "description": "The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9260 advisory.\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. (CVE-2020-36516)\n\n - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. (CVE-2021-20322)\n\n - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-04-05T00:00:00", "type": "nessus", "title": "Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2022-9260)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-36516", "CVE-2021-20322", "CVE-2021-3772", "CVE-2022-0330", "CVE-2022-26966"], "modified": "2022-05-06T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek-firmware"], "id": "ORACLELINUX_ELSA-2022-9260.NASL", "href": "https://www.tenable.com/plugins/nessus/159519", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2022-9260.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(159519);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/06\");\n\n script_cve_id(\n \"CVE-2020-36516\",\n \"CVE-2021-3772\",\n \"CVE-2021-20322\",\n \"CVE-2022-0330\",\n \"CVE-2022-26966\"\n );\n\n script_name(english:\"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2022-9260)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe ELSA-2022-9260 advisory.\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the\n way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or\n escalate their privileges on the system. (CVE-2022-0330)\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the\n hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session\n or terminate that session. (CVE-2020-36516)\n\n - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux\n kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an\n off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this\n vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source\n port randomization are indirectly affected as well. (CVE-2021-20322)\n\n - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP\n association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and\n the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to\n obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2022-9260.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-3772\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2022-0330\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/04/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/04/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-firmware\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 6 / 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['4.1.12-124.61.2.el6uek', '4.1.12-124.61.2.el7uek'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2022-9260');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '4.1';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-4.1.12-124.61.2.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-debug-4.1.12-124.61.2.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.1.12'},\n {'reference':'kernel-uek-debug-devel-4.1.12-124.61.2.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.1.12'},\n {'reference':'kernel-uek-devel-4.1.12-124.61.2.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.1.12'},\n {'reference':'kernel-uek-doc-4.1.12-124.61.2.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-124.61.2.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'},\n {'reference':'kernel-uek-4.1.12-124.61.2.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-debug-4.1.12-124.61.2.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.1.12'},\n {'reference':'kernel-uek-debug-devel-4.1.12-124.61.2.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.1.12'},\n {'reference':'kernel-uek-devel-4.1.12-124.61.2.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.1.12'},\n {'reference':'kernel-uek-doc-4.1.12-124.61.2.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-124.61.2.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek / kernel-uek-debug / kernel-uek-debug-devel / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:44:26", "description": "The remote OracleVM system is missing necessary patches to address security updates:\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. (CVE-2020-36516)\n\n - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. (CVE-2021-20322)\n\n - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-04-05T00:00:00", "type": "nessus", "title": "OracleVM 3.4 : kernel-uek (OVMSA-2022-0011)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-36516", "CVE-2021-20322", "CVE-2021-3772", "CVE-2022-0330", "CVE-2022-26966"], "modified": "2022-05-06T00:00:00", "cpe": ["p-cpe:/a:oracle:vm:kernel-uek", "p-cpe:/a:oracle:vm:kernel-uek-firmware", "cpe:/o:oracle:vm_server:3.4"], "id": "ORACLEVM_OVMSA-2022-0011.NASL", "href": "https://www.tenable.com/plugins/nessus/159525", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were\n# extracted from OracleVM Security Advisory OVMSA-2022-0011.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(159525);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/06\");\n\n script_cve_id(\n \"CVE-2020-36516\",\n \"CVE-2021-3772\",\n \"CVE-2021-20322\",\n \"CVE-2022-0330\",\n \"CVE-2022-26966\"\n );\n\n script_name(english:\"OracleVM 3.4 : kernel-uek (OVMSA-2022-0011)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote OracleVM host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote OracleVM system is missing necessary patches to address security updates:\n\n - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the\n hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session\n or terminate that session. (CVE-2020-36516)\n\n - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux\n kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an\n off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this\n vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source\n port randomization are indirectly affected as well. (CVE-2021-20322)\n\n - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP\n association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and\n the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)\n\n - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the\n way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or\n escalate their privileges on the system. (CVE-2022-0330)\n\n - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to\n obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/cve/CVE-2020-36516.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/cve/CVE-2021-20322.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/cve/CVE-2021-3772.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/cve/CVE-2022-0330.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/cve/CVE-2022-26966.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/OVMSA-2022-0011.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel-uek / kernel-uek-firmware packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-3772\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2022-0330\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/04/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/04/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.4\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"3\\.4\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.4\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['4.1.12-124.61.2.el6uek'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for OVMSA-2022-0011');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '4.1';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-4.1.12-124.61.2.el6uek', 'cpu':'x86_64', 'release':'3.4', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-124.61.2.el6uek', 'cpu':'x86_64', 'release':'3.4', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'OVS' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release && (!exists_check || rpm_exists(release:release, rpm:exists_check))) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek / kernel-uek-firmware');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-19T14:49:41", "description": "The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0841 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\n - cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands (CVE-2022-24407)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-15T00:00:00", "type": "nessus", "title": "RHEL 8 : Red Hat Virtualization Host security and bug fix update [ovirt-4.4.10] Async #1 (Important) (RHSA-2022:0841)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-0920", "CVE-2021-4154", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0847", "CVE-2022-22942", "CVE-2022-24407"], "modified": "2023-02-02T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "p-cpe:/a:redhat:enterprise_linux:redhat-virtualization-host-image-update"], "id": "REDHAT-RHSA-2022-0841.NASL", "href": "https://www.tenable.com/plugins/nessus/158924", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:0841. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158924);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/02\");\n\n script_cve_id(\n \"CVE-2021-0920\",\n \"CVE-2021-4154\",\n \"CVE-2022-0330\",\n \"CVE-2022-0435\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\",\n \"CVE-2022-24407\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0841\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"RHEL 8 : Red Hat Virtualization Host security and bug fix update [ovirt-4.4.10] Async #1 (Important) (RHSA-2022:0841)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:0841 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container\n breakout (CVE-2021-4154)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\n - cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands\n (CVE-2022-24407)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-0920\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0435\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0847\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-22942\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-24407\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0841\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2031930\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2034514\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2048738\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2055326\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2060795\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected redhat-virtualization-host-image-update package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0435\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2022-24407\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n script_cwe_id(20, 89, 120, 281, 416, 665, 787);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/15\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:redhat-virtualization-host-image-update\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/dist/layered/rhel8/x86_64/rhv-mgmt-agent/4/debug',\n 'content/dist/layered/rhel8/x86_64/rhv-mgmt-agent/4/os',\n 'content/dist/layered/rhel8/x86_64/rhv-mgmt-agent/4/source/SRPMS',\n 'content/dist/layered/rhel8/x86_64/rhv-tools/4/debug',\n 'content/dist/layered/rhel8/x86_64/rhv-tools/4/os',\n 'content/dist/layered/rhel8/x86_64/rhv-tools/4/source/SRPMS',\n 'content/dist/layered/rhel8/x86_64/rhvh-build/4/debug',\n 'content/dist/layered/rhel8/x86_64/rhvh-build/4/os',\n 'content/dist/layered/rhel8/x86_64/rhvh-build/4/source/SRPMS',\n 'content/dist/layered/rhel8/x86_64/rhvh/4/debug',\n 'content/dist/layered/rhel8/x86_64/rhvh/4/os',\n 'content/dist/layered/rhel8/x86_64/rhvh/4/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'redhat-virtualization-host-image-update-4.4.10-202203101736_8.5', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'redhat-release-virtualization-host-4'}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'redhat-virtualization-host-image-update');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:37:26", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0823 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: use-after-free in RDMA listen() (CVE-2021-4028)\n\n - kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-11T00:00:00", "type": "nessus", "title": "RHEL 8 : kernel (RHSA-2022:0823)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-0920", "CVE-2021-4028", "CVE-2021-4083", "CVE-2022-0330", "CVE-2022-0492", "CVE-2022-0847", "CVE-2022-22942"], "modified": "2023-05-25T00:00:00", "cpe": ["cpe:/o:redhat:rhel_e4s:8.1", "p-cpe:/a:redhat:enterprise_linux:bpftool", "p-cpe:/a:redhat:enterprise_linux:kernel", "p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists", "p-cpe:/a:redhat:enterprise_linux:kernel-core", "p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers", "p-cpe:/a:redhat:enterprise_linux:kernel-debug", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-core", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra", "p-cpe:/a:redhat:enterprise_linux:kernel-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-modules", "p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra", "p-cpe:/a:redhat:enterprise_linux:kernel-tools", "p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs", "p-cpe:/a:redhat:enterprise_linux:perf", "p-cpe:/a:redhat:enterprise_linux:python3-perf"], "id": "REDHAT-RHSA-2022-0823.NASL", "href": "https://www.tenable.com/plugins/nessus/158805", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:0823. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158805);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/05/25\");\n\n script_cve_id(\n \"CVE-2021-0920\",\n \"CVE-2021-4028\",\n \"CVE-2021-4083\",\n \"CVE-2022-0330\",\n \"CVE-2022-0492\",\n \"CVE-2022-0847\",\n \"CVE-2022-22942\"\n );\n script_xref(name:\"RHSA\", value:\"2022:0823\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/05/16\");\n\n script_name(english:\"RHEL 8 : kernel (RHSA-2022:0823)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:0823 advisory.\n\n - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)\n\n - kernel: use-after-free in RDMA listen() (CVE-2021-4028)\n\n - kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)\n\n - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)\n\n - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)\n\n - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)\n\n - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-0920\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4028\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4083\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0492\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-0847\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-22942\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:0823\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2027201\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2029923\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2031930\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2042404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2044809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2051505\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2060795\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-0847\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Dirty Pipe Local Privilege Escalation via CVE-2022-0847');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n script_cwe_id(281, 287, 416, 665);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/12/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python3-perf\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'eq', os_version: os_ver, rhel_version: '8.1')) audit(AUDIT_OS_NOT, 'Red Hat 8.1', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n var cve_list = make_list('CVE-2021-0920', 'CVE-2021-4028', 'CVE-2021-4083', 'CVE-2022-0330', 'CVE-2022-0492', 'CVE-2022-0847', 'CVE-2022-22942');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for RHSA-2022:0823');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/e4s/rhel8/8.1/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.1/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.1/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.1/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.1/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.1/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.1/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.1/ppc64le/sap/os',\n 'content/e4s/rhel8/8.1/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.1/x86_64/appstream/os',\n 'content/e4s/rhel8/8.1/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.1/x86_64/baseos/os',\n 'content/e4s/rhel8/8.1/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.1/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.1/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.1/x86_64/sap/debug',\n 'content/e4s/rhel8/8.1/x86_64/sap/os',\n 'content/e4s/rhel8/8.1/x86_64/sap/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'bpftool-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'bpftool-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-abi-whitelists-4.18.0-147.64.1.el8_1', 'sp':'1', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-core-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-cross-headers-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-core-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-devel-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-debug-modules-extra-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-devel-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-modules-extra-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-tools-libs-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'perf-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'ppc64le', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-perf-4.18.0-147.64.1.el8_1', 'sp':'1', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var subscription_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in the Red Hat Enterprise Linux\\n' +\n 'Update Services for SAP Solutions repository.\\n' +\n 'Access to this repository requires a paid RHEL subscription.\\n';\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = subscription_caveat + rpm_report_get() + redhat_report_repo_caveat();\n else extra = subscription_caveat + rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-whitelists / kernel-core / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-09-09T15:22:20", "description": "According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system. (CVE-2021-4197)\n\n - A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (CVE-2021-3669)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. (CVE-2022-24448)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2022-04-25T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP5 : kernel (EulerOS-SA-2022-1537)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-3669", "CVE-2021-4197", "CVE-2022-0617", "CVE-2022-22942", "CVE-2022-24448"], "modified": "2023-03-21T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2022-1537.NASL", "href": "https://www.tenable.com/plugins/nessus/160116", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(160116);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/21\");\n\n script_cve_id(\n \"CVE-2021-3669\",\n \"CVE-2021-4197\",\n \"CVE-2022-0617\",\n \"CVE-2022-22942\",\n \"CVE-2022-24448\"\n );\n\n script_name(english:\"EulerOS 2.0 SP5 : kernel (EulerOS-SA-2022-1537)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by\nthe following vulnerabilities :\n\n - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces\n subsystem was found in the way users have access to some less privileged process that are controlled by\n cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of\n control groups. A local user could use this flaw to crash the system or escalate their privileges on the\n system. (CVE-2021-4197)\n\n - A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large\n shared memory segment counts which could lead to resource exhaustion and DoS. (CVE-2021-3669)\n\n - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way\n user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw\n to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the\n O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a\n regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file\n descriptor. (CVE-2022-24448)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security\nadvisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional\nissues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2022-1537\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c95538f0\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-4197\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'vmwgfx Driver File Descriptor Handling Priv Esc');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/04/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/04/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar release = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nvar uvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nvar sp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(5)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nvar flag = 0;\n\nvar pkgs = [\n \"kernel-3.10.0-862.14.1.5.h675.eulerosv2r7\",\n \"kernel-devel-3.10.0-862.14.1.5.h675.eulerosv2r7\",\n \"kernel-headers-3.10.0-862.14.1.5.h675.eulerosv2r7\",\n \"kernel-tools-3.10.0-862.14.1.5.h675.eulerosv2r7\",\n \"kernel-tools-libs-3.10.0-862.14.1.5.h675.eulerosv2r7\",\n \"perf-3.10.0-862.14.1.5.h675.eulerosv2r7\",\n \"python-perf-3.10.0-862.14.1.5.h675.eulerosv2r7\"\n];\n\nforeach (var pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"5\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-19T14:49:49", "description": "The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5092 advisory.\n\n - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).\n (CVE-2021-43976)\n\n - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. (CVE-2022-24448)\n\n - An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c. (CVE-2022-24959)\n\n - An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.\n (CVE-2022-25258)\n\n - An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory. (CVE-2022-25375)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2022-03-07T00:00:00", "type": "nessus", "title": "Debian DSA-5092-1 : linux - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-43976", "CVE-2022-0330", "CVE-2022-0435", "CVE-2022-0516", "CVE-2022-0847", "CVE-2022-22942", "CVE-2022-24448", "CVE-2022-24959", "CVE-2022-25258", "CVE-2022-25375"], "modified": "2023-01-16T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:affs-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:affs-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:affs-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:affs-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:affs-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:affs-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:affs-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:affs-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:ata-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:bpftool", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:btrfs-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:cdrom-core-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:crc-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:crypto-dm-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:crypto-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:dasd-extra-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:dasd-extra-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:dasd-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:dasd-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:efi-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:efi-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:event-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:ext4-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:f2fs-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:fancontrol-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:fancontrol-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-10-octeon-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-10-s390x-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-9-octeon-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:fat-modules-5.10.0-9-s390x-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-10-marvell-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-9-armmdi", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-9-marvell-di", "p-cpe:/a:debian:debian_linux:fb-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:input-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:firewire-core-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:firewire-core-modules-5.10.0-10-powerpc64le-di", "p-cpe:/a:debian:debian_linux:firewire-core-modules-5.10.0-9-loongson-3-di", "p-cpe:/a:debian:debian_linux:firewire-core-modules-5.10.0-9-powerpc64le-di", "p-cpe:/a:debian:debian_linux:input-modules-5.10.0-9-4kc-malta-di", "p-cpe:/a:debian:debian_linux:fuse-modules-5.10.0-10-4kc-malta-di", "p-cpe:/a:debian:debian_linux:fuse-modules-5.10.0-10-5kc-malta-di", "p-cpe:/a:debian:debian_linux:input-modules-5.10.0-9-5kc-malta-di", "p-cpe:/a:debian:debian_linux:fuse-modules-5.10.0-10-armmdi", "p-cpe:/a:debian:debian_linux:fuse-modules-5.10.0-10-loongson-3-di", "p-cpe:/a:debian:debian_linux:input-modules-5.10.0-9-armmdi&quo