# changelog

author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.35.2.el7uek]
changelog:
  - tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Eric Dumazet)  [Orabug: 29886600]  {CVE-2019-11477} 
  - tcp: add tcp_min_snd_mss sysctl (Eric Dumazet)  [Orabug: 29884307]  {CVE-2019-11479} 
  - tcp: tcp_fragment() should apply sane memory limits (Eric Dumazet)  [Orabug: 29884307]  {CVE-2019-11478} 
  - tcp: fix fack_count accounting on tcp_shift_skb_data() (Joao Martins)  [Orabug: 29890831]  {CVE-2019-11477} 
  - tcp: limit payload size of sacked skbs (Eric Dumazet)  [Orabug: 29884307]  {CVE-2019-11477}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.35.1.el7uek]
changelog:
  - Bluetooth: hidp: fix buffer overflow (Young Xiao)  [Orabug: 29786787]  {CVE-2011-1079} {CVE-2019-11884} 
  - x86/speculation/mds: Fix verw usage to use memory operand (Patrick Colp)  [Orabug: 29791038]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} 
  - x86/speculation/mds: Make cpu_vuln_whitelist __cpuinitconst (Patrick Colp)  [Orabug: 29792023]  
  - x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Thomas Gleixner)  [Orabug: 29792061]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.34.1.el7uek]
changelog:
  - Input: wacom - move the USB (now hid) Wacom driver in drivers/hid (Benjamin Tissoires)  [Orabug: 25512494]  {CVE-2016-3139} 
  - net: qmi_wwan: fix divide by 0 on bad descriptors (Bjørn Mork)  [Orabug: 27215229]  {CVE-2017-16650} 
  - USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data (Hui Peng)  [Orabug: 29605987]  {CVE-2018-19985} {CVE-2018-19985} 
  - KEYS: encrypted: fix buffer overread in valid_master_desc() (Eric Biggers)  [Orabug: 29605993]  {CVE-2017-13305} 
  - ecryptfs: don't allow mmap when the lower fs doesn't support it (Jeff Mahoney)  [Orabug: 29666607]  {CVE-2016-1583} {CVE-2016-1583} 
  - Revert "ecryptfs: forbid opening files without mmap handler" (Brian Maly)  [Orabug: 29666607]  {CVE-2016-1583} 
  - binfmt_elf: switch to new creds when switching to new mm (Linus Torvalds)  [Orabug: 29677234]  {CVE-2019-11190}


author: Chuck Anderson <chuck.anderson@oracle.com> [3.8.13-118.33.2.el7uek]
changelog:
  - x86/speculation/mds: Make cpu_matches() __cpuinit (Patrick Colp)  [Orabug: 29751729]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} 
  - x86/speculation/mds: Only worry about firmware loaded microcode (Patrick Colp)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091}


author: Chuck Anderson <chuck.anderson@oracle.com> [3.8.13-118.33.1.el7uek]
changelog:
  - x86/mds: Add empty commit for CVE-2019-11091 (Patrick Colp)  [Orabug: 29721936]  {CVE-2019-11091} 
  - x86/speculation/mds: Fix comment (Boris Ostrovsky)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mitigation mode VMWERV (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add sysfs reporting for MDS (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mitigation control for MDS (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Allow runtime checking of CPU features (Patrick Colp)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Improve coverage for MDS vulnerability (Boris Ostrovsky)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Clear CPU buffers on exit to user (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mds_clear_cpu_buffers() (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add BUG_MSBDS_ONLY (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add basic bug infrastructure for MDS (Andi Kleen)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation: Consolidate CPU whitelists (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.12.el7uek]
changelog:
  - nvme: Drop nvmeq->q_lock before dma_pool_alloc(), so as to prevent hard lockups (Aruna Ramakrishna)  [Orabug: 25409587]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.11.el7uek]
changelog:
  - nvme: Handle PM1725 HIL reset (Martin K. Petersen)  [Orabug: 26277600]  
  - char: lp: fix possible integer overflow in lp_setup() (Willy Tarreau)  [Orabug: 26403940]  {CVE-2017-1000363} 
  - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race between read and ioctl (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race (Vegard Nossum)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix negative queue usage by racy accesses (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG Cong)  [Orabug: 26404005]  {CVE-2017-9077} 
  - ocfs2: fix deadlock issue when taking inode lock at vfs entry points (Eric Ren)  [Orabug: 26427126]  
  - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock (Eric Ren)  [Orabug: 26427126]  
  - ping: implement proper locking (Eric Dumazet)  [Orabug: 26540286]  {CVE-2017-2671} 
  - aio: mark AIO pseudo-fs noexec (Jann Horn)  [Orabug: 26643598]  {CVE-2016-10044} 
  - vfs: Commit to never having exectuables on proc and sysfs. (Eric W. Biederman)  [Orabug: 26643598]  {CVE-2016-10044} 
  - vfs, writeback: replace FS_CGROUP_WRITEBACK with SB_I_CGROUPWB (Tejun Heo)  [Orabug: 26643598]  {CVE-2016-10044} 
  - x86/acpi: Prevent out of bound access caused by broken ACPI tables (Seunghun Han)  [Orabug: 26643645]  {CVE-2017-11473} 
  - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (Eric Dumazet)  [Orabug: 26650883]  {CVE-2017-9075} 
  - [media] saa7164: fix double fetch PCIe access condition (Steven Toth)  [Orabug: 26675142]  {CVE-2017-8831} 
  - [media] saa7164: fix sparse warnings (Hans Verkuil)  [Orabug: 26675142]  {CVE-2017-8831} 
  - fs: __generic_file_splice_read retry lookup on AOP_TRUNCATED_PAGE (Abhi Das)  [Orabug: 26797306]  
  - timerfd: Protect the might cancel mechanism proper (Thomas Gleixner)  [Orabug: 26899787]  {CVE-2017-10661} 
  - scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly (Xin Long)  [Orabug: 26988627]  {CVE-2017-14489}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.9.el7uek]
changelog:
  - ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca)  [Orabug: 27011273]  {CVE-2017-7542} 
  - packet: fix tp_reserve race in packet_set_ring (Willem de Bruijn)  [Orabug: 27002450]  {CVE-2017-1000111}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.8.el7uek]
changelog:
  - mlx4_core: calculate log_num_mtt based on total system memory (Wei Lin Guay)  [Orabug: 26883934]  
  - xen/x86: Add interface for querying amount of host memory (Boris Ostrovsky)  [Orabug: 26883934]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.7.el7uek]
changelog:
  - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri)  [Orabug: 26796364]  {CVE-2017-1000251}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.5.el7uek]
changelog:
  - fs/exec.c: account for argv/envp pointers (Kees Cook)  [Orabug: 26638921]  {CVE-2017-1000365} {CVE-2017-1000365}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-68.3.5.el7uek]
changelog:
  - KVM: x86: SYSENTER emulation is broken (Nadav Amit)  [Orabug: 21502739]  {CVE-2015-0239} {CVE-2015-0239} 
  - fs: take i_mutex during prepare_binprm for set[ug]id executables (Jann Horn)  [Orabug: 21502254]  {CVE-2015-3339} 
  - eCryptfs: Remove buggy and unnecessary write in file name decode routine (Michael Halcrow)  [Orabug: 21502065]  {CVE-2014-9683}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-98.2.1.el7uek]
changelog:
  - Introduce [compat_]save_altstack_ex() to unbreak x86 SMAP (Al Viro)  [Orabug: 21549587]  
  - x86, smap: Handle csum_partial_copy_*_user() (H. Peter Anvin)  [Orabug: 21549587]  
  - ext4: fix warning in ext4_da_update_reserve_space() (Jan Kara)  [Orabug: 21621442]  
  - ext4: remove unused variable in ext4_free_blocks() (Lukas Czerner)  [Orabug: 21621442]  
  - quota: provide interface for readding allocated space into reserved space (Jan Kara)  [Orabug: 21621442]  
  - udp: fix behavior of wrong checksums (Eric Dumazet)  [Orabug: 21628850]  {CVE-2015-5364} {CVE-2015-5366}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-98.1.1.el7uek]
changelog:
  - md: use kzalloc() when bitmap is disabled (Benjamin Randazzo)  [Orabug: 21563041]  {CVE-2015-5697}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-68.1.2.el7uek]
changelog:
  - IB/core: Prevent integer overflow in ib_umem_get address arithmetic (Shachar Raindel)  [Orabug: 20799875]  {CVE-2014-8159} {CVE-2014-8159}


author: Kris Van Hees <kris.van.hees@oracle.com> - 0.4.5-1
changelog:
  - Support USDT for 32-bit applications on 64-bit hosts.
    [Orabug: 21219315]
  - Convert from sdt_instr_t to asm_instr_t.
    [Orabug: 21219374]
  - Restructuring to support DTrace on multiple architectures.
    [Orabug: 21273259]
  - Fix dtrace_helptrace_buffer memory leak.
    [Orabug: 20514336]
  - Add .gitignore file.
    [Orabug: 20266608]


author: Kris Van Hees <kris.van.hees@oracle.com> - 0.4.3-4
changelog:
  - Updated NEWS file: test stress/buffering/tst.resize1.d is XFAIL for now.
  - Align with kernel header file change: FOLL_NOFAULT -> FOLL_IMMED.
    [Orabug: 18653713]


author: Kris Van Hees <kris.van.hees@oracle.com> - 0.4.2-1
changelog:
  - Fix 'vtimestamp' implementation.
    [Orabug: 17741477]
  - Support SDT probes points in kernel modules.
    [Orabug: 17851716]


author: Kris Van Hees <kris.van.hees@oracle.com> - 0.4.1-1
changelog:
  - Align with new cyclic implementation in UEK3 kernel.
    [Orabug: 17553446]
  - Bugfix for module reference counting.
  - Fix memory leak.
  - Fix race condition in speculative tracing buffer cleaning.
    [Orabug: 17591351]
  - Ensure safe access to userspace stack memory location.
    [Orabug: 17591351]


author: Kris Van Hees <kris.van.hees@oracle.com> - 0.4.0-1
changelog:
  - Bugfix for module unloading.
  - Support meta-providers, USDT, and fasttrap (for USDT only).
  - Export DTrace kernel headers to userspace.
  - Improved ustack() robustness.
    [Orabug: 17591351]
  - Reimplemented ustack().
    (Nick Alcock) [Orabug: 17591351]
  - Bugfixes.


author: Kris Van Hees <kris.van.hees@oracle.com> - 0.2.1
changelog:
  - Ensure that allocation attempts are done in atomic fashion so that a failing
    allocation attempt won't interfere with other allocations.
  - Surpress OOM warnings.


author: Brian Maly <brian.maly@oracle.com> [3.8.13-98.4.1.el7uek]
changelog:
  - xen/blkfront: remove redundant flush_op (Vitaly Kuznetsov)  [Orabug: 21868758]  
  - xen/blkfront: improve protection against issuing unsupported REQ_FUA (Vitaly Kuznetsov)  [Orabug: 21868758]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-98.3.1.el7uek]
changelog:
  - xen-blkfront: introduce blkfront_gather_backend_features() (Bob Liu)  [Orabug: 20190614]  
  - sched/x86: Fix up typo in topology detection (Dave Hansen)  [Orabug: 21845184]  
  - sctp: fix ASCONF list handling (Marcelo Ricardo Leitner)  [Orabug: 21842668]  {CVE-2015-3212} 
  - KEYS: ensure we free the assoc array edit if edit is valid (Colin Ian King)  [Orabug: 21842655]  {CVE-2015-1333}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.2.1.el7uek]
changelog:
  - mlx4_vnic: Skip fip discover restart if pkey index not changed (Yuval Shaia)  [Orabug: 21306476]  
  - kvm: fix excessive pages un-pinning in kvm_iommu_map error path. (Quentin Casasnovas)  [Orabug: 20687313]  {CVE-2014-3601} {CVE-2014-8369} {CVE-2014-3601} 
  - ttusb-dec: buffer overflow in ioctl (Dan Carpenter)  [Orabug: 20673376]  {CVE-2014-8884} 
  - mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support (Kirill A. Shutemov)  [Orabug: 20673281]  {CVE-2014-8173} 
  - netfilter: conntrack: disable generic tracking for known protocols (Florian Westphal)  [Orabug: 20673239]  {CVE-2014-8160} 
  - tracing/syscalls: Ignore numbers outside NR_syscalls' range (Rabin Vincent)  [Orabug: 20673163]  {CVE-2014-7826} 
  - uek-rpm: ol7: update update-el to 7.1 (Guangyu Sun)  [Orabug: 20524579]  
  - [CIFS] Possible null ptr deref in SMB2_tcon (Steve French)  [Orabug: 20433140]  {CVE-2014-7145} 
  - net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)  [Orabug: 20425332]  {CVE-2014-7841} 
  - ACPI: x2apic entry ignored (Cathy Avery)  [Orabug: 19475776]  
  - i40e: relax the firmware API version check (Shannon Nelson)  [Orabug: 20216831]  
  - x86, fpu: remove the logic of non-eager fpu mem allocation at the first usage (Annie Li)  [Orabug: 20232585]  
  - iommu/{vt-d,amd}: Remove multifunction assumption around grouping (Alex Williamson)  [Orabug: 20192796]  
  - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara)  [Orabug: 20224059]  {CVE-2014-5471} {CVE-2014-5472} 
  - x86_64, traps: Stop using IST for #SS (Andy Lutomirski)  [Orabug: 20224027]  {CVE-2014-9090} {CVE-2014-9322}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-35.3.2.el7uek]
changelog:
  - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin)  [Orabug: 19229497]  {CVE-2014-4943} {CVE-2014-4943} 
  - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo)  [Orabug: 19230689]  {CVE-2014-4699} 
  - net: flow_dissector: fail on evil iph->ihl (Jason Wang)  [Orabug: 19231234]  {CVE-2013-4348}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-35.3.1.el7uek]
changelog:
  - selinux: correctly label /proc inodes in use before the policy is loaded (Paul Moore)  [Orabug: 19064376]  
  - modsign: Ksplice certificate for module signing (Sasha Levin)  [Orabug: 18999924]  
  - net: fix kernel deadlock with interface rename and netdev name retrieval. (Nicolas Schichan)  [Orabug: 18969316]  
  - floppy: don't write kernel-only members to FDRAWCMD ioctl output (Matthew Daley)  [Orabug: 19028443]  {CVE-2014-1738} 
  - floppy: ignore kernel-only members in FDRAWCMD ioctl input (Matthew Daley)  [Orabug: 19028436]  {CVE-2014-1737}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-35.2.1.el7uek]
changelog:
  - spec: fix symbolic link to build directory (Jerry Snitselaar)  [Orabug: 18973099]  
  - config ol7: enable netfilter reverse path filter support (Jerry Snitselaar)  [Orabug: 18973079]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-35.1.1.el7uek]
changelog:
  - futex: Make lookup_pi_state more robust (Thomas Gleixner)  [Orabug: 18918552]  {CVE-2014-3153} 
  - futex: Always cleanup owner tid in unlock_pi (Thomas Gleixner)  [Orabug: 18918552]  {CVE-2014-3153} 
  - futex: Validate atomic acquisition in futex_lock_pi_atomic() (Thomas Gleixner)  [Orabug: 18918552]  {CVE-2014-3153} 
  - futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1) (Thomas Gleixner)  [Orabug: 18918552]  {CVE-2014-3153} {CVE-2014-3153}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.15.3.el7uek]
changelog:
  - uek-rpm ol7: change uek-rpm/ol7/update-el release value from 7.1 to 7.3 (Brian Maly)  [Orabug: 25348336]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.15.2.el7uek]
changelog:
  - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski)  [Orabug: 25269176]  {CVE-2016-3157} {CVE-2016-3157} 
  - net: Fix use after free in the recvmmsg exit path (Arnaldo Carvalho de Melo)  [Orabug: 25298611]  {CVE-2016-7117}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-98.2.2.el7uek]
changelog:
  - sctp: fix ASCONF list handling (Marcelo Ricardo Leitner)  [Orabug: 21842668]  {CVE-2015-3212} 
  - KEYS: ensure we free the assoc array edit if edit is valid (Colin Ian King)  [Orabug: 21842655]  {CVE-2015-1333}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.11.2.el7uek]
changelog:
  - Btrfs: fix truncation of compressed and inlined extents (Ashish Samant)  [Orabug: 22307285]  {CVE-2015-8374} 
  - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi)  [Orabug: 22307285]  {CVE-2015-8374} 
  - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998} 
  - netfilter: x_tables: validate e->target_offset early (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.3.el7uek]
changelog:
  - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417805]  {CVE-2016-8646} 
  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462760]  {CVE-2016-4482} 
  - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462807]  {CVE-2016-4485} 
  - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.2.el7uek]
changelog:
  - net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (Eric Dumazet)  [Orabug: 25203623]  {CVE-2016-9793}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-98.5.1.el7uek]
changelog:
  - netdev: fix NETIF_F_GSO_UDP_TUNNEL_BIT enum shift in i40e driver import (Todd Vierling)  [Orabug: 22066176]


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-44.1.5.el7uek]
changelog:
  - net: sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann)  [Orabug: 20010590]  {CVE-2014-3687} 
  - net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann)  [Orabug: 20010577]  {CVE-2014-3673}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-44.1.4.el7uek]
changelog:
  - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw)  [Orabug: 19849334]  {CVE-2014-3185} 
  - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849317]  {CVE-2014-3181} 
  - kvm: vmx: handle invvpid vm exit gracefully (Petr Matousek)  [Orabug: 19906300]  {CVE-2014-3646} 
  - nEPT: Nested INVEPT (Nadav Har'El)  [Orabug: 19906267]  {CVE-2014-3645} 
  - KVM: x86: Improve thread safety in pit (Andy Honig)  [Orabug: 19905686]  {CVE-2014-3611}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-44.1.3.el7uek]
changelog:
  - ALSA: control: Don't access controls outside of protected regions (Lars-Peter Clausen)  [Orabug: 19817785]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} 
  - ALSA: control: Fix replacing user controls (Lars-Peter Clausen)  [Orabug: 19817747]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} 
  - kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601) (Michael S. Tsirkin)  [Orabug: 19817646]  {CVE-2014-3601} 
  - net: sctp: inherit auth_capable on INIT collisions (Daniel Borkmann)  [Orabug: 19816067]  {CVE-2014-5077}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-44.1.2.el7uek]
changelog:
  - CVE-2014-3535: NULL pointer dereference in VxLAN packet logging. (Sasha Levin)  [Orabug: 19613139]


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-44.1.1.el7uek]
changelog:
  - auditsc: audit_krule mask accesses need bounds checking (Andy Lutomirski)  [Orabug: 19590596]  {CVE-2014-3917}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-35.3.5.el7uek]
changelog:
  - net: Use netlink_ns_capable to verify the permisions of netlink messages (Eric W. Biederman)  [Orabug: 19404231]  {CVE-2014-0181} 
  - net: Add variants of capable for use on netlink messages (Eric W. Biederman)  [Orabug: 19404231]  
  - net: Add variants of capable for use on on sockets (Eric W. Biederman)  [Orabug: 19404231]  
  - netlink: Rename netlink_capable netlink_allowed (Eric W. Biederman)  [Orabug: 19404231]  
  - sctp: Fix sk_ack_backlog wrap-around problem (Xufeng Zhang)  [Orabug: 19404244]  {CVE-2014-4667}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-35.3.3.el7uek]
changelog:
  - filter: prevent nla extensions to peek beyond the end of the message (Mathias Krause)  [Orabug: 19315781]  {CVE-2014-3144} {CVE-2014-3145} 
  - mac80211: fix AP powersave TX vs. wakeup race (Emmanuel Grumbach)  [Orabug: 19316457]  {CVE-2014-2706}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-98.6.1.el7uek]
changelog:
  - mm/hugetlb: Add locking to region_{add,change,truncate,count} when using shared files with hugepages (Mike Kravetz)  [Orabug: 21683388]  
  - xen-netback: Fix releasing header slot on error path (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Fix releasing frag_list skbs in error path (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Fix handling frag_list on grant op error path (Zoltan Kiss)  [Orabug: 21976319]  
  - x86/efi: Make efi virtual runtime map passing more robust (Borislav Petkov)  [Orabug: 22020990]  
  - virtio-net: drop NETIF_F_FRAGLIST (Jason Wang)  [Orabug: 22145600]  {CVE-2015-5156}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.24.2.el7uek]
changelog:
  - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PAE swap entries against L1TF (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Extend 64bit swap file size limit (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm, fremap: mitigate L1TF in remap_file_pages (Daniel Jordan)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation: Don't mark cpu_no_l1tf __initconst (Boris Ostrovsky)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/kmmio: Make the tracer robust against L1TF (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/pat: Make set_memory_np() L1TF safe (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/pat: Ensure cpa->pfn only contains page frame numbers (Matt Fleming)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Exempt zeroed PTEs from inversion (Sean Christopherson)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Invert all not present mappings (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Move the l1tf function and define pr_fmt properly (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Limit swap file size to MAX_PA/2 (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk.c: prevent positive return value of walk_page_test() from being passed to callers (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - pagewalk: improve vma handling (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk: remove pgd_entry() and pud_entry() (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk.c: fix walk_page_range() access of wrong PTEs (Chen LinX)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Add sysfs reporting for l1tf (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/cpu/intel: Add Knights Mill to Intel family (Piotr Luc)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Concentrate bug reporting into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Concentrate bug detection into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make sure the first page is always reserved (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE (Michal Hocko)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect swap entries against L1TF (Linus Torvalds)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Change order of offset/type in swap entry (Linus Torvalds)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Fix swap entry comment and macro (Dave Hansen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Move swap offset/type up in PTE to work around erratum (Dave Hansen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm: x86 pgtable: drop unneeded preprocessor ifdef (Cyrill Gorcunov)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Fix regression with huge pages on PAE (Kirill A. Shutemov)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Move PUD_PAGE macros to page_types.h (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation: sort X86_BUG_* with X86_FEATURE_* (Daniel Jordan)  [Orabug: 28505476]  {CVE-2018-3620} 
  - Disable kaiser if the cpu is not vulnerable to X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27958074]  
  - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (David Woodhouse)  [Orabug: 27958074]  
  - x86/msr: Add definitions for IA32_ARCH_CAPABILITIES MSR (Kanth Ghatraju)  [Orabug: 27958074]  
  - x86/cpufeatures: Add Intel feature bit for IA32_ARCH_CAPABILITIES supported (Kanth Ghatraju)  [Orabug: 27958074]


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-98.1.2.el7uek]
changelog:
  - udp: fix behavior of wrong checksums (Eric Dumazet)  [Orabug: 21628850]  {CVE-2015-5364} {CVE-2015-5366}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.13.2.el7uek]
changelog:
  - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer)  [Orabug: 24798695]  {CVE-2016-5829}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.14.2.el7uek]
changelog:
  - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060050]  {CVE-2016-6480} {CVE-2016-6480} 
  - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche)  [Orabug: 25060011]  {CVE-2016-6327} 
  - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059945]  {CVE-2016-6136} 
  - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059753]  {CVE-2016-4569} 
  - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058991]  {CVE-2016-3699} 
  - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug: 25058903]  {CVE-2015-8956} 
  - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059046]  {CVE-2016-2053} 
  - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059194]  {CVE-2016-3070}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.21.3.el7uek]
changelog:
  - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li)  [Orabug: 27951287]  {CVE-2017-17741} {CVE-2017-17741} 
  - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 27989498]  {CVE-2018-10323} 
  - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri)  [Orabug: 28030520]  {CVE-2017-1000410} {CVE-2017-1000410} 
  - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2549} 
  - ALSA: timer: Harden slave timer list handling (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2547} {CVE-2016-2548} 
  - ALSA: timer: Fix double unlink of active_list (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2545} 
  - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2543} 
  - ALSA: seq: Fix race at timer setup and close (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2544} 
  - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov)  [Orabug: 28058229]  {CVE-2016-2384}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.21.2.el7uek]
changelog:
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947608]  {CVE-2018-1000199} 
  - Revert "perf/hwbp: Simplify the perf-hwbp code, fix documentation" (Brian Maly)  [Orabug: 27947608]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.2.5.el7uek]
changelog:
  - KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats)  [Orabug: 22563965]  {CVE-2016-0728}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.10.2.el7uek]
changelog:
  - tcp: make challenge acks less predictable (Eric Dumazet)  [Orabug: 24010012] [Orabug: 2401010]  {CVE-2016-5696}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-68.1.3.el7uek]
changelog:
  - isofs: Fix unchecked printing of ER records (Jan Kara)  [Orabug: 20930551]  {CVE-2014-9584} 
  - KEYS: close race between key lookup and freeing (Sasha Levin)  [Orabug: 20930548]  {CVE-2014-9529} {CVE-2014-9529} 
  - mm: memcg: do not allow task about to OOM kill to bypass the limit (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - mm: memcg: do not declare OOM from __GFP_NOFAIL allocations (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - fs: buffer: move allocation failure loop into the allocator (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - mm: memcg: handle non-error OOM situations more gracefully (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - mm: memcg: do not trap chargers with full callstack on OOM (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - mm: memcg: rework and document OOM waiting and wakeup (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - mm: memcg: enable memcg OOM killer only for user faults (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - x86: finish user fault error path with fatal signal (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - arch: mm: pass userspace fault flag to generic fault handler (Johannes Weiner)  [Orabug: 20930539]  {CVE-2014-8171} 
  - selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID. (Stephen Smalley)  [Orabug: 20930501]  {CVE-2014-3215}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.1.8.el7uek]
changelog:
  - kvm: fix excessive pages un-pinning in kvm_iommu_map error path. (Quentin Casasnovas)  [Orabug: 20687313]  {CVE-2014-3601} {CVE-2014-8369} {CVE-2014-3601}


author: Guangyu Sun <guangyu.sun@oracle.com> [3.8.13-55.1.7.el7uek]
changelog:
  - ttusb-dec: buffer overflow in ioctl (Dan Carpenter)  [Orabug: 20673376]  {CVE-2014-8884} 
  - mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support (Kirill A. Shutemov)  [Orabug: 20673281]  {CVE-2014-8173} 
  - netfilter: conntrack: disable generic tracking for known protocols (Florian Westphal)  [Orabug: 20673239]  {CVE-2014-8160} 
  - tracing/syscalls: Ignore numbers outside NR_syscalls' range (Rabin Vincent)  [Orabug: 20673163]  {CVE-2014-7826}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.4.2.el7uek]
changelog:
  - pipe: Fix buffer offset after partially failed read (Ben Hutchings)  [Orabug: 22985903]  {CVE-2016-0774} {CVE-2015-1805} {CVE-2016-0774}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.24.3.el7uek]
changelog:
  - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook)  [Orabug: 28710010]  {CVE-2018-14634}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.3.2.el7uek]
changelog:
  - x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Reorder nested NMI checks (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Improve nested NMI comments (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Switch stacks on userspace NMI entry (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/paravirt: Replace the paravirt nop with a bona fide empty function (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157}


