kernel-3.10.0-1160.99.1.el7

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)
* hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* nf_conntrack causing nfs to stall (BZ#2128262)
* Request to backport upstream commit 5e2d2cc2588b, 26a8b12747c9, and e98fa02c4f2e for RHEL 7.9.z (BZ#2180681)
* Fix soft lockup happens in gfs2_dir_get_hash_table() (BZ#2190450)

CVE-2023-20593
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
CVE-2023-35788
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.