elsa-2025-1301

{
  "cves": [
    "CVE-2020-11023"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "[8.5.0-23.0.1]\n- Merge Oracle patches to 8.5.0-23.\n  Oracle history:\n  May-22-2024 Qing Zhao qing.zhao@oracle.com 8.5.0-22.0.1\n  - Merge Oracle patches to 8.5.0-22.\n  Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-27-2024 Qing Zhao qing.zhao@oracle.com 8.5.0-21.0.1\n  - Merge Oracle patches to 8.5.0-21.\n  January-19-2024 Qing Zhao qing.zhao@oracle.com 8.5.0-20.0.3\n  - Fix Orabug 35283123, i.e, the same bug as GCC PR111407.\n    gcc14-pr111407.patch\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  January-5-2024 Jose E. Marchesi jose.marchesi@oracle.com 8.5.0-20.0.2\n  - Restore support for -mpreserve-args in aarch64 targets, adapted to\n    new AArch64 stack frame layout.\n    Reviewed-by: Cupertino Miranda cupertino.miranda@oracle.com\n  October-4-2023 David Faust david.faust@oracle.com 8.5.0-20.0.1\n  - Forward-port Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  September-28-2023 David Faust david.faust@oracle.com 8.5.0-18.0.6\n  - Backport additional patches from gcc-9 to fix CVE-2023-4039 patches\n    interaction with backported aarch64 -fstack-clash-protection support.\n    [Orabug 35843962]\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  August-31-2023 Qing Zhao qing.zhao@oracle.com 8.5.0-18.0.5\n  - CVE-2023-4039 GCC mitigation.\n    Orabug 35751743.\n    Includes removal of aarch64-preserve-args.patch.\n  - CVE-2022-40982 'Intel Downfall' mitigation.\n    Orabug 35751810.\n    Add two patches originally from GCC upstream releases/gcc-11 branch.\n    with major adjustment.\n    gcc11-downfall-disable-gather-in-vec.patch\n    gcc11-downfall-support-mno-gather.patch\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  May-11-2023 Jose E. Marchesi jose.marchesi@oracle.com 8.5.0-18.0.2\n  - Support for -mpreserve-args in aarch64.\n    Orabug 35065765.\n    Reviewed-by: Qing Zhao qing.zhao@oracle.com.\n  March-28-2023 Qing Zhao qing.zhao@oracle.com 8.5.0-18.0.1\n  - Merge Oracle patches with gcc-8.5.0-18.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  January-12-2023 Qing Zhao qing.zhao@oracle.com 8.5.0-16.0.1\n  - Merge oracle patches with gcc-8.5.0-16.\n  November-30-2022 Qing Zhao qing.zhao@oracle.com 8.5.0-15.0.2\n  - Fix Orabug 34679540 - PROFILE COLLECT BUILD AND WORK LOAD TEST\n    ISSUES IN LINUX ARM64.\n    Removing the buggy patch that has been removed from upstream gcc too:\n    gcc10-pr91971.patch\n  September-28-2022 Qing Zhao qing.zhao@oracle.com 8.5.0-15.0.1\n  - Merge oracle patches with gcc-8.5.0-15.\n  June-29-2022 Qing Zhao qing.zhao@oracle.com 8.5.0-10.1.0.1\n  - Merge oracle patches with gcc-8.5.0-10.1.el8_6.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  May-4-2022 Qing Zhao qing.zhao@oracle.com 8.5.0-10.0.2\n  - Fix Orabug 34066706 only in OL GCC.\n    report error when there is no PROGRAM_SUMMARY section in .gcda file.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  April-27-2022 Marek Polacek polacek@redhat.com 8.5.0-10.1\n  - backport Default widths with -fdec-format-defaults patch (#2079578)\n  March-22-2022 Qing Zhao qing.zhao@oracle.com 8.5.0-10.0.1\n  - Merge with oracle patches.\n  January-5-2022 Qing Zhao qing.zhao@oracle.com 8.5.0-4.0.2\n  - Add patches to support marvell on Arm:\n    gcc9-add-support-for-profile-extension.patch\n    gcc10-add-initial-octeontx2-support.patch\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  November-16-2021 Qing Zhao qing.zhao@oracle.com 8.5.0-4.0.1\n  - Merge oracle patches to security errata 8.5.0-4.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  October-14-2021 Indu Bhagat indu.bhagat@oracle.com 8.5.0-3.0.2\n  - Fix Orabug 33451471 and backport CTF/BTF enhancements\n    ctfc: Free CTF container elements in ctfc_delete_container ()\n    ctf: Do not warn for CTF not supported for GNU GIMPLE\n    ICE in btf_finalize when compiling with -gbtf (PR debug/102507, Orabug\n    33451471)\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  October-5-2021 Qing Zhao qing.zhao@oracle.com 8.5.0-3.0.1\n  - Merge the following oracle patches to OL8.5 beta:\n    - Fix an aarch64 compilation error triggered by the oracle patch\n      gcc9-multiple-changes-align.patch on OL8U5 source base.\n      gcc-fix-aarch64-tune-params.patch\n    - Fix Orabug 33281392 Update CTF and BTF support in OL8 GCC\n      This commit brings the support for CTF/BTF debug formats at par with\n      upstream.  GCC now generates the CTF/BTF debug information by using the\n      internal DWARF representation.\n      For backward compatibility reasons, OL8 GCC continues to support -gt\n      command line option.\n      (Indu Bhagat indu.bhagat@oracle.com 8.4.1-1.0.3)\n    - Add complex divide improvement\n      backport of upstream commit 54f0224d55a1b56dde092460ddf76913670e6efc\n      (Patrick.McGehearty patrick.mcgehearty@oracle.com 8.4.1-1.0.2)\n    - Fix Orabug 32301371 - bug using gcov with preserve paths option\n      This is the same bug as GCC bug PR gcov-profile/88994\n      gcc9-pr88994.patch\n      (Qing Zhao qing.zhao@oracle.com 8.3.1-5.1.0.2)\n    - Fix generation of CTF type records for completed structs referred\n      thru pointers.\n      Orabug 31095790.\n      (Jose E. Marchesi jose.marchesi@oracle.com 8.3.1-5.0.4)\n    - Fix Orabug 29838827 - provide an option to adjust the maximum depth\n      of nested #include\n      This is the same bug as gcc upstream PR90581 from Gcc9:\n      gcc9-pr90581.patch\n    - Fix Orabug 29541051 -  confusing error message when there is a problem\n      with ASAN_OPTIONS 'ERROR: expected '=''\n      This is the same bug as gcc upstream PR89832 from Gcc9:\n      gcc9-pr89832.patch\n      (Qing Zhao qing.zhao@oracle.com 8.3.1-5.0.3)\n    - Update support for CTF\n      Fix Orabug 30833294 GCC generates incorrect CTF for single element arrays\n      Fix Orabug 30808764 CTF generation fails when __attribute__ ((mode (XX))) is\n      used\n      (Indu Bhagat indu.bhagat@oracle.com 8.3.1-5.0.2)\n    - Apply ares/neoverse support patches only ifarch aarch64.\n      (Qing Zhao qing.zhao@oracle.com 8.3.1-4.5.0.6)\n    - Add 4 patches from gcc9 to support Arm Ares and Neoverse-N1 for Aarch64\n      gcc9-add-vec-reverse.patch\n      gcc9-multiple-changes-align.patch\n      gcc9-initial-mcpu-ares-tuning.patch\n      gcc9-add-support-for-neoverse-n1.patch\n      (Indu Bhagat indu.bhagat@oracle.com 8.3.1-4.5.0.5)\n    - Update support for CTF\n      Fix Orabug 30778534 gcc should generate CTF for functions at file-scope only\n      Fix Orabug 30779193 CTF generation fails for some flavors of vla\n      Fix Orabug 30784275 Fix issues wtih CTF generation for typedef constructs\n      ctf-3-generation-and-emission-for-a-single-compilation.patch\n      ctf-4-update-ctf-testsuite.patch\n      (Indu Bhagat indu.bhagat@oracle.com 8.3.1-4.5.0.4)\n    - Add support for CTF in GCC\n      Fix Orabug 30102948 gcc: Add CTF generation to compiler\n      Fix Orabug 30102949 gcc: Add CTF generation to compiler (aarch64)\n      ctf-1-new-function-lang_GNU_GIMPLE.patch\n      ctf-2-command-line-options-gtLEVEL.patch\n      ctf-3-generation-and-emission-for-a-single-compilation.patch\n      ctf-4-update-ctf-testsuite.patch\n      ctf-5-handle-ctf-sections-when-lto-enabled.patch\n      (Qing Zhao qing.zhao@oracle.com 8.3.1-4.5.0.3)\n    - CVE-2018-12207 / Intel SKX102\n      OL8 gcc: Intel Mitigation for CVE: CVE-2018-12207\n    - Allow -flto -Wa,-mbranches-within-32B-boundaries to pass -mbranches-within-32B-boundaries\n      to GNU assembler. Without -lfto, -Wa,-mbranches-within-32B-boundaries to pass\n      -mbranches-within-32B-boundaries to GNU assembler using existing GCC binaries.\n    - Mitigation patch:\n      gcc8-Fix-Wa-with-flto.patch\n      (Qing Zhao  qing.zhao@oracle.com 8.3.1-4.5.0.2)\n    - Fix Orabug 29968294 -      Heap corruption with fprofile-dir=%p prevents\n      profiling parallel processes, needed for RDBMS:\n      Add patch to fix PR86057 from Gcc9:\n      gcc9-pr86057.patch\n    - Fix Orabug 30044244 - Profile directory concatenated with object file path\n      This is the same bug as gcc upstream PR91971:\n      gcc9-pr85759.patch\n      gcc10-pr91971.patch\n      (Indu Bhagat indu.bhagat@oracle.com 8.3.1-4.5.0.1)\n    - Fix Orabug 29599147 - Need -fprofile-dir=%q{VAR} backported to gcc8\n      This is the similar GCC PR47618, add the fix from GCC9:\n      gcc9-pr47618.patch\n    - Fix Orabug 29272977 - DB SUPPORT: Need way to dump inlining report from GCC\n      Add -fopt-info-inline support from GCC9:\n      gcc9-opt-info-inline.patch\n    - Fix Orabug 29273006 - DB SUPPORT: need way to turn off inlining of global functions\n      Add -flive-patching support from GCC9:\n      gcc9-fipa-reference-addressable.patch\n      gcc9-fipa-stack-alignment.patch\n      gcc9-add-fomit-frame-pointer-to-test.patch\n      gcc9-extend-live-patching-option-handling.patch\n      gcc9-ipa-stack-alignment-386-test.patch\n    - Introduce 'oracle_release' into .spec file. Echo it to gcc/DEV-PHASE.\n    - Backport 17 ampere patches from\n      https://git.theobroma-systems.com/ampere-computing/gcc.git/log/?h=gcc-8_2_0-amp3-branch\n      e18301133ea622f6d6796ded1d15466e70475cf8: Retpoline (Spectre-V2 mitigation) for\n                                                aarch64.\n      d735f3ae4712f66362326d179b4d7e9332c79677: Revert 2017-10-24  Richard Biener\n      271e2811e59c0c77fc022fa86a7030f20b4cac8e: Correct the maximum shift amount for\n                                                shifted\n      0512749950d927de3dd695f2f2aacdfd30cf32fd: Add CPU support for Ampere Computing's\n                                                eMAG.\n      c8b87078f9e0714cb9cab602e12a18ceb12df05a: eMAG/Xgene: Procedural cost-model for\n                                                X-Gene\n      74610471b3577c5d465c3fd095a65b796b1e074c: Updating cost table for xgene1.\n      ddba1553ac412be5596e6e2962c148032c4cf231: [AArch64] Add Xgene1 prefetch tunings.\n      b7ebb0a10a8900324074070188a0936ed81b28a4: [AArch64] Fix in xgene1_addrcost_table\n      393dc5c50d55d069f91627bf0be5bab812978850: X-Gene: Adapt tuning struct for GCC 8.\n      b9136d58824af2118c4969c3edb42cad3318b08f: tree-ssa-list-find-pipeline:\n                                                Add pipelining loads for list finds.\n      095496dd8a9491a17a9caec173281ad02e559df5: uncse: Added pass to undo common\n                                                subexpression elimination.\n      a7c8dc238e3656e9d2f9256ee76f933c8d7956fb: loop-prefetcher: Adapt defaults for\n                                                X-Gene cores.\n      256307f293f1750851576e14c8a42b696eced2da: tree-ssa-cpp: Don't crash on SSA names\n                                                without definition stmts.\n      6e32f53be4f6733f6bfe267ad2337aecaf4047f6: Introduce new option -funroll-more.\n      1ac2485a2fced091a5cce6343fe6a6337f850e73: New option to bypass aliasing-checks.\n      66d7d833bece61e58998ad53a609cd32e3ee4fad: cfgloopmanip: Allow forced creation\n                                                of loop preheaders.\n      c4f89d50e200538b1ac8889801705300e0b27ef2: Add new pass to optimise loops.\n\n[8.5.0-23]\n- rebuild for CVE-2020-11023 (RHEL-78274)",
  "id": "ELSA-2025-1301",
  "ovalId": "oval:com.oracle.elsa:def:20251301",
  "source": "oracle_linux",
  "title": "ELSA-2025-1301:  gcc security update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2025-1301.html"
}