pat98's always & forever

[취약점 개요 및 영향도]

1.    취약점 개요

A.     CVE ID : CVE-2026-31431

B.     심각도 : Important (CVSS 7.8 / HIGH)

C.     영향 범위 : Linux Kernel 4.14 이상 (RHEL 8, 9, 10)

D.     취약점 : crypto: algif_aead (커널 암호화 인터페이스)

2.    취약점 영향도

A.     커널 암호화 인터페이스(algif_aead)의 연산 오류로 인해, 로컬 사용자가 페이지 캐시 조작을 통해 root 권한을 획득할 수 있는 취약점

B.     로컬 권한 상승(LPE) 취약점으로, 시스템에 일반 사용자 접근 권한이 있어야 악용이 가능

C.   공격 형태: 일반 유저 계정으로 Linux 암호화 API를 악용해 메모리 속 파일을 변조, root 권한을 획득하는 로컬 권한 상승(LPE) 공격

D.   공격 대상: 2017년 이후 출시된 Linux 커널(4.14~)을 사용하는 모든 서버, VM, 컨테이너 환경

[조치 안내]

해당 CVE는 아래 커널 버전에서 수정 되었습니다.

• UEK8: 6.12.0-201.74.2.2
• UEK7: 5.15.0-319.201.4.4
• UEK6: 5.4.17-2136.354.4.2
• CVE Errata https://linux.oracle.com/cve/CVE-2026-31431.html
  https://linux.oracle.com/errata/ELSA-2026-50255.html

====================================================

- kernel Update 작업 테스트

[root@rhel97 ~]# id
uid=0(root) gid=0(root) groups=0(root)

[root@rhel97 ~]# uname -a
Linux rhel97 6.12.0-105.51.5.el9uek.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Oct 14 19:55:41 PDT 2025 x86_64 x86_64 x86_64 GNU/Linux

[root@rhel97 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux release 9.7 (Plow)


[root@rhel97 ~]# dnf clean all
24 files removed

[root@rhel97 ~]# dnf updateinfo list --cve CVE-2026-31431
Oracle Linux 9 BaseOS Latest (x86_64)                                                                33 MB/s | 122 MB     00:03    
Oracle Linux 9 Application Stream Packages (x86_64)                                                  30 MB/s |  90 MB     00:03    
Oracle Linux 9 UEK Release 8 (x86_64)                                                                19 MB/s |  42 MB     00:02    
Last metadata expiration check: 0:00:04 ago on Wed 20 May 2026 10:46:14 AM KST.
ELSA-2026-13565 Important/Sec. kernel-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-core-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-modules-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-modules-core-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-tools-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-tools-libs-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-core-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-core-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-core-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-core-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-desktop-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-desktop-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-extra-netfilter-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-usb-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-usb-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-wireless-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-wireless-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-13565 Important/Sec. python3-perf-5.14.0-611.54.1.el9_7.x86_64
[root@rhel97 ~]# dnf update kernel-uek
Last metadata expiration check: 0:00:47 ago on Wed 20 May 2026 10:46:14 AM KST.
Dependencies resolved.
====================================================================================================================================
 Package                                      Architecture     Version                                    Repository           Size
====================================================================================================================================
Upgrading:
 dracut                                       x86_64           057-104.git20250919.0.3.el9_7              ol9_UEKR8           689 k
 dracut-config-rescue                         x86_64           057-104.git20250919.0.3.el9_7              ol9_UEKR8           8.9 k
 dracut-network                               x86_64           057-104.git20250919.0.3.el9_7              ol9_UEKR8           144 k
 dracut-squash                                x86_64           057-104.git20250919.0.3.el9_7              ol9_UEKR8           8.9 k
Installing group/module packages:
 kernel-uek                                   x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8           1.5 M
Installing dependencies:
 kernel-uek-core                              x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8            21 M
 kernel-uek-modules                           x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8            32 M
 kernel-uek-modules-core                      x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8            39 M
 kernel-uek-modules-desktop                   x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8            21 M
 kernel-uek-modules-extra-netfilter           x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8           2.4 M
 kernel-uek-modules-usb                       x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8           2.5 M
 kernel-uek-modules-wireless                  x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8           9.5 M

Transaction Summary
====================================================================================================================================
Install  8 Packages
Upgrade  4 Packages

Total download size: 130 M
Is this ok [y/N]: y
Downloading Packages:
(1/12): kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                              4.3 MB/s | 1.5 MB     00:00    
(2/12): kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                          11 MB/s |  21 MB     00:01    
(3/12): kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                       12 MB/s |  32 MB     00:02    
(4/12): kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64.rpm                       11 MB/s | 2.4 MB     00:00    
(5/12): kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64.rpm                               17 MB/s |  21 MB     00:01    
(6/12): kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                   15 MB/s | 2.5 MB     00:00    
(7/12): kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                  13 MB/s |  39 MB     00:02    
(8/12): dracut-057-104.git20250919.0.3.el9_7.x86_64.rpm                                             5.9 MB/s | 689 kB     00:00    
(9/12): dracut-config-rescue-057-104.git20250919.0.3.el9_7.x86_64.rpm                               250 kB/s | 8.9 kB     00:00    
(10/12): dracut-network-057-104.git20250919.0.3.el9_7.x86_64.rpm                                    2.9 MB/s | 144 kB     00:00    
(11/12): dracut-squash-057-104.git20250919.0.3.el9_7.x86_64.rpm                                     255 kB/s | 8.9 kB     00:00    
(12/12): kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64.rpm                             24 MB/s | 9.5 MB     00:00    
------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                37 MB/s | 130 MB     00:03     
Oracle Linux 9 UEK Release 8 (x86_64)                                                               3.6 MB/s | 6.2 kB     00:00    
Importing GPG key 0x8D8B756F:
 Userid     : "Oracle Linux (release key 1) <secalert_us@oracle.com>"
 Fingerprint: 3E6D 826D 3FBA B389 C2F3 8E34 BC4D 06A0 8D8B 756F
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
Is this ok [y/N]: y
Key imported successfully
Importing GPG key 0x8B4EFBE6:
 Userid     : "Oracle Linux (backup key 1) <secalert_us@oracle.com>"
 Fingerprint: 9822 3175 9C74 6706 5D0C E9B2 A7DD 0708 8B4E FBE6
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
Is this ok [y/N]: y
Key imported successfully
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                            1/1 
  Upgrading        : dracut-057-104.git20250919.0.3.el9_7.x86_64                                                               1/16 
  Installing       : kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64                                                   2/16 
  Running scriptlet: kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                           3/16 
  Installing       : kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                           3/16 
  Running scriptlet: kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                           3/16 
  Installing       : kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64                                                        4/16 
  Running scriptlet: kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64                                                        4/16 
  Installing       : kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64                                                5/16 
  Running scriptlet: kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64                                                5/16 
  Installing       : kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64                                        6/16 
  Running scriptlet: kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64                                        6/16 
  Installing       : kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64                                                    7/16 
  Running scriptlet: kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64                                                    7/16 
  Installing       : kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64                                               8/16 
  Running scriptlet: kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64                                               8/16 
  Installing       : kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64                                                                9/16 
  Upgrading        : dracut-config-rescue-057-104.git20250919.0.3.el9_7.x86_64                                                10/16 
  Upgrading        : dracut-network-057-104.git20250919.0.3.el9_7.x86_64                                                      11/16 
  Upgrading        : dracut-squash-057-104.git20250919.0.3.el9_7.x86_64                                                       12/16 
  Cleanup          : dracut-squash-057-102.git20250818.0.1.el9.x86_64                                                         13/16 
  Cleanup          : dracut-network-057-102.git20250818.0.1.el9.x86_64                                                        14/16 
  Cleanup          : dracut-config-rescue-057-102.git20250818.0.1.el9.x86_64                                                  15/16 
  Cleanup          : dracut-057-102.git20250818.0.1.el9.x86_64                                                                16/16 
  Running scriptlet: kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64                                                  16/16 
  Running scriptlet: kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                          16/16 
  Running scriptlet: kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64                                                       16/16 
  Running scriptlet: dracut-057-102.git20250818.0.1.el9.x86_64                                                                16/16 
  Verifying        : kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64                                                                1/16 
  Verifying        : kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                           2/16 
  Verifying        : kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64                                                        3/16 
  Verifying        : kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64                                                   4/16 
  Verifying        : kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64                                                5/16 
  Verifying        : kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64                                        6/16 
  Verifying        : kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64                                                    7/16 
  Verifying        : kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64                                               8/16 
  Verifying        : dracut-057-104.git20250919.0.3.el9_7.x86_64                                                               9/16 
  Verifying        : dracut-057-102.git20250818.0.1.el9.x86_64                                                                10/16 
  Verifying        : dracut-config-rescue-057-104.git20250919.0.3.el9_7.x86_64                                                11/16 
  Verifying        : dracut-config-rescue-057-102.git20250818.0.1.el9.x86_64                                                  12/16 
  Verifying        : dracut-network-057-104.git20250919.0.3.el9_7.x86_64                                                      13/16 
  Verifying        : dracut-network-057-102.git20250818.0.1.el9.x86_64                                                        14/16 
  Verifying        : dracut-squash-057-104.git20250919.0.3.el9_7.x86_64                                                       15/16 
  Verifying        : dracut-squash-057-102.git20250818.0.1.el9.x86_64                                                         16/16 

Upgraded:
  dracut-057-104.git20250919.0.3.el9_7.x86_64                   dracut-config-rescue-057-104.git20250919.0.3.el9_7.x86_64          
  dracut-network-057-104.git20250919.0.3.el9_7.x86_64           dracut-squash-057-104.git20250919.0.3.el9_7.x86_64                 
Installed:
  kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64                   kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                     
  kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64           kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64             
  kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64   kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64  
  kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64       kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64         

Complete!

[root@rhel97 ~]# reboot

[root@rhel97 ~]# uname -r
6.12.0-202.76.4.2.el9uek.x86_64

[root@rhel97 ~]# rpm -q kernel-uek
kernel-uek-6.12.0-105.51.5.el9uek.x86_64
kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64

이슈 :

- RHEL 9.X 설치후 crs autostart 되지 않는 문제

root@rac1:/root# crsctl config crs 
CRS-4622: Oracle High Availability Services autostart is enabled.

Autostart 설정되어 있어도 Reboot 하면 자동으로 올라오지 않는다.

원인 :

RHEL 9 부터 chkconfig rpm 이 기본설치 되지 않음

https://access.redhat.com/solutions/6837271

Bugzilla:2018112[1]

To manage services, use the systemctl commands or install the chkconfig package manually.

For more information about systemd, see Introduction to systemd. For instructions on how to use the systemctl utility, see Managing system services with systemctl.

해결책 :

그냥 해당 버전에 맞는 chkconfig 받아서 설치해 주면 됨. (난 RHEL 9.7 이였음)

예시)

rpm -Uvh chkconfig-1.24-2.el9.x86_64.rpm

warning: chkconfig-1.24-2.el9.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:chkconfig-1.24-2.el9             ################################# [100%]

이때 /etc/init.d/  디렉토리가 존재하여 설치가 안되는 경우가 있는데 안에 화일들을 백업후 디렉토리 지웠다가 설치후에 다시 복원시켜주면 된다.

root@rac1:/etc/init.d# ls -al
total 160
drwxr-xr-x.  2 root root    83 Apr 24 17:12 .
drwxr-xr-x. 10 root root   127 Sep  5  2024 ..
-rwxr-xr-x   1 root root 26097 Apr 24 15:55 init.ohasd
-rwxr-xr-x   1 root root 37326 Apr 24 15:56 init.tfa
-rwxr-xr-x   1 root root  8056 Apr 24 15:55 ohasd
-rw-r--r--.  1 root root  1161 Aug 15  2025 README

설치 후 Reboot 하여 Autostart 되는지 확인 !!!

관련 MOS 문서 :
Ohasd Process Does Not Start After Rebooting OS On RHEL 9 Due To Missing Chkconfig Package (문서 ID 3000775.1)