Merge ~cypressyew/ubuntu-cve-tracker:oem-5.14 into ubuntu-cve-tracker:master

[Po-Hsu Lin]

Add tracking for focal/linux-oem-5.14 kernel

Add tracking for F-OEM-5.14 based on 14f96c290581

[Steve Beattie (sbeattie)]

Thanks for the merge request, I've gone ahead and merged it, along with adding the kernel to the actively tracked kernel CVEs.

review: Approve

diff --git a/active/00boilerplate.linux b/active/00boilerplate.linux
index fd27057..c0c23e9 100644
--- a/active/00boilerplate.linux
+++ b/active/00boilerplate.linux
@@ -499,6 +499,16 @@ focal_linux-oem-5.13: needs-triage
 hirsute_linux-oem-5.13: DNE
 devel_linux-oem-5.13: DNE
 
+Patches_linux-oem-5.14:
+upstream_linux-oem-5.14: needs-triage
+trusty_linux-oem-5.14: DNE
+trusty/esm_linux-oem-5.14: DNE
+xenial_linux-oem-5.14: DNE
+bionic_linux-oem-5.14: DNE
+focal_linux-oem-5.14: needs-triage
+hirsute_linux-oem-5.14: DNE
+devel_linux-oem-5.14: DNE
+
 Patches_linux-oem-osp1:
 upstream_linux-oem-osp1: needs-triage
 trusty_linux-oem-osp1: DNE
diff --git a/active/CVE-2021-3653 b/active/CVE-2021-3653
index 3d5a703..951ed1d 100644
--- a/active/CVE-2021-3653
+++ b/active/CVE-2021-3653
@@ -25,6 +25,7 @@ Ubuntu-Description:
  enabling AVIC in nested guest VMs. An attacker in a guest VM could use this
  to write to portions of the host's physical memory.
 Notes:
+ cascardo> trusty libvirt/qemu does not create nested capable VMs by default
 Mitigation:
  Disable nested virtualisation when loading the KVM AMD module:
     modprobe kvm_amd nested=0
@@ -38,7 +39,7 @@ Patches_linux:
  break-fix: 3d6368ef580a4dff012960834bba4e28d3c1430c 0f923e07124df069ba68d8bb12324398f4b6b709|local-CVE-2021-3653-fix
 upstream_linux: released (5.14~rc7)
 trusty_linux: ignored (out of standard support)
-trusty/esm_linux: needed
+trusty/esm_linux: ignored (ESM criteria, not a high on 3.13)
 xenial_linux: ignored (was needs-triage now end-of-life)
 esm-infra/xenial_linux: released (4.4.0-214.246)
 bionic_linux: released (4.15.0-156.163)
diff --git a/active/CVE-2021-40490 b/active/CVE-2021-40490
index b7c20dd..9b162aa 100644
--- a/active/CVE-2021-40490
+++ b/active/CVE-2021-40490
@@ -18,6 +18,7 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
+ break-fix: f19d5870cbf72d4cb2a8e1f749dff97af99b071e a54c4613dac1500b40e4ab55199f7c51f028e848
 upstream_linux: needs-triage
 trusty_linux: ignored (out of standard support)
 trusty/esm_linux: ignored (was needs-triage ESM criteria)
diff --git a/meta_lists/package_info_overrides.json b/meta_lists/package_info_overrides.json
index 34cfb10..5a3e9ca 100644
--- a/meta_lists/package_info_overrides.json
+++ b/meta_lists/package_info_overrides.json
@@ -1311,6 +1311,10 @@
         "description": "Linux kernel for OEM systems",
         "title": "Linux kernel (OEM)"
     },
+    "linux-oem-5.14": {
+        "description": "Linux kernel for OEM systems",
+        "title": "Linux kernel (OEM)"
+    },
     "linux-oem-5.6": {
         "description": "Linux kernel for OEM systems",
         "title": "Linux kernel (OEM)"
diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index c706a61..2d896f6 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -227,6 +227,7 @@ kernel_srcs = set(['linux',
                    'linux-oem-5.6',
                    'linux-oem-5.10',
                    'linux-oem-5.13',
+                   'linux-oem-5.14',
                    'linux-oem-osp1',
                    'linux-oracle',
                    'linux-oracle-5.0',
diff --git a/scripts/kernel_lib.py b/scripts/kernel_lib.py
index b9bfa18..ae121d2 100755
--- a/scripts/kernel_lib.py
+++ b/scripts/kernel_lib.py
@@ -195,6 +195,7 @@ meta_kernels.add_new_kernel('focal', ['linux-raspi2'], '-5.4.0', signed=False)
 meta_kernels.add_new_kernel('focal', ['linux-oem-5.6'], '-5.6.0')
 meta_kernels.add_new_kernel('focal', ['linux-oem-5.10'], '-5.10.0')
 meta_kernels.add_new_kernel('focal', ['linux-oem-5.13'], '-5.13.0')
+meta_kernels.add_new_kernel('focal', ['linux-oem-5.14'], '-5.14.0')
 meta_kernels.add_new_kernel('focal', ['linux-aws'], '-5.4.0', signed=False)
 meta_kernels.add_new_kernel('focal', ['linux-aws-5.8'], '-5.8.0', signed=False)
 meta_kernels.add_new_kernel('focal', ['linux-aws-5.11'], '-5.11.0', signed=False)
@@ -556,6 +557,11 @@ kernel_glitches = {
             '~': '5.13.0-1011.15',  # initial publication
         },
     },
+    'linux-oem-5.14': {
+        'focal': {
+            '~': '5.14.0-1002.2',  # initial publication
+        },
+    },
     'linux-oracle': {
         'xenial': {
             '~': '4.15.0-1008.10~16.04.1',