New Ksplice updates for UEKR4 4.1.12 are available for Oracle Linux 6 and 7
Synopsis: ELSA-2019-4850 can now be patched using Ksplice
CVEs: CVE-2017-15128 CVE-2017-18551 CVE-2019-11478 CVE-2019-14284 CVE-2019-14835 CVE-2019-15213 CVE-2019-15215 CVE-2019-15217 CVE-2019-15916 CVE-2019-16994 CVE-2019-16995 CVE-2019-17053 CVE-2019-17055
Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2019-4850.
More information about this errata can be found at
https://linux.oracle.com/errata/ELSA-2019-4850.html
INSTALLING THE UPDATES
We recommend that all users of Ksplice Uptrack running UEKR4 4.1.12 on
OL6 and OL7 install these updates.
On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.
Alternatively, you can install these updates by running:
# /usr/sbin/uptrack-upgrade -y
DESCRIPTION
* CVE-2019-11478: Denial-of-service when receiving packets over tcp sockets.
A logic error when receiving packets over tcp sockets could lead to a
kernel assert. A local attacker could use this flaw to cause a
denial-of-service.
Orabug: 30317608
* CVE-2017-15128: Denial-of-service when handling page fault through userfaultfd.
Incorrect error handling during userfaultfd UFFDIO_COPY ioctl operation
leads to kernel crash. An attacker can exploit this to cause
denial-of-service.
Orabug: 27422557
* NULL pointer dereference when probing Lego Mindstorms infrared device.
A race condition when probing Lego Mindstorms infrared device can trigger
a NULL pointer dereference and cause a local denial of service.
Orabug: 27124665
* CVE-2019-14284: Denial-of-service in floppy disk formatting.
A division by zero in the setup_format_params function for the floppy
disk driver could result in a kernel crash. A local user with access to
the floppy disk device could use this flaw to crash the system.
Orabug: 30447843
* CVE-2019-15916: Denial-of-service in network device registration.
A missing free of resources when registering a kobject for a net device
fails could lead to a memory leak. A local attacker could use this flaw
to exhaust kernel memory and cause a denial-of-service.
Orabug: 30350263
* CVE-2017-18551: Denial-of-service when reading data over I2C bus.
A missing check on user input when reading data over I2C bus could lead
to an out-of-bounds access. A local attacker could use this flaw to
cause a denial-of-service.
Orabug: 30210503
* Denial-of-service in Reliable Datagram Socket Infiniband address checks.
Excessive resource usage when checking Reliable Datagram Socket
Infiniband addresses could result in memory exhaustion under specific
conditions.
Orabug: 30327671
* CVE-2019-15217: NULL pointer deference when using USB ZR364XX Camera driver.
A missing check when querying capabilities of USB ZR364XX Camera device
from user space could lead to a NULL pointer dereference. A local
attacker could use this flaw to cause a denial-of-service.
Orabug: 30532774
* CVE-2019-15215: Denial-of-service when disconnecting CPiA2 USB camera.
A use-after-free vulnerability in the V4L2 interface for CPiA2 USB
camera allows a malicious USB device to crash the kernel. An attacker
could exploit this to cause a denial-of-service.
Orabug: 30511741
* CVE-2019-15213: Denial-of-service when removing a USB DVB device.
A use-after-free when releasing a USB DVB device could lead to a kernel
crash. An attacker could exploit this to cause a denial-of-service by
plugging in a malicious USB device.
Orabug: 30490491
* CVE-2019-16994: Denial-of-service in IPv6-in-IPv4 tunnel registration.
A missing free of resources when registering an IPv6-in-IPv4 tunnel fails
could lead to a memory leak. A local attacker could use this flaw to
exhaust kernel memory and cause a denial-of-service.
Orabug: 30445305
* CVE-2019-17055: Permission bypass when creating a Modular ISDN socket.
A missing check on user capabilities when creating a Modular ISDN socket
could lead to a permission bypass.
Orabug: 30445158
* CVE-2019-17053: Permission bypass when creating a IEEE 802.15.4 socket.
A missing check on user capabilities when creating a IEEE 802.15.4
socket could lead to a permission bypass.
Orabug: 30444946
* Improved fix for Spectre v1: Bounds check bypass in Vhost ioctl.
A missing use of the indirect call protection macro in the vhost ioctl
code could lead to speculative execution. A locaal attacker could use
this flaw to leak information about the running system.
Orabug: 30312787
* CVE-2019-14835: Privilege escalation during live migration of guest.
A failure to check for guest creating a zero length queue in the vhost driver
can lead to a buffer overflow in the host kernel. A guest virtual machine
could use this flaw to crash the host or potentially escalate privileges when
the virtual machine is live migrated.
Orabug: 30312787
* Kernel crash on QLogic QLA2XXX device probe failure.
Incorrect error handling could result in a NULL pointer dereference when
failing to probe a QLogic QLA2XXX device leading to a kernel crash.
Orabug: 30161119
* Infiniband connection hang after failure.
Missing ARP cache flushing could result in persistent failure after
previously failing to establish a connection.
Orabug: 29994550
* CVE-2019-16995: Denial-of-service in HSR networking finalization.
Missing resource deallocation in the High-availability Seamless
Redundancy network core could result in memory exhaustion and eventual
crash.
Orabug: 30444853
* Kernel crash in OCFS2 direct IO cluster allocation.
Missing locking when allocating clusters during a direct IO operation
could result in triggering a kernel assertion and subsequent crash.
Orabug: 30036349
SUPPORT
Ksplice support is available at ksplice-support_ww@oracle.com.
