El-errata: New Ksplice updates for UEKR7 5.15.0 on OL8 and OL9 (5.15.0-5.76.5.1)
Synopsis: 5.15.0-5.76.5.1 can now be patched using Ksplice CVEs: CVE-2016-5195 CVE-2017-1000253 CVE-2017-11176 CVE-2019-9213 CVE-2021-22543 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 CVE-2021-4154 CVE-2022-0185 CVE-2022-0847 CVE-2022-1184 CVE-2022-2308 CVE-2022-2588 CVE-2022-2602 CVE-2022-2663 CVE-2022-27666 CVE-2022-2978 CVE-2022-3524 CVE-2022-3542 CVE-2022-3543 CVE-2022-3564 CVE-2022-3565 CVE-2022-3594 CVE-2022-3619 CVE-2022-3621 CVE-2022-3623 CVE-2022-3628 CVE-2022-3640 CVE-2022-3646 CVE-2022-3649 CVE-2022-40768 CVE-2022-41674 CVE-2022-41850 CVE-2022-42719 CVE-2022-42720 CVE-2022-42721 CVE-2022-42722 CVE-2022-42895 CVE-2022-42896 CVE-2022-43750 CVE-2022-4378 CVE-2022-43945
Users with Oracle Linux Premier Support can now use Ksplice to patch against the latest Oracle kernel update, 5.15.0-5.76.5.1.
INSTALLING THE UPDATES
We recommend that all users of Ksplice Uptrack running UEKR7 5.15.0 on OL8 and OL9 install these updates.
On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf, these updates will be installed automatically and you do not need to take any action.
Alternatively, you can install these updates by running:
# /usr/sbin/uptrack-upgrade -y
DESCRIPTION
* Denial-of-service when checking if an address is a jump label.
The jump label sub-system has an assertion that can be triggered while installing Ksplice updates.
* CVE-2022-4378: Privilege escalation in the proc filesystem.
Incorrect bounds checking and an integer overflow in the proc filesystem could lead to out-of-bounds memory writes. An unprivileged user could use this flaw to cause a denial-of-service or elevate privileges.
* CVE-2022-41850: Use-after-free in Roccat support driver.
A race condition in Roccat support driver may lead to a
read-after-free. A local user could use this flaw to gain
sensitive information as a part of another type of attack.
* CVE-2022-42722: Denial of service in beacon protection for P2P-device.
A missing check in mac80211 subsystem can lead to a null pointer dereference error. A local attacker able to inject WLAN frames could use this flaw to cause denial of service.
* CVE-2022-41674: Privilege escalation in cfg80211 subsystem.
An incorrect input validation in cfg80211 subsystem can lead to a buffer overflow error. A local attacker able to inject WLAN frames could use this flaw to escalate privileges.
* CVE-2022-43750: Use-after-free in USB monitor.
Incorrect permission flags set on userspace memory mappings in usbmon could lead to a use-after-free. A local attacker could use this flaw for a denial-of-service or escalate privileges.
* CVE-2022-3565: Use-after-free in modular ISDN driver.
A race condition in mISDN when l1oip_cleanup is called while a timer handler is running may lead to a use-after-free. A local user could use this flaw for a denial-of-service or privilege escalation.
* Note: Oracle has determined that CVE-2022-3649 is not applicable.
A missing sanity check in nilfs2 when handling corrupted on-disk filesystem data could lead to a use-after-free. An attacker could use this flaw to cause a denial-of-service or escalate privileges.
The kernel is not affected by CVE-2022-3649 since the code under consideration is not compiled.
* Unexpected return codes from recvmsg() for RDS sockets.
A logic error in the RDS messaging implementation can cause unexpected errors to be thrown by recvmsg(). This can disrupt the operation of userspace applications in some cases.
Orabug: 34658657
* Note: Oracle has determined that CVE-2022-3621 is not applicable.
A missing sanity check in nilfs2 when handling corrupted on-disk filesystem data could lead to a NULL pointer dereference. A local user could use this flaw for a denial-of-service.
The kernel is not affected by CVE-2022-3621 since the code under consideration is not compiled.
* CVE-2022-2978: Denial-of-service when initializing inodes.
A logic error when initializing inodes could lead to an invalid memory access. A local attacker could use this flaw to cause a denial-of- service.
* Note: Oracle has determined that CVE-2022-3646 is not applicable.
A flaw in NILFS2 when failing to create a log write thread could lead to a memory leak. A local attacker could use this flaw to exhaust system memory and cause a denial-of-service.
The kernel is not affected by CVE-2022-3646 since the code under consideration is not compiled.
* CVE-2022-42721: Denial of service in cfg80211 subsystem.
A missing check in cfg80211 subsystem can lead to internal data structures corruption of the kernel. A local attacker able to inject WLAN frames could use this flaw to cause denial of service.
* CVE-2022-2308: Information disclosure in Virtio Data Path Acceleration.
Improperly initialized memory in vDPA when a vDPA Device in Userspace (VDUSE) application requests configuration data from the driver may lead to leaking kernel stack memory. This could cause undefined behavior or data leaks in Virtio drivers.
* CVE-2022-3594: Denial-of-service in r8152 USB network driver.
Improper management of logging in the r8152 driver when handling interrupts can lead to logging of excessive data. A remote attacker could use this flaw to flood the system logs and hinder the ability to detect anomalous conditions.
* CVE-2022-40768: Information leak in Promise SuperTrak EX driver.
A missing zeroing of on-stack memory passed to userspace in a SCSI driver could lead to an information leak. A local attacker could use this flaw to leak information about running kernel and facilitate an attack.
* CVE-2022-42720: Privilege escalation in cfg80211 subsystem.
Improper reference counting in cfg80211 subsystem can lead to a use after free error. A local attacker able to inject WLAN frames could use this flaw to escalate privileges.
* Updated fix to CVE-2022-1184: Use-after-free when handling corrupted hash tree in ext4.
A logic error when handling corrupted hash tree directory in ext4 filesystems could lead to a use-after-free. A local attacker could use this flaw and a malicious ext4 image to cause a denial-of-service.
* Note: Oracle has determined that CVE-2022-3542 is not applicable.
The kernel is not affected by CVE-2022-3542 since the code under consideration is not compiled.
* CVE-2022-2663: Firewall bypass in IRC connection tracking
An issue in nf_conntrack_irc in unencrypted IRC protocol message handling could result in messages being incorrectly matched by the firewall. A remote user could use this flaw to bypass local firewall rules.
* CVE-2022-2602: Privilege escalation in io_uring.
A race between handling an io_uring request and the Unix socket garbage collector can lead to a use after free vulnerability. A local attacker could use this flaw to escalate privileges.
* CVE-2022-42719: Privilege escalation in mac80211 subsystem.
An improper resources management in mac80211 subsystem can lead to a use after free error. A local attacker able to inject WLAN frames could use this flaw to cause denial of service or escalate privileges.
* CVE-2022-43945: Out-of-bounds memory access in NFSD.
A logic error in NFSD when a small RPC Call message arrives in an oversized RPC record can lead to a buffer overflow. A remote attacker could use this flaw for a denial-of-service or privilege escalation.
* Information leak in Transparent Inter Process Communication (TIPC) protocol.
A logic error in TIPC protocol during socket initialization can lead to kernel information leak. A local user could use this flaw to gain access to sensitive information.
* CVE-2022-3564: Use-after-free in Bluetooth L2CAP.
A race condition in Bluetooth L2CAP when a socket buffer is queued and dequeued by two flows running in parallel can lead to a use-after-free. A remote attacker could use this flaw for a denial-of-service or for privilege escalation.
* CVE-2022-3524: Memory-leak in IPv6 networking.
A race condition in IPv6 networking when converting an IPv6 socket into IPv4 could lead to a memory-leak. A local user could use this flaw to exhaust the system's memory and cause denial-of-service.
* CVE-2022-42896: Use-after-free in Bluetooth L2CAP.
A flaw in Bluetooth L2CAP protocol when accepting incoming connection requests could lead to a use-after-free. A remote attacker could use this flaw for a denial-of-service or for privilege escalation.
* CVE-2022-42895: Information disclosure in Bluetooth subsystem.
A missing sanity check when parsing a configuration request in Bluetooth L2CAP implementation could result in out-of-bounds memory access. A physically proximate attacker could use this flaw for information disclosure.
* CVE-2022-3640: Use-after-free in Bluetooth subsystem.
A logic flaw in receive data path of the Bluetooth subsystem could result in a use-after-free. A local user could use this flaw to cause a denial-of-service or execute arbitrary code.
* CVE-2022-3628: Code execution in Broadcom FullMAC USB WiFi driver.
A missing sanity check when setting up the Broadcom FullMAC USB WiFi driver could result in out-of-bounds access. A physically proximate user could use this flaw to craft a malicious USB device and cause a denial-of-service or execute arbitrary code.
* CVE-2022-3623: Information disclosure in hugetlb.
A race condition in hugetlb when multiple threads are looking up CONT-PTE/PMD pages could lead to page table inconsistencies. A local attacker could use this to cause a denial-of-service or expose sensitive information.
* CVE-2022-3543: Denial-of-service in Unix domain sockets.
Improperly released resources in the AF_UNIX sockets when closing sockets with unconsumed out-of-band buffers could lead to a memory leak. A local user could use this flaw to exhaust kernel memory and cause de denial-of-service.
* CVE-2022-3619: Denial-of-Service in Bluetooth L2CAP.
Improperly released resources in Bluetooth L2CAP when handling fragmented frames could result in a memory leak. A remote user could use this flaw to exhaust the kernel memory and cause a
denial-of-service.
SUPPORT
Ksplice support is available at ksplice-support_ww@oracle.com.
_______________________________________________
New Ksplice updates for UEKR7 5.15.0 on Oracle Linux 8 and 9 are available.
