[Ksplice-cloudlinux6-updates] New updates available via Ksplice (2.6.32-531.23.3.lve1.2.65)
Oracle Ksplice
ksplice-support_ww at oracle.com
Thu Sep 4 14:08:24 PDT 2014
Synopsis: 2.6.32-531.23.3.lve1.2.65 can now be patched using Ksplice
CVEs: CVE-2013-6378 CVE-2013-7339 CVE-2014-0196 CVE-2014-1737 CVE-2014-1738 CVE-2014-1874 CVE-2014-2672 CVE-2014-2678 CVE-2014-2706 CVE-2014-2851 CVE-2014-3144 CVE-2014-3145 CVE-2014-4699 CVE-2014-4943 CVE-2014-5077
Systems running CloudLinux 6 can now use Ksplice to patch against the
latest CloudLinux 6 kernel update, 2.6.32-531.23.3.lve1.2.65.
INSTALLING THE UPDATES
We recommend that all users of Ksplice Uptrack on CloudLinux 6 install
these updates.
On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.
Alternatively, you can install these updates by running:
# /usr/sbin/uptrack-upgrade -y
DESCRIPTION
* CVE-2014-4943: Privilege escalation in PPP over L2TP setsockopt/getsockopt.
PPP over L2TP sockets incorrectly used UDP's getsockopt and setsockopt
as a fallback handler. Since UDP's implementation expects different
data structures, a local attacker could corrupt kernel memory and gain
root privileges.
* CVE-2014-5077: Remote denial-of-service in SCTP on simultaneous connections.
Linux kernel built with the support for Stream Control Transmission
Protocol is vulnerable to a NULL pointer dereference flaw. It could occur
when simultaneous new connections are initiated between the same pair of
hosts. A remote user/program could use this flaw to crash the system kernel
resulting in denial-of-service.
* CVE-2014-1737, CVE-2014-1738: Local privilege escalation in floppy ioctl.
The floppy driver would leak internal memory addresses to userspace,
and would allow unprivileged userspace code to overwrite those
addresses, allowing for a local privilege escalation and gaining
of root.
* CVE-2014-0196: Pseudo TTY device write buffer handling race.
A race in how the pseudo ttyp (pty) device handled device writes when
two threads/processes wrote to the same pty, the buffer end could be
overwritten. An attacker could use this to cause a denial-of-service or
gain root privileges.
* CVE-2013-6378: Denial-of-service in Marvell 8xxx Libertas WLAN driver.
Incorrect validation of user supplied data in the Marvell 8xxx Libertas
WLAN driver could allow a privileged user to trigger an invalid pointer
dereference and crash the system.
* CVE-2014-1874: Denial-of-service in SELinux on empty security context.
Incorrect input validation in the SELinux subsystem could lead to a NULL
pointer dereference. A local, privileged user could use this flaw to cause
a denial-of-service.
* CVE-2014-4699: Privilege escalation in ptrace() RIP modification.
Missing validation of the RIP value could allow an unprivileged user to
cause the CPU to fetch instructions from a non-canonical address. On
some CPUs this could result in a denial-of-service or potentially allow
escalation of privileges.
* CVE-2014-2678: NULL pointer dereference in RDS protocol when binding.
A missing check in the wireless RDS protocol leads to a NULL pointer
dereference when there is no device. A local, unprivileged user could use
this flaw to cause a NULL pointer dereference and denial-of-service.
* CVE-2013-7339: NULL pointer dereference in RDS socket binding.
A missing pointer validation can trigger a NULL pointer dereference and kernel
panic when binding an RDS socket.
* CVE-2014-2851: Privilege escalation in IPv4 ping sockets.
Incorrect reference counting could result in an integer overflow causing
a use-after-free condition and crashing the kernel, or possible
escalating privileges.
* CVE-2014-2672: Kernel panic in ath9k transmit.
A race condition in the ath9k xmit driver code could lead
to multiple frees on the same object, causing an invalid memory
access and a kernel panic.
* CVE-2014-3144, CVE-2014-3145: Multiple local denial of service vulnerabilities in netlink.
The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extension implementations
in the sk_run_filter function in net/core/filter.c failed to check whether
a certain length value is sufficiently large, which allows local users to
cause a denial of service (integer underflow and system crash) via crafted
BPF instructions.
* CVE-2014-2706: Remote denial-of-service in mac80211 stack when using power mode.
A race condition in the mac80211 subsystem allows remote attackers to cause
a denial of service via network traffic that improperly interacts with the
WLAN_STA_PS_STA state, as known as power save mode.
* Denial-of-service in IP set netfilter module.
Missing permissions checks inside the IP set netfilter module could
allow a container to change the rules for the hardware node resulting in
a denial of service or private data leak.
* NULL pointer dereference in disk quota subsystem.
A race condition in quota management could result in a NULL pointer
dereference and kernel crash when initializing a disk quota.
* Use-after-free in checkpoint-restore mount failure handling.
Incorrect error logging could result in a use-after-free and a kernel
crash when a mount point restore operation failed.
SUPPORT
Ksplice support is available at ksplice-support_ww at oracle.com.
More information about the Ksplice-CloudLinux6-Updates
mailing list