[Ksplice][Debian 9.0 Updates] New Ksplice updates for Debian 9.0 Stretch (4.9.272-1)

[Oracle Ksplice]

Synopsis: 4.9.272-1 can now be patched using Ksplice
CVEs: CVE-2017-0605 CVE-2019-19060 CVE-2019-19061 CVE-2020-24586 CVE-2020-24587 CVE-2020-24588 CVE-2020-25670 CVE-2020-25671 CVE-2020-25672 CVE-2020-25673 CVE-2020-26139 CVE-2020-26147 CVE-2020-29368 CVE-2020-29374 CVE-2020-36322 CVE-2021-0129 CVE-2021-20292 CVE-2021-23133 CVE-2021-23134 CVE-2021-28660 CVE-2021-28688 CVE-2021-28950 CVE-2021-28964 CVE-2021-28971 CVE-2021-28972 CVE-2021-29154 CVE-2021-29265 CVE-2021-29647 CVE-2021-29650 CVE-2021-30002 CVE-2021-31916 CVE-2021-32399 CVE-2021-33034 CVE-2021-3428 CVE-2021-3483 CVE-2021-3564 CVE-2021-3587

Systems running Debian 9.0 Stretch can now use Ksplice to patch
against the latest Debian kernel update, 4.9.272-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Debian 9.0
Stretch install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2021-28688, XSA-371: Xen Hypervisor persistant grant leakage.

A logic error when initializing pointers under certain circumstances
may overwrite unreclamied values. A local user could use to exhaust
system resources, leading to a denial-of-service.


* CVE-2021-29650: Denial-of-service in Netfilter due to incorrect memory barrier.

Lack of a full memory barrier upon the assignment of a new table value
in the Netfilter subsystem could result in a system crash. A local user
could use this flaw to cause a denial-of-service.


* CVE-2021-29154: Code execution in eBPF JIT compiler.

Improper computation validation of branch displacements in eBPF JIT
compiler could lead to memory corruption. A local attacker with
the ability to insert eBPF instructions could use this flaw to cause
a denial-of-service or possibly execute arbitrary code.


* CVE-2021-30002: Denial-of-service in V4L2 driver due to memory leaks.

A flaw in the exit code sequence of V4L2 driver could lead to memory
leaks. A local user could use this flaw to cause a denial-of-service.


* CVE-2020-29374: Multiple vulnerabilities in get_user_pages of Memory Management subsystem.

Due to a flaw in Memory Management subsystem unintended write access
could be granted when get_user_pages is used for a copy-on-write page.
A local user could use this flaw to cause a wide range of problems,
including information exposures, denial of service, and arbitrary code
execution.


* Note: Oracle has determined that CVE-2021-29647 is not applicable.

The kernel is not affected by CVE-2021-29647 since the code under
consideration is not compiled.


* Note: Oracle has determined that CVE-2019-19060 is not applicable.

The kernel is not affected by CVE-2019-19060 since the code under
consideration is not compiled.


* CVE-2021-20292: Double Free in Nouveau DRM subsystem.

A flaw in nouveau_sgdma_create_ttm() in Nouveau DRM subsystem results
in double free. An local attacker with a root privilege, can leverage
this vulnerability to escalate privileges and execute code in the
kernel context.


* CVE-2020-25670: Denial-of-service in socket binds of NFC LLCP protocol.

A reference counting error in sockets binds of the NFC LLCP protocol
implementation could lead to a system crash. A local attacker could use
this to cause a denial of service.


* CVE-2021-28660: Out-of-bounds writes in Realtek RTL8188EU Wireless LAN NIC driver.

A missing error handling check in Realtek RTL8188EU Wireless LAN NIC
driver could lead to out-of-bounds writes. A local user could use this
flaw for a denial-of-service or code execution.


* CVE-2020-25672: Denial-of-service in socket connects of the NFC LLCP protocol.

A flaw in socket connects of the NFC LLCP protocol implementation could
lead to a failure to deallocate memory in certain error situations.
A local attacker could use this flaw to cause a denial of service.


* CVE-2021-3483: Code execution in FireWire packet sniffer due to improper reference counting.

A reference counting flaw in ioctls of IEEE 1394 FireWire packet sniffer
could allow a device to be started twice leading to a use-after-free.
A local user could use this flaw to cause a code execution or a denial
of service.


* CVE-2020-25673: Denial-of-service in NFC subsystem due to improper error handling.

Improper error handling in LLC socket connects of NFC subsystem could
lead to an infinite loop. A local attacker could use this to cause
a denial of service.


* Out-of-bounds memory accesses when accessing HID devices array fields.

Out-of-bounds reads and writes in HID driver during HID device
registration could lead to information disclosure and corruption of
internal data structures. A local attacker could use this flaw
to cause a denial-of-service or as an aid in another type of
attack.


* CVE-2021-31916: Information disclosure due to out-of-bounds writes in the Multi-device driver.

A flaw in ioctls of Multiple devices driver support could lead to
out-of-bounds memory writes. An attacker with special user
(CAP_SYS_ADMIN) privilege could use this flaw for denial-of-service
or information disclosure.


* CVE-2017-0605: Privilege escalation when using kernel tracing subsystem.

Usage of strcpy() when using kernel tracing subsystem and retrieving
traced process command line could lead to a stack overflow. A local
attacker could use this flaw to execute arbitrary code in the kernel and
escalate privilege.


* CVE-2021-28964: Denial-of-service in the btrfs filesystem.

Lack of proper locking when resolving back-references as part of some
filesystems operations could lead to a kernel assertion to trigger.  An
unprivileged user could use this flaw to cause a denial-of-service.


* Denial-of-service in security key addition for Generic IEEE 802.15.4 Soft Networking Stack.

A flaw in link-layer security key addition for Generic IEEE 802.15.4 Soft
Networking Stack could lead to a system crash. A local attacker could
use this to cause a denial of service.


* CVE-2021-29265: Denial-of-service in usbip driver due to race conditions.

Race conditions in the stub-up sequence of the usbip driver during
an update of the local and shared status could lead to a system crash.
A local attacker could use this flaw to cause a Denial-of-service.


* CVE-2021-28971: Denial-of-service due to PEBS status mishandling in Intel processors Support.

PEBS status mishandling in PEBS records of Intel processors Support
might lead to a situation on some Haswell and earlier systems when
userspace applications could cause a system crash. A local user could
use this flaw to cause a denial-of-service.


* Note: Oracle has determined that CVE-2019-19061 is not applicable.

The kernel is not affected by CVE-2019-19061 since the code under
consideration is not compiled.


* Note: Oracle has determined that CVE-2021-28972 is not applicable.

Oracle has determined that CVE-2021-28972 is not applicable to x86.
Applying the patch has no resulting changes in the generated object
files.


* Note: Oracle will not provide a zero-downtime update for CVE-2020-36322 and CVE-2021-28950.

Oracle has determined that patching CVE-2020-36322 and CVE-2021-28950
on a running system would not be safe and recommends rebooting to avoid
the vulnerability.


* Note: Oracle will not provide a zero-downtime update for CVE-2021-3428.

A flaw in the ext4 filesystem driver allows a privileged user with
the ability to mount a crafted ext4 filesystem to cause a denial of
service. Oracle will not provide a zero-downtime update for CVE-2021-3428
because it contains data changes that are not safe to include in
a Ksplice update and has a low CVVS v3 score of 4.4.


* CVE-2021-23133: Multiple vulnerabilities due to a race condition in SCTP.

A flaw in socket functionality of Stream Control Transmission Protocol
could lead to a race condition. A local user with network service
privileges could use this flaw for privilege escalation, information
disclosure or denial-of-service.


* CVE-2020-25671: Denial-of-service in the NFC LLCP protocol due to a refcount leak.

A flaw in socket connects of the NFC LLCP protocol implementation could
lead to a refcount leak in certain error situations.A local attacker
could use this flaw to cause a denial of service.


* CVE-2020-29368: Write protection bypass in huge-page handler.

A race condition in the kernel huge page handing could result in a
kernel huge page being erroneously created with write permissions after
it was duplicated via copy-on-write. A malicious user might exploit this
to modify sensitive kernel data structures.


* CVE-2021-33034: Use-after-free when tearing down bluetooth HCI channel.

A race condition in the bluetooth Host Controller Interface code could
result in a use-after-free. A malicious device might exploit this to
write data to an arbitrary kernel address, potentially allowing code
execution under control of the device.


* CVE-2021-23134: Race when creating NFC sockets allows privilege escalation.

A race condition in the kernel's Near Field Communication socket code
could allow for a use-after-free and potential code execution. A
malicious user with the CAP_NET_RAW permission might exploit this to
escalate their privileges.


* CVE-2021-0129: Man-in-the-middle disclosure of bluetooth passkey.

The kernel bluetooth pairing process contains a flaw that might allow a
malicious nearby device to determine the passkey used to complete the
pairing, or potential pair itself instead.


* CVE-2020-26147: Information disclosure/packet injection over WEP/WPA WiFi.

The kernel 802.11 WiFi driver erroneously combines encypted and
plaintext fragments, potentially allowing an attacker to intercept or
inject into a legitimate encrypted WiFi connection.


* Note: Oracle will not provide a zero-downtime update for CVE-2020-24586 or CVE-2020-24587.

Oracle has determined that patching CVE-2020-24586 and CVE-2020-24587 on
a running system would not be safe. These vulnerabilities have a low
CVVS score of 3.5 and 2.6 respectively. Oracle therefore recommends a
reboot to mitigate these issues.


* CVE-2020-24588: Packet injection via unauthenticated A-MSDU header.

A flaw in the design of the 802.11 WiFi standard allows for potential
packet injection via an unauthenticated A-MSDU frame header.


* CVE-2020-26139: Remote denial-of-Wifi-service via malicious EAPOL frames.

When acting as an access point, the kernel WiFi driver might forward
EAPOL frames to other devices that have not successfully authenticated.
A malicious device might exploit this to cause a denial-of-service of
the WiFi connection towards legitimately connected clients.


* CVE-2021-3564: Use-after-free when initializing bluetooth HCI device.

A flaw in the bluetooth Host Controller Interface handling could result
in a use-after-free if a device fails initialization. A malicious local
device or user might exploit this to cause a denial-of-service.


* CVE-2021-3587: Denial-of-service when calling sockname() on NFC socket.

If an NFC socket fails to bind, calling getsockname() will result in a
NULL pointer deference. A local, unprivileged user might exploit this to
cause a denial-of-service.


* CVE-2021-32399: Race condition when removing bluetooth HCI controller.

A race condition when removing bluetooth HCI controller could result in
race condition and out-of-bounds write. A malicious unprivileged user
might able to exploit this to cause a denial-of-service or escalate
their privileges.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.