[Ksplice-Fedora-25-updates] New Ksplice updates for Fedora 25 (FEDORA-2017-fb89ca752a)

[Oracle Ksplice]

Synopsis: FEDORA-2017-fb89ca752a can now be patched using Ksplice
CVEs: CVE-2017-5897

Systems running Fedora 25 can now use Ksplice to patch against the
latest Fedora kernel update, FEDORA-2017-fb89ca752a.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Fedora 25
install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* Denial-of-service when mounting ext4 image with large metablock group.

A missing check when mounting an ext4 image with a high first metablock
group value could lead to a buffer overflow. A local attacker with mount
capability could use this flaw to cause a denial-of-service.


* Denial-of-service when using perf on a task being killed.

A missing check when using perf on a task being killed could lead to a
use-after-free. A local attacker could use this flaw to cause a
denial-of-service.


* Denial-of-service when accessing valid_zones sysfs entry.

A logic error when reading valid_zones sysfs entry on a system with more
than 64GB of memory could lead to a kernel panic. A local attacker could
use this flaw to cause a denial-of-service.


* CVE-2017-5897: Denial-of-service in IPV6 GRE tunnel error handling.

A logic error in IPV6 GRE error handling could lead to an out of bound
access. A remote attacker could use this flaw and forge a specific IPV6
packet to cause a denial-of-service.


* Denial-of-service when using SCTP socket with concurrent thread.

A BUG_ON() could be triggered when queueing data in a full SCTP socket
while another thread disassociates the first thread from the socket. A
local attacker could use this flaw to cause a denial-of-service.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.