[Ksplice-Fedora-25-updates] New Ksplice updates for Fedora 25 (FEDORA-2017-252ce2f03f)

[Oracle Ksplice]

Synopsis: FEDORA-2017-252ce2f03f can now be patched using Ksplice

Systems running Fedora 25 can now use Ksplice to patch against the
latest Fedora kernel update, FEDORA-2017-252ce2f03f.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Fedora 25
install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* Denial-of-service when using POSTROUTING rule on VRF interface.

A missing reset after sending data on a Virtual Routing and Forwarding
(VRF) enabled interface while POSTROUTING rule is enabled could lead to
a memory corruption. An attacker could use this flaw to cause a
denial-of-service.


* Denial-of-service when using diagnostic socket for sctp.

A locking error when getting socket information using NETLINK_SOCKET_DIAG
protocol could lead to a kernel panic. An attacker could use this flaw
to create a denial-of-service.


* Denial-of-service when using RECVORIGDSTADDR option on cmsg socket.

A missing check when using RECVORIGDSTADDR option on control message
(cmsg) socket could lead to an overflow. An attacker could use this flaw
to create a denial-of-service.


* Denial-of-service when using specific options of raw ipv6 socket.

A missing check when sending data through ipv6 socket configured with
IPV6_CHECKSUM and IPV6_DSTOPTS options could lead to a kernel panic. An
attacker could use this flaw to cause a denial-of-service.


* Denial-of-service in traffic control when using any net scheduler.

An incorrect variable initialization when classifying traffic control
could lead to a soft lockup. An attacker could use this flaw to cause a
denial-of-service.


* Denial-of-service when sending malformed netlink messages.

A missing check in statistics related netlink messages could lead to a
memory corruption. An attacker could use a malformed netlink message to
cause a denial-of-service.


* Denial-of-service when receiving Cisco GRE tunnels network packets.

A logic error when parsing skb using Cisco GRE Tunnels protocol could
lead to a NULL pointer dereference. A remote attacker could use this
flaw to cause a denial-of-service.


* Denial-of-service in Crypress USB HID driver.

A missing check in Crypress USB HID driver when parsing usb descriptors
could lead to an out of bounds access. An attacker with physical access
to the machine could use this flaw to cause a denial-of-service.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.