[Ksplice-Fedora-29-updates] New Ksplice updates for Fedora 29 (FEDORA-2019-914542e05c)

[Oracle Ksplice]

Synopsis: FEDORA-2019-914542e05c can now be patched using Ksplice
CVEs: CVE-2019-10126 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479

Systems running Fedora 29 can now use Ksplice to patch against the
latest Fedora kernel update, FEDORA-2019-914542e05c.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Fedora 29
install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* Data corruption when using a FAT filesystem.

A missing flush after a write operation on a FAT filesystem could lead
to data corruption or loss of data.


* Deadlock when using POSIX Message Queues on large memory SMP systems.

A logic error when using POSIX Message Queues on large memory SMP
systems could lead to a deadlock. A local attacker could use this flaw
to cause a denial-of-service.


* Undefined behavior in low memory case when using memory compaction.

A missing check in low memory case when using memory compaction could
lead to an undefined behavior.


* Denial-of-service when using F2FS filesystem with a crafted filesystem.

A logic error when using a specially crafted F2FS filesystem could lead
to multiple kernel asserts. A local attacker could use this flaw to cause a
denial-of-service.


* Reference leak in error path during F2FS filesystem recovery.

A wrong error path during F2FS filesystem recovery could lead to a
reference leak. A local attacker could use this flaw to exhaust kernel
memory and cause a denial-of-service.


* Deadlock in percpu memory allocator.

A locking error in the percpu memory allocator could lead to a deadlock.
A local attacker could use this flaw to cause a denial-of-service.


* Use-after-free when registering a configfs group.

A wrong error path when registering a configfs group could lead to a
use-after-free. A local attacker could use this flaw to cause a
denial-of-service.


* Use-after-free when releasing a block multiqueue in the block layer.

A logic error when releasing a block multiqueue in the block layer could
lead to a use-after-free. A local attacker could use this flaw to cause
a denial-of-service.


* Memory leak in VFIO driver for P9 Witherspoon machine with NVIDIA V100 GPUs.

A missing free of resources on error path in VFIO driver for P9
Witherspoon machine with NVIDIA V100 GPUs could lead to a memory leak. A
local attacker could use this flaw to exhaust kernel memory and cause a
denial-of-service.


* Buffer overflow in Netfilter flow table mixed IPv4/IPv6 module.

A missing check in Netfilter flow table mixed IPv4/IPv6 module could
lead to a buffer overflow. A local attacker could use this flaw to cause
a denial-of-service.


* Reference count leak in Netfilter flow table mixed IPv4/IPv6 module.

A missing check in Netfilter flow table mixed IPv4/IPv6 module could
lead to a reference count leak. A local attacker could use this flaw to
exhaust kernel memory and cause a denial-of-service.


* NULL pointer dereference when receiving IRQ while registering Intel HD Audio driver.

A logic error when registering Intel HD Audio driver while receiving an
interrupt could lead to a NULL pointer dereference.


* Deadlock in NFS server driver when unlinking a file twice.

A logic error when unlinking a file twice in NFS server could lead to a
deadlock. A local attacker could use this flaw to cause a
denial-of-service.


* NULL pointer dereference when using ChromeOS EC communication protocol helpers.

A missing check when using ChromeOS EC communication protocol helpers
could lead to a NULL pointer dereference. A local attacker could use
this flaw to cause a denial-of-service.


* Information leak when using untrusted PCI device with Intel IOMMU.

A missing flush of IOTLB when using untrusted PCI device with Intel
IOMMU could lead to an information leak.


* Use-after-free when unregistering Intel PMC IPC driver.

A wrong error path when creating Intel PMC device fails could lead to a
use-after-free when later unregistering Intel PMC IPC driver. A local
attacker could use this flaw to cause a denial-of-service.


* Kernel stack overflow when mounting a F2FS filesystem with data_flush mode.

A logic error when mounting a F2FS filesystem with data_flush mode could
lead to a kernel stack overflow and a kernel panic. A local attacker
could use this flaw to cause a denial-of-service.


* Deadlock when unregistering a PWM device.

A logic error when unregistering a PWM device could lead to a deadlock.
A local attacker could use this flaw to cause a denial-of-service.


* Undefined behavior when converting BPF load instruction.

A logic error when converting BPF load instruction could lead to an
undefined behavior.


* CVE-2019-10126: Heap overflow when parsing IEs in Marvell WiFi-Ex driver.

A missing check when parsing IEs in Marvell WiFi-Ex driver could lead to
a heap overflow. A local attacker could use this flaw to cause a
denial-of-service.


* CVE-2019-11477, CVE-2019-11478, CVE-2019-11479: Remote Denial-of-service in TCP stack.

A number of errors in the TCP stack could result in a remotely
triggerable denial of service on links with a small Maximum Segment Size
(MSS).  A remote user could use a maliciously crafted TCP stream to
either panic the system or exhaust resources.

A new sysctl, ksplice_net_ipv4.tcp_min_snd_mss can be used to to adjust
the minimum Maximum Segment Size and defaults to 48 bytes.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.