[Ksplice][Ubuntu-15.10-Updates] New updates available via Ksplice (USN-3017-1)

[Oracle Ksplice]

Synopsis: USN-3017-1 can now be patched using Ksplice
CVEs: CVE-2016-3134 CVE-2016-4482 CVE-2016-4557 CVE-2016-4565 CVE-2016-4569 CVE-2016-4578 CVE-2016-4580 CVE-2016-4913 CVE-2016-4951 CVE-2016-4997 CVE-2016-4998

Systems running Ubuntu 15.10 Wily can now use Ksplice to patch against
the latest Ubuntu Security Notice, USN-3017-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack on Ubuntu 15.10 Wily
install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* Denial-of-service in USB stack during device unplug.

Incorrect handing of USB devices during unplug could result in memory
corruption and a kernel crash.  A user with physical access to the
system could use this flaw to crash the system.


* CVE-2016-4578, CVE-2016-4569: Information leak in sound timers.

Missing initialization of stack data structures could result in leaking
the contents of kernel stack memory to user-space.  A local user with
access to the sound device could use this flaw to infer the layout of
kernel memory.


* CVE-2016-4580: Kernel stack information leak in X25 facility negotiation.

Missing initialization of a stack data structure could result in leaking
up to 8 bytes of kernel stack information to a local, unprivileged user.


* CVE-2016-4913: Information leak in ISO9660 filename parsing.

Incorrect handling of NUL termination bytes could result in reading
excessive data from a kernel buffer into user-space.  A local user with
permissions to mount a maliciously crafted filesystem could use this
flaw to leak the contents of sensitive memory.


* CVE-2016-4951: NULL pointer dereference in TIPC nested attribute parsing.

A missing NULL pointer check could result in a NULL pointer dereference
when parsing nested attributes for a published socket.


* CVE-2016-4482: Information leak in USB devfs ioctl.

The USB devfs driver can leak the contents on the kernel stack to
userspace when performing a USBDEVFS_CONNECTINFO operation.


* NULL pointer dereference in DECnet routing.

Missing NULL pointer checks could result in a NULL pointer dereference
and kernel crash when outputting a DECnet packet.  A local, unprivileged
user could use this flaw to crash the system.


* CVE-2016-4557: Privilege escalation in Berkeley Packet Filter.

A use-after-free in the Berkeley Packet Filter could allow a local,
unprivileged user to crash the system or escalate privileges with a
carefully crafted BPF program.


* Use-after-free in network bridge ioctl().

Missing locking in the bridge ioctl handler for receiving network
interface indices could result in a use-after-free and kernel crash
under specific conditions.


* Use after free in MAC-VLAN frame handling.

Incorrect reference counting when handling frames from a macvtap device
can trigger a use after free and kernel panic.


* Improved fix for CVE-2016-4565: Privilege escalation in Infiniband ioctl.

The initial fix for CVE-2016-4565 did not handle QLogic Hyper-Transport
adaptors which could allow local users to escalate privileges on
machines with that adaptor enabled.


* Kernel panic when probing Maxim MAX8997 haptic devices.

A logic error when probing Maxim MAX8997 haptic devices can trigger a
NULL pointer dereference and kernel panic when probing a device.


* CVE-2016-3134, CVE-2016-4997, CVE-2016-4998: Memory corruption in SO_SET_REPLACE netfilter interface.

The netfilter subsystem does not correctly validate IPT_SO_SET_REPLACE
data from userspace which can allow local users with CAP_NET_ADMIN
privileges to trigger kernel memory corruption and possibly gain
elevated privileges.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.