[Ksplice][Ubuntu-18.04-Updates] New Ksplice updates for Ubuntu 18.04 Bionic (USN-5727-1)
Oracle Ksplice
quentin.casasnovas at oracle.com
Thu Dec 8 15:41:30 UTC 2022
Synopsis: USN-5727-1 can now be patched using Ksplice
CVEs: CVE-2022-20422 CVE-2022-2153 CVE-2022-2978 CVE-2022-3028 CVE-2022-3061 CVE-2022-3629 CVE-2022-3635 CVE-2022-36879 CVE-2022-40768
Systems running Ubuntu 18.04 Bionic can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-5727-1.
INSTALLING THE UPDATES
We recommend that all users of Ksplice Uptrack running Ubuntu 18.04
Bionic install these updates.
On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.
Alternatively, you can install these updates by running:
# /usr/sbin/uptrack-upgrade -y
DESCRIPTION
* CVE-2022-3028: Out-of-bounds memory access in IP framework XFRM subsystem.
Multiple calls to the same function in the IP framework can lead to
a race condition and subsequent out-of-bounds memory accesses. A local
attacker could exploit this flaw to leak kernel memory or make arbitrary
writes to kernel memory.
* CVE-2022-36879: Denial-of-service in XFRM.
An incorrect reference counting flaw in IP framework for transforming
packets when manipulating XFRM policy entries could result in releasing
a resource before it is made available for re-use. A local user could
use this flaw for a denial-of-service.
* CVE-2022-2978: Use-after-free in NILFS.
Incorrect initialization of the inode structure in the NILFS file system
implementation may lead to a use-after-free. A local attacker could use
this flaw to cause a denial-of-service or potentially execute arbitrary
code.
* CVE-2022-3635: Denial-of-service in IDT 77252 ATM PCI driver.
The IDT 77252 ATM PCI device driver did not remove pending timers during
device exit, which could lead to a use-after-free. A local attacker could
potentially use this to cause a denial-of-service or execute arbitrary code.
* Improved update to CVE-2022-2153: Denial-of-service in Kernel-based Virtual Machine.
A logic flaw in Kernel-based Virtual Machine in some cases when KVM
initializes a vCPU without creating APIC could result in NULL pointer
dereference. A local user could use this flaw for a denial-of-service.
* Note: Oracle has determined that CVE-2022-20422 is not applicable.
Oracle has determined that CVE-2022-20422 is not applicable to x86.
Applying the patch has no resulting changes in the generated object files.
* CVE-2022-40768: Information leak in Promise SuperTrak EX driver.
A missing zeroing of on-stack memory passed to userspace in a SCSI driver
could lead to an information leak. A local attacker could use this flaw
to leak information about running kernel and facilitate an attack.
* CVE-2022-3629: Memory leak in virtual socket protocol.
A race condition in VMware vSockets Driver when attempting to connect a
vsock in non-blocking mode may lead to a reference count leak. A local
attacker could use this flaw to exhaust kernel memory and eventually
cause a denial-of-service.
* CVE-2022-3061: Denial-of-service in i740fb framebuffer driver.
Improper checking of userspace provided arguments in i740fb when
setting the 'pixclock' hardware property may lead to a divide-by-zero
bug. A local attacker could use this flaw for a denial-of-service.
SUPPORT
Ksplice support is available at ksplice-support_ww at oracle.com.
More information about the Ksplice-Ubuntu-18.04-updates
mailing list