[Ksplice][Ubuntu-18.04-Updates] New Ksplice updates for Ubuntu 18.04 Bionic (USN-5669-1)

[Oracle Ksplice]

Synopsis: USN-5669-1 can now be patched using Ksplice
CVEs: CVE-2022-0812 CVE-2022-1012 CVE-2022-2318 CVE-2022-26365 CVE-2022-27666 CVE-2022-32296 CVE-2022-33740 CVE-2022-33741 CVE-2022-33742 CVE-2022-33744 CVE-2022-36123

Systems running Ubuntu 18.04 Bionic can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-5669-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 18.04
Bionic install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2022-0812: Information leak in NFS RDMA transport.

The RDMA transport method for NFS RPCs fails to properly calculate the
size of its headers. This could result in uninitialized kernel data
being inadvertently transmitted over the network.


* CVE-2022-27666: Privilege escalation in IPsec ESP transformation.

A logic flaw in IPsec ESP transformation implementation could lead to
a heap buffer overflow. A local user could use this flaw to overwrite
kernel heap objects and cause privilege escalation.


* CVE-2022-2318: Privilege escalation in X.25 Packet Layer Protocol.

Improper reference counting in X.25 Packet Layer Protocol (Rose) could
lead to a use-after-free. A local unprivileged user could use this flaw
for privilege escalation.


* Note: Oracle will not be providing an update for CVE-2022-36123.

This CVE is only applicable at boot time, so by the time Ksplice live updates
are applied, the relevant code has already run.


* Note: Oracle has determined that CVE-2022-33744 is not applicable.

Oracle has determined that CVE-2022-33744 is not applicable to x86.
Applying the patch has no resulting changes in the generated object
files.


* CVE-2022-1012, CVE-2022-32296: Information disclosure in TCP.

Insufficient randomness in TCP source port number generation when
opening TCP connections to remote host could lead to an information
leak. A remote attacker can use this to fingerprint a network host.


* Note: Oracle will not provide a zero-downtime update for XSA-403, CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742.

Oracle has determined that live patching XSA-403, CVE-2022-26365,
CVE-2022-33740, CVE-2022-33741, CVE-2022-33742 on a running system would
not be safe. The vulnerability allows an information leak in Xen PV
frontends (blkfront and netfront) from the guest to the hypervisor.
Hosts not using Xen are not affected.

Oracle recommends a reboot to mitigate these issues if the host is affected.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.