[Ksplice][Ubuntu-20.04-Updates] New Ksplice updates for Ubuntu 20.04 Focal (USN-5691-1)

[Oracle Ksplice]

Synopsis: USN-5691-1 can now be patched using Ksplice
CVEs: CVE-2022-2602 CVE-2022-41674 CVE-2022-42720 CVE-2022-42721

Systems running Ubuntu 20.04 Focal can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-5691-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 20.04
Focal install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2022-42721: Denial of service in cfg80211 subsystem.

A missing check in cfg80211 subsystem can lead to internal data
structures corruption of the kernel. A local attacker able to inject
WLAN frames could use this flaw to cause denial of service.


* CVE-2022-42720: Privilege escalation in cfg80211 subsystem.

Improper reference counting in cfg80211 subsystem can lead to a use
after free error. A local attacker able to inject WLAN frames
could use this flaw to escalate privileges.


* CVE-2022-41674: Privilege escalation in cfg80211 subsystem.

Incorrect input validation in cfg80211 subsystem can lead to a buffer
overflow error. A local attacker able to inject WLAN frames could use
this flaw to escalate privileges.


* CVE-2022-2602: Privilege escalation in io_uring.

A race between handling an io_uring request and the Unix socket garbage
collector can lead to a use after free vulnerability. A local attacker
could use this flaw to escalate privileges.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.