[Ksplice][Ubuntu-20.04-Updates] New Ksplice updates for Ubuntu 20.04 Focal (USN-6131-1)

[Oracle Ksplice]

Synopsis: USN-6131-1 can now be patched using Ksplice
CVEs: CVE-2023-1380 CVE-2023-2612 CVE-2023-30456 CVE-2023-31436 CVE-2023-32233

Systems running Ubuntu 20.04 Focal can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-6131-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 20.04
Focal install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2023-1380: Out-of-bounds read in Broadcom 802.11 Networking Device Driver.

Out-of-bounds read exists in the Broadcom 802.11 Networking Device Driver. This
can lead to a denial-of-service.


* CVE-2023-2612: Denial-of-service in UID/GID shifting overlay filesystem for containers.

Improper inode lock handling in shiftfs could lead to a kernel deadlock.
A local attacker could use this to cause a denial-of-service.


* CVE-2023-32233: Use-after-free in Netfilter nf_tables packet classification framework.

Incorrect handling of anonymous sets in the Netfilter nf_tables packet
classification framework can lead to a use-after-free.  This can allow a
local unprivileged user to perform arbitrary access to kernel memory and
escalate privileges.


* CVE-2023-31436: Out-of-bounds memory access in sch_qfq driver.

An arithmetic error in the sch_qfq driver can lead to an out-of-bounds
memory access.  A local attacker could exploit this flaw to leak
sensitive information or to cause other undefined behavior.


* CVE-2023-30456: Privilege escalation in Intel VMX subsystem for KVM.

Insufficient checking in Intel VMX system for KVM can allow a nested guest
to control values in the virtual machine control structure. This can allow a
local user to escalate privileges.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.