From gregory.herrero at oracle.com  Mon Dec 16 07:54:02 2019
From: gregory.herrero at oracle.com (Gregory Herrero)
Date: Mon, 16 Dec 2019 16:54:02 +0100
Subject: [Ksplice][Virtuozzo 4.7 Updates] New Ksplice updates for Virtuozzo
	4.7 or OpenVZ on RHEL 6 (2.6.32-042stab141.3)
Message-ID: <201912161554.xBGFs6R3002168@aserv0121.oracle.com>

Synopsis: 2.6.32-042stab141.3 can now be patched using Ksplice
CVEs: CVE-2018-12207 CVE-2019-0154 CVE-2019-0155 CVE-2019-11135 CVE-2019-11478 CVE-2019-14835 CVE-2019-3900

Systems running Virtuozzo 4.7 or the OpenVZ RHEL 6 kernel can now use
Ksplice to patch against the latest Parallels Virtuozzo Containers 4.7
kernel security update, 2.6.32-042stab141.3.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Virtuozzo 4.7
or OpenVZ on RHEL 6 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2019-14835: Privilege escalation during live migration of guest.

A failure to check for guest creating a zero length queue in the vhost driver
can lead to a buffer overflow in the host kernel.  A guest virtual machine
could use this flaw to crash the host or potentially escalate privileges when
the virtual machine is live migrated.


* Improved fix to CVE-2019-11478: Remote Denial-of-service in TCP stack.

The previous fix for CVE-2019-11478 might overzealously check sockets
with abnormally low SO_SNDBUF sockopt settings, resulting in performance
degradation.


* CVE-2019-3900: Infinite loop in vhost_net driver under heavy load.

It is possible, under certain conditions, for the vhost_net driver to
get caught in a near-infinite loop while trying to process incoming
packets.  This flaw could be exploited by a malicious local or remote
attacker in order to cause a deny access to network services that rely
on the vhost_net driver.


* CVE-2019-11135: Side-channel information leak in Intel TSX.

A side-channel information leak on some generations of Intel processors
could allow the leaking of internal microarchitectural buffers during
asynchronous aborts in a TSX transaction.  For CPUs that are vulnerable
to Microarchitectural Data Sampling, existing mitigations cover
CVE-2019-11135, for newer CPUs with hardware fixes for MDS, TSX is
transparently disabled.  On these newer CPUs, TSX functionality can be
restored by writing 0 to /sys/kernel/debug/x86/tsx_force_abort.


* CVE-2018-12207: Machine Check Exception on page size change.

A hardware bug in Intel x86 processors can result in a Machine Check Exception
when a page table mapping for currently executing instructions is changed. A
privileged user in a guest VM could use this flaw to crash the host, leading to
a denial-of-service.


* CVE-2019-0155: Privilege escalation in Intel i915 graphics driver.

Missing validation of MMIO commands to the Intel i915 device driver could
result in illicit page table modifications. An attacker could use this to
access sensitive information or elevate privileges.


* CVE-2019-0154: Denial-of-service in Intel i915 graphics driver.

Due to a hardware error, the Intel i915 device state could get corrupted.
A malicious user could use this to cause denial-of-service.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.