[El-errata] New updates available via Ksplice (ELSA-2013-2523)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2013-2523 can now be patched using Ksplice
CVEs: CVE-2012-4542

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Security Advisory, ELSA-2013-2523.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack on EL 5 install these
updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* NULL pointer dereference in SCSI device removal.

A race condition in the SCSI device removal code could cause a NULL
pointer dereference when removing a drive such as a USB HDD.


* Stale timer values in Xen event channel handling.

The processing of timer interrupts in the xen event channel could happen
before other interrupts causing drivers to see incorrect time values and
triggering unexpected behaviour.


* Incorrect load calculation in procfs.

Integer overflow in the procfs idle and iowait calculation functions could
cause userspace to report heavy loading even when the system was idle.


* CVE-2012-4542: SCSI command filter does not restrict access to read-only devices.

The default SCSI command filter does not accommodate commands that overlap across
device classes. A privileged guest user could potentially use this flaw to write
arbitrary data to a LUN that is passed-through as read-only.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.