[El-errata] New Ksplice updates for UEKR2 2.6.39 on OL5 and OL6 (ELSA-2018-4172)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2018-4172 can now be patched using Ksplice
CVEs: CVE-2015-8575 CVE-2017-11600 CVE-2017-17741 CVE-2017-7616 CVE-2018-10087 CVE-2018-10124 CVE-2018-1130

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-4172.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR2 2.6.39 on
OL5 and OL6 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2017-11600: Out-of-bound access in network Transformation user configuration interface.

A missing check on user-controlled input in network Transformation user
configuration interface could lead to an out-of-bounds access. A local
attacker could use this flaw to cause a denial-of-service.

Orabug: 28264531


* CVE-2017-7616: Information leak when setting memory policy.

A missing check when setting memory policy through set_mempolicy()
syscall could lead to a stack data leak. A local attacker could use this
flaw to leak information about running kernel and facilitate an attack.

Orabug: 28242479


* CVE-2018-1130: Denial-of-service in DCCP message send.

A logic error in the dccp code could lead to a NULL pointer dereference
when transmitting messages, leading to a kernel panic.  An attacker could
use this to cause a denial-of-service.

Orabug: 28220512


* CVE-2015-8575: Information leak in Bluetooth socket binding.

Lack of input validation when binding a Bluetooth socket could result in
kernel stack memory being leaked to userspace.  A local attacker could use
this flaw to gain information about the running kernel.

Orabug: 28130291


* Deadlock while queuing messages before remote node is up using RDS protocol.

A logic error when queuing messages before remote RDS node is up could
lead to a deadlock. A local attacker could use this flaw to cause a
denial-of-service in user-space.

Orabug: 27619034


* CVE-2018-10124: Denial-of-service when using kill() syscall with a too big pid.

A missing check on user input when using kill() syscall with a pid
number higher than integer limit could lead to an overflow. A local
attacker could use this flaw to cause a denial-of-service.

Orabug: 28082989


* CVE-2018-10087: Denial-of-service when using wait() syscall with a too big pid.

A missing check on user input when using wait() syscall with a pid
number higher than integer limit could lead to an overflow. A local
attacker could use this flaw to cause a denial-of-service.

Orabug: 28049790


* CVE-2017-17741: Information leak in kvm_mmio tracepoint.

An out-of-bounds access in the kvm_mmio tracepoint could result in
disclosure of sensitive information from the host Kernel to a guest.  A
malicious guest could use this flaw to facilitate a further attack on
the host Kernel.

Orabug: 27951293

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.