[El-errata] New Ksplice updates for UEKR2 2.6.39 on OL5 and OL6 (ELSA-2018-4088)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2018-4088 can now be patched using Ksplice
CVEs: CVE-2017-0861 CVE-2017-15868 CVE-2017-16526 CVE-2017-16527 CVE-2017-16536 CVE-2017-16649 CVE-2018-1000199

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-4088.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR2 2.6.39 on
OL5 and OL6 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2017-0861: Use-after-free in ALSA sound subsystem.

A race condition when closing an ALSA device descriptor could cause a
use-after-free, potentially allowing an attacker to write to protected
memory and cause a privilege escalation.

Orabug: 27344840


* CVE-2017-15868: Privilege escalation in the Bluetooth stack when adding connections.

Multiple missing checks that a socket belongs to the L2CAP layer leads to
type confusion and kernel crash.  A local user with the ability to create a
BNEP (Bluetooth Network Encapsulation Protocol), Human Interface Device
Protocol (HIDP) or a CAPI Message Transport Protocol (CMTP) connection
could use this flaw to escalate privileges.

Orabug: 27344787


* CVE-2017-16649: Divide by zero when binding a network USB device.

A logic error when binding a network USB device could lead to a divide
by zero error. A local attacker could use this flaw to cause a
denial-of-service.

Orabug: 27215206


* CVE-2017-16536: NULL pointer dereference when registering a Conexant cx231xx USB video device.

A missing check when probing a Conexant cx231xx USB video device could
lead to a NULL pointer dereference. A local attacker could use a crafted
USB device to cause a denial-of-service.

Orabug: 27208080


* Out-of-bounds access during parsing of Human Interface Device information.

A failure to validate information supplied by a USB device can result in
a out-of-bounds memory write, leading to undefined behaviour.

Orabug: 27207935


* CVE-2017-16526: Denial-of-service in failed launch of UWB daemon.

A failure to handle an error case when launching the UWB management
daemon can result in an invalid pointer dereference leading to a kernel
crash.

Orabug: 27206900


* CVE-2017-16527: Use-after-free when creating mixer for USB Audio device.

A missing free in error path when creating mixer for USB Audio device
could lead to a use-after-free. A local attacker could use a crafted USB
Audio device to cause a denial-of-service.

Orabug: 27148283


* System crash in Broadwell microcode updates.

A microcode bug in specific Broadwell microcode revisions could result
in a system crash and reboot when applying microcode updates.  For these
revisions, only a BIOS based microcode update is supported.

Orabug: 27343579


* Missing Spectre V2 protections on AMD systems.

A difference in capability reporting between AMD and Intel based X86
systems could result in failure to apply IBRS protections on AMD
systems.

Orabug: 27649706


* Spectre v2 hardening on context switch.

Additional speculation barriers on context switch add protection for
sensitive processes to prevent leaking of sensitive data across
privilege boundaries.

Orabug: 2751637


* CVE-2018-1000199: Denial-of-service in hardware breakpoints.

Incorrect validation of a ptrace hardware breakpoint could result in
corrupted kernel state.  A local, unprivileged user could use this flaw
to crash the system or potentially, escalate privileges.

Orabug: 27947612


* Improved vulnerability reporting for Spectre v2.

Incorrect vulnerability reporting for Spectre v2 could report the system
as being vulnerable when it was actually protected.

Orabug: 27519083


* Connectivity loss with Xen virtualized network driver.

Incorrect handling of integer overflow could result in missing
notifications and network stalls after receiving a large number of
frames.

Orabug: 25053376

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.