[El-errata] New Ksplice updates for UEKR2 2.6.39 on OL5 and OL6 (ELSA-2018-4088)
Errata Announcements for Oracle Linux
el-errata at oss.oracle.com
Wed May 2 14:09:12 PDT 2018
Synopsis: ELSA-2018-4088 can now be patched using Ksplice
CVEs: CVE-2017-0861 CVE-2017-15868 CVE-2017-16526 CVE-2017-16527 CVE-2017-16536 CVE-2017-16649 CVE-2018-1000199
Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-4088.
INSTALLING THE UPDATES
We recommend that all users of Ksplice Uptrack running UEKR2 2.6.39 on
OL5 and OL6 install these updates.
On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.
Alternatively, you can install these updates by running:
# /usr/sbin/uptrack-upgrade -y
* CVE-2017-0861: Use-after-free in ALSA sound subsystem.
A race condition when closing an ALSA device descriptor could cause a
use-after-free, potentially allowing an attacker to write to protected
memory and cause a privilege escalation.
* CVE-2017-15868: Privilege escalation in the Bluetooth stack when adding connections.
Multiple missing checks that a socket belongs to the L2CAP layer leads to
type confusion and kernel crash. A local user with the ability to create a
BNEP (Bluetooth Network Encapsulation Protocol), Human Interface Device
Protocol (HIDP) or a CAPI Message Transport Protocol (CMTP) connection
could use this flaw to escalate privileges.
* CVE-2017-16649: Divide by zero when binding a network USB device.
A logic error when binding a network USB device could lead to a divide
by zero error. A local attacker could use this flaw to cause a
* CVE-2017-16536: NULL pointer dereference when registering a Conexant cx231xx USB video device.
A missing check when probing a Conexant cx231xx USB video device could
lead to a NULL pointer dereference. A local attacker could use a crafted
USB device to cause a denial-of-service.
* Out-of-bounds access during parsing of Human Interface Device information.
A failure to validate information supplied by a USB device can result in
a out-of-bounds memory write, leading to undefined behaviour.
* CVE-2017-16526: Denial-of-service in failed launch of UWB daemon.
A failure to handle an error case when launching the UWB management
daemon can result in an invalid pointer dereference leading to a kernel
* CVE-2017-16527: Use-after-free when creating mixer for USB Audio device.
A missing free in error path when creating mixer for USB Audio device
could lead to a use-after-free. A local attacker could use a crafted USB
Audio device to cause a denial-of-service.
* System crash in Broadwell microcode updates.
A microcode bug in specific Broadwell microcode revisions could result
in a system crash and reboot when applying microcode updates. For these
revisions, only a BIOS based microcode update is supported.
* Missing Spectre V2 protections on AMD systems.
A difference in capability reporting between AMD and Intel based X86
systems could result in failure to apply IBRS protections on AMD
* Spectre v2 hardening on context switch.
Additional speculation barriers on context switch add protection for
sensitive processes to prevent leaking of sensitive data across
* CVE-2018-1000199: Denial-of-service in hardware breakpoints.
Incorrect validation of a ptrace hardware breakpoint could result in
corrupted kernel state. A local, unprivileged user could use this flaw
to crash the system or potentially, escalate privileges.
* Improved vulnerability reporting for Spectre v2.
Incorrect vulnerability reporting for Spectre v2 could report the system
as being vulnerable when it was actually protected.
* Connectivity loss with Xen virtualized network driver.
Incorrect handling of integer overflow could result in missing
notifications and network stalls after receiving a large number of
Ksplice support is available at ksplice-support_ww at oracle.com.
More information about the El-errata