[El-errata] New Ksplice updates for UEKR3 3.8.13 on OL6 and OL7 (ELSA-2018-4089)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2018-4089 can now be patched using Ksplice
CVEs: CVE-2017-0861 CVE-2017-14140 CVE-2017-15115 CVE-2017-15868 CVE-2017-16527 CVE-2017-16533 CVE-2017-16536 CVE-2017-16649 CVE-2018-1000199

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-4089.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR3 3.8.13 on
OL6 and OL7 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2017-15115: Use-after-free in SCTP peel off operation inside network namespace.

A logic error when performing an SCTP peel off operation from a network
namespace can result in an incorrect free, leading to a subsequent
use-after-free. A local user could use this flaw to cause a
denial-of-service, or potentially escalate privileges.

Orabug: 27387001


* CVE-2017-14140: Permission bypass when checking credentials for filesystem accesses.

A flaw in the ptrace access checks allows a temporarily unprivileged
process to access files that it was not supposed to.  A local, unprivileged
user could potentially use this flaw to escalate privileges.

Orabug: 27364691


* CVE-2017-0861: Use-after-free in ALSA sound subsystem.

A race condition when closing an ALSA device descriptor could cause a
use-after-free, potentially allowing an attacker to write to protected
memory and cause a privilege escalation.

Orabug: 27344843


* CVE-2017-15868: Privilege escalation in the Bluetooth stack when adding connections.

Multiple missing checks that a socket belongs to the L2CAP layer leads to
type confusion and kernel crash.  A local user with the ability to create a
BNEP (Bluetooth Network Encapsulation Protocol), Human Interface Device
Protocol (HIDP) or a CAPI Message Transport Protocol (CMTP) connection
could use this flaw to escalate privileges.

Orabug: 27344793


* System crash in Broadwell microcode updates.

A microcode bug in specific Broadwell microcode revisions could result
in a system crash and reboot when applying microcode updates.  For these
revisions, only a BIOS based microcode update is supported.

Orabug: 27343577


* CVE-2017-16649: Divide by zero when binding a network USB device.

A logic error when binding a network USB device could lead to a divide
by zero error. A local attacker could use this flaw to cause a
denial-of-service.

Orabug: 27215201


* CVE-2017-16536: NULL pointer dereference when registering a Conexant cx231xx USB video device.

A missing check when probing a Conexant cx231xx USB video device could
lead to a NULL pointer dereference. A local attacker could use a crafted
USB device to cause a denial-of-service.

Orabug: 27208072


* CVE-2017-16533: Out-of-bounds access during parsing of Human Interface Device information.

A failure to validate information supplied by a USB device can result in
a out-of-bounds memory write, leading to undefined behaviour.

Orabug: 27207929


* CVE-2017-16527: Use-after-free when creating mixer for USB Audio device.

A missing free in error path when creating mixer for USB Audio device
could lead to a use-after-free. A local attacker could use a crafted USB
Audio device to cause a denial-of-service.

Orabug: 27148281


* Microsoft Hyper-V utils driver crashes on unload when fcopy daemon is running.

Improper reference counting of access to the hv_utils module can
lead to the module being unloaded while in use causing a crash.

Orabug: 21191022


* Spectre v2 hardening on context switch.

Additional speculation barriers on context switch add protection for
sensitive processes to prevent leaking of sensitive data across
privilege boundaries.

Orabug: 27516379


* CVE-2018-1000199: Denial-of-service in hardware breakpoints.

Incorrect validation of a ptrace hardware breakpoint could result in
corrupted kernel state.  A local, unprivileged user could use this flaw
to crash the system or potentially, escalate privileges.

Orabug: 27947608


* Improved CPU feature detection on microcode updates.

Incorrect handling of new CPU features introduced with a microcode
update could fail to be detected by the system or propagated to guest
VMs.

Orabug: 27806667


* Incorrect Spectre V1 reporting.

Incorrect Spectre V1 reporting could falsely lead the system to report
as being vulnerable whilst actually being mitigated by lfence
instructions.

Orabug: 27509932

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.