[El-errata] New Ksplice updates for UEKR3 3.8.13 on OL6 and OL7 (ELSA-2018-4089)
Errata Announcements for Oracle Linux
el-errata at oss.oracle.com
Thu May 3 08:10:32 PDT 2018
Synopsis: ELSA-2018-4089 can now be patched using Ksplice
CVEs: CVE-2017-0861 CVE-2017-14140 CVE-2017-15115 CVE-2017-15868 CVE-2017-16527 CVE-2017-16533 CVE-2017-16536 CVE-2017-16649 CVE-2018-1000199
Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-4089.
INSTALLING THE UPDATES
We recommend that all users of Ksplice Uptrack running UEKR3 3.8.13 on
OL6 and OL7 install these updates.
On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.
Alternatively, you can install these updates by running:
# /usr/sbin/uptrack-upgrade -y
* CVE-2017-15115: Use-after-free in SCTP peel off operation inside network namespace.
A logic error when performing an SCTP peel off operation from a network
namespace can result in an incorrect free, leading to a subsequent
use-after-free. A local user could use this flaw to cause a
denial-of-service, or potentially escalate privileges.
* CVE-2017-14140: Permission bypass when checking credentials for filesystem accesses.
A flaw in the ptrace access checks allows a temporarily unprivileged
process to access files that it was not supposed to. A local, unprivileged
user could potentially use this flaw to escalate privileges.
* CVE-2017-0861: Use-after-free in ALSA sound subsystem.
A race condition when closing an ALSA device descriptor could cause a
use-after-free, potentially allowing an attacker to write to protected
memory and cause a privilege escalation.
* CVE-2017-15868: Privilege escalation in the Bluetooth stack when adding connections.
Multiple missing checks that a socket belongs to the L2CAP layer leads to
type confusion and kernel crash. A local user with the ability to create a
BNEP (Bluetooth Network Encapsulation Protocol), Human Interface Device
Protocol (HIDP) or a CAPI Message Transport Protocol (CMTP) connection
could use this flaw to escalate privileges.
* System crash in Broadwell microcode updates.
A microcode bug in specific Broadwell microcode revisions could result
in a system crash and reboot when applying microcode updates. For these
revisions, only a BIOS based microcode update is supported.
* CVE-2017-16649: Divide by zero when binding a network USB device.
A logic error when binding a network USB device could lead to a divide
by zero error. A local attacker could use this flaw to cause a
* CVE-2017-16536: NULL pointer dereference when registering a Conexant cx231xx USB video device.
A missing check when probing a Conexant cx231xx USB video device could
lead to a NULL pointer dereference. A local attacker could use a crafted
USB device to cause a denial-of-service.
* CVE-2017-16533: Out-of-bounds access during parsing of Human Interface Device information.
A failure to validate information supplied by a USB device can result in
a out-of-bounds memory write, leading to undefined behaviour.
* CVE-2017-16527: Use-after-free when creating mixer for USB Audio device.
A missing free in error path when creating mixer for USB Audio device
could lead to a use-after-free. A local attacker could use a crafted USB
Audio device to cause a denial-of-service.
* Microsoft Hyper-V utils driver crashes on unload when fcopy daemon is running.
Improper reference counting of access to the hv_utils module can
lead to the module being unloaded while in use causing a crash.
* Spectre v2 hardening on context switch.
Additional speculation barriers on context switch add protection for
sensitive processes to prevent leaking of sensitive data across
* CVE-2018-1000199: Denial-of-service in hardware breakpoints.
Incorrect validation of a ptrace hardware breakpoint could result in
corrupted kernel state. A local, unprivileged user could use this flaw
to crash the system or potentially, escalate privileges.
* Improved CPU feature detection on microcode updates.
Incorrect handling of new CPU features introduced with a microcode
update could fail to be detected by the system or propagated to guest
* Incorrect Spectre V1 reporting.
Incorrect Spectre V1 reporting could falsely lead the system to report
as being vulnerable whilst actually being mitigated by lfence
Ksplice support is available at ksplice-support_ww at oracle.com.
More information about the El-errata