[El-errata] New Ksplice updates for UEKR2 2.6.39 on OL5 and OL6 (ELSA-2018-4214)
Errata Announcements for Oracle Linux
el-errata at oss.oracle.com
Mon Oct 1 04:42:44 PDT 2018
Synopsis: ELSA-2018-4214 can now be patched using Ksplice
CVEs: CVE-2017-18344 CVE-2018-10675 CVE-2018-3620 CVE-2018-3646
Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-4214.
INSTALLING THE UPDATES
We recommend that all users of Ksplice Uptrack running UEKR2 2.6.39 on
OL5 and OL6 install these updates.
On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.
Alternatively, you can install these updates by running:
# /usr/sbin/uptrack-upgrade -y
ELSA-2018-4214 contains a fix for CVE-2018-3620, CVE-2018-3646 for 32 bits PAE
and Oracle Linux 5 versions that Ksplice will not patch. Users that require the
additional patching of this vulnerability are recommended to reboot into
oracle-uek2 2.6.39-400.301.1 or later.
* CVE-2017-18344: Information disclosure in POSIX timers.
Incorrect validation of POSIX timers could allow a local, unprivileged
user to leak the contents of arbitrary memory through /proc/$PID/timers.
* CVE-2018-10675: Use-after-free in get_mempolicy due to incorrect reference counting.
A reference count error in the get_mempolicy ioctl implementation can
result in a use-after-free. A local user could use this flaw to
* CVE-2018-3620, CVE-2018-3646: Information leak in Intel CPUs under terminal fault.
A flaw in terminal fault handling on Intel CPUs could result in
information leaks across privilege boundaries including between
processes on a system or between virtual machines.
Ksplice support is available at ksplice-support_ww at oracle.com.
More information about the El-errata