[El-errata] New Ksplice updates for UEKR5 4.14.35 on OL7 (ELSA-2019-4708)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2019-4708 can now be patched using Ksplice
CVEs: CVE-2017-7308 CVE-2018-14634 CVE-2019-6133

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2019-4708.
More information about this errata can be found at
https://linux.oracle.com/errata/ELSA-2019-4708.html

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR5 4.14.35
on OL7 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2019-6133: Permission bypass of userspace Policykit protection.

When a non-root user try to control a systemd unit, the Policykit asks
for an administrator password. Once entered, polkit caches this password
up to five minutes for corresponding process based on PID and start_time
of the process. A race condition in the fork syscall could let an
attacker spawn a process with same start_time and same PID as targeted
process and thus control a systemd unit.

Orabug: 29850579


* NULL pointer dereference in RDS connect completion.

Missing NULL pointer checks could result in a kernel crash when
completing an Infiniband RDS connection completion.

Orabug: 29924845


* Use-after-free in RDS TCP connection shutdown.

Incorrect locking could result in a use-after-free and kernel crash when
shutting down an RDS TCP socket.

Orabug: 29814108

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.