[El-errata] New Ksplice updates for UEKR2 2.6.39 on OL5 and OL6 (ELSA-2019-4855)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2019-4855 can now be patched using Ksplice
CVEs: CVE-2017-14991 CVE-2017-15102 CVE-2017-18509 CVE-2017-18551 CVE-2018-20169 CVE-2019-14284

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2019-4855.
More information about this errata can be found at
https://linux.oracle.com/errata/ELSA-2019-4855.html

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR2 2.6.39 on
OL5 and OL6 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2018-20169: Missing bound check when reading extra USB descriptors.

A failure to properly check the minimum and maximum size of an extra USB
descriptor in the USB sub-system could lead to reading or writing past
memory bounds.  An attacker with the ability to send specially crafted
extra descriptors from a USB device could use this flaw to escalate
privileges or cause a denial-of-service.

Orabug: 30057430


* CVE-2017-18551: Out-of-bounds access when reading data over I2C bus.

A missing check on user input when reading data over I2C bus could lead
to an out-of-bounds access. A local attacker could use this flaw to
cause a denial-of-service.

Orabug: 30468843


* CVE-2019-14284: Denial-of-service in floppy disk formatting.

A division by zero in the setup_format_params function for the floppy
disk driver could result in a kernel crash.  A local user with access to
the floppy disk device could use this flaw to crash the system.

Orabug: 30447845


* CVE-2017-15102: NULL pointer dereference when probing Lego Mindstorms infrared device.

A race condition when probing Lego Mindstorms infrared device can trigger
a NULL pointer dereference and cause a local denial of service.

Orabug: 30412152


* CVE-2017-14991: Information leak in SCSI Generic Support driver.

Failing to initialize buffer when performing ioctl call for /dev/sg0
results in stale kernel data leaked into userspace. This allows local
users to obtain sensitive information about kernel heap memory.

Orabug: 30393903


* CVE-2017-18509: Memory corruption in IPv6 via setting socket options.

A missing check in the IPv6 ip6mr code could allow a privileged attacker
to control a pointer in kernel land, potentially causing a general
protection fault or being able to execute arbitrary code.

Orabug: 30183226

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.