[El-errata] New glibc updates available via Ksplice (ELSA-2022-0896)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2022-0896 can now be patched using Ksplice
CVEs: CVE-2021-3999 CVE-2022-23218 CVE-2022-23219

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2022-0896.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OL 8 install these updates.

You can install these updates by running:

# ksplice -y user upgrade

32-bit applications should be restarted after upgrading the on-disk
glibc RPMs and statically linked applications using
glibc should be rebuilt to include these fixes.

Ksplice user-space patching requires installation of Ksplice-aware
packages and the system must be rebooted after the first installation of
these packages.  Refer to the installation instructions for the Enhanced
Ksplice Client in the Ksplice User's Guide for more details.  Systems
may be prepared for Ksplice patching by installing the Ksplice aware
packages in advance, prior to installing the enhanced Ksplice client.

DESCRIPTION

* CVE-2021-3999: Memory corruption when retrieving current working directory.

Logic and arithmetic errors when retrieving the current working
directory can lead to a buffer underflow or overflow.  This flaw could
be exploited by a local attacker to execute arbitrary code and escalate
privileges.


* CVE-2022-23218, CVE-2022-23219: Buffer overflows in sunrpc service and client creation.

Missing length checks during both service and client creation for
sunrpc can lead to buffer overflows.  These flaws could be exploited by
a remote attacker to execute arbitrary code or cause a
denial-of-service.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.