[El-errata] New Ksplice updates for UEKR7 5.15.0 on OL8 and OL9 (5.15.0-5.76.5.1)

Thu Feb 23 22:31:32 UTC 2023

Synopsis: 5.15.0-5.76.5.1 can now be patched using Ksplice CVEs:
CVE-2016-5195 CVE-2017-1000253 CVE-2017-11176 CVE-2019-9213 CVE-2021-22543
CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 CVE-2021-4154 CVE-2022-0185
CVE-2022-0847 CVE-2022-1184 CVE-2022-2308 CVE-2022-2588 CVE-2022-2602
CVE-2022-2663 CVE-2022-27666 CVE-2022-2978 CVE-2022-3524 CVE-2022-3542
CVE-2022-3543 CVE-2022-3564 CVE-2022-3565 CVE-2022-3594 CVE-2022-3619
CVE-2022-3621 CVE-2022-3623 CVE-2022-3628 CVE-2022-3640 CVE-2022-3646
CVE-2022-3649 CVE-2022-40768 CVE-2022-41674 CVE-2022-41850 CVE-2022-42719
CVE-2022-42720 CVE-2022-42721 CVE-2022-42722 CVE-2022-42895 CVE-2022-42896
CVE-2022-43750 CVE-2022-4378 CVE-2022-43945

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle kernel update, 5.15.0-5.76.5.1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR7 5.15.0 on
OL8 and OL9 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y

DESCRIPTION

* Denial-of-service when checking if an address is a jump label.

The jump label sub-system has an assertion that can be triggered while
installing Ksplice updates.

* CVE-2022-4378: Privilege escalation in the proc filesystem.

Incorrect bounds checking and an integer overflow in the proc
filesystem could lead to out-of-bounds memory writes.  An unprivileged
user could use this flaw to cause a denial-of-service or elevate
privileges.

* CVE-2022-41850: Use-after-free in Roccat support driver.

A race condition in Roccat support driver may lead to a
read-after-free. A local user could use this flaw to gain
sensitive information as a part of another type of attack.

* CVE-2022-42722: Denial of service in beacon protection for P2P-device.

A missing check in mac80211 subsystem can lead to a null pointer
dereference error. A local attacker able to inject WLAN frames could
use this flaw to cause denial of service.

* CVE-2022-41674: Privilege escalation in cfg80211 subsystem.

An incorrect input validation in cfg80211 subsystem can lead to a
buffer overflow error. A local attacker able to inject WLAN frames
could use this flaw to escalate privileges.

* CVE-2022-43750: Use-after-free in USB monitor.

Incorrect permission flags set on userspace memory mappings in usbmon
could lead to a use-after-free. A local attacker could use this flaw for
a denial-of-service or escalate privileges.

* CVE-2022-3565: Use-after-free in modular ISDN driver.

A race condition in mISDN when l1oip_cleanup is called while a timer
handler is running may lead to a use-after-free. A local user could use
this flaw for a denial-of-service or privilege escalation.

* Note: Oracle has determined that CVE-2022-3649 is not applicable.

A missing sanity check in nilfs2 when handling corrupted on-disk
filesystem data could lead to a use-after-free. An attacker could use
this flaw to cause a denial-of-service or escalate privileges.

The kernel is not affected by CVE-2022-3649 since the code under
consideration is not compiled.

* Unexpected return codes from recvmsg() for RDS sockets.

A logic error in the RDS messaging implementation can cause unexpected
errors to be thrown by recvmsg().  This can disrupt the operation of
userspace applications in some cases.

Orabug: 34658657

* Note: Oracle has determined that CVE-2022-3621 is not applicable.

A missing sanity check in nilfs2 when handling corrupted on-disk
filesystem data could lead to a NULL pointer dereference. A local user
could use this flaw for a denial-of-service.

The kernel is not affected by CVE-2022-3621 since the code under
consideration is not compiled.

* CVE-2022-2978: Denial-of-service when initializing inodes.

A logic error when initializing inodes could lead to an invalid memory
access. A local attacker could use this flaw to cause a denial-of-
service.

* Note: Oracle has determined that CVE-2022-3646 is not applicable.

A flaw in NILFS2 when failing to create a log write thread could lead to
a memory leak. A local attacker could use this flaw to exhaust system
memory and cause a denial-of-service.

The kernel is not affected by CVE-2022-3646 since the code under
consideration is not compiled.

* CVE-2022-42721: Denial of service in cfg80211 subsystem.

A missing check in cfg80211 subsystem can lead to internal data
structures corruption of the kernel. A local attacker able to inject
WLAN frames could use this flaw to cause denial of service.

* CVE-2022-2308: Information disclosure in Virtio Data Path Acceleration.

Improperly initialized memory in vDPA when a vDPA Device in Userspace
(VDUSE) application requests configuration data from the driver may lead
to leaking kernel stack memory. This could cause undefined behavior or
data leaks in Virtio drivers.

* CVE-2022-3594: Denial-of-service in r8152 USB network driver.

Improper management of logging in the r8152 driver when handling
interrupts can lead to logging of excessive data. A remote attacker
could use this flaw to flood the system logs and hinder the ability to
detect anomalous conditions.

* CVE-2022-40768: Information leak in Promise SuperTrak EX driver.

A missing zeroing of on-stack memory passed to userspace in a SCSI driver
could lead to an information leak. A local attacker could use this flaw
to leak information about running kernel and facilitate an attack.

* CVE-2022-42720: Privilege escalation in cfg80211 subsystem.

Improper reference counting in cfg80211 subsystem can lead to a use
after free error. A local attacker able to inject WLAN frames
could use this flaw to escalate privileges.

* Updated fix to CVE-2022-1184: Use-after-free when handling corrupted hash tree in ext4.

A logic error when handling corrupted hash tree directory in ext4
filesystems could lead to a use-after-free. A local attacker could use
this flaw and a malicious ext4 image to cause a denial-of-service.

* Note: Oracle has determined that CVE-2022-3542 is not applicable.

The kernel is not affected by CVE-2022-3542 since the code under
consideration is not compiled.

* CVE-2022-2663: Firewall bypass in IRC connection tracking

An issue in nf_conntrack_irc in unencrypted IRC protocol message
handling could result in messages being incorrectly matched by the
firewall. A remote user could use this flaw to bypass local firewall
rules.

* CVE-2022-2602: Privilege escalation in io_uring.

A race between handling an io_uring request and the Unix socket garbage
collector can lead to a use after free vulnerability. A local attacker
could use this flaw to escalate privileges.

* CVE-2022-42719: Privilege escalation in mac80211 subsystem.

An improper resources management in mac80211 subsystem can lead to
a use after free error. A local attacker able to inject WLAN frames
could use this flaw to cause denial of service or escalate privileges.

* CVE-2022-43945: Out-of-bounds memory access in NFSD.

A logic error in NFSD when a small RPC Call message arrives in an
oversized RPC record can lead to a buffer overflow. A remote attacker
could use this flaw for a denial-of-service or privilege escalation.

* Information leak in Transparent Inter Process Communication (TIPC) protocol.

A logic error in TIPC protocol during socket initialization can lead to
kernel information leak. A local user could use this flaw to gain access
to sensitive information.

* CVE-2022-3564: Use-after-free in Bluetooth L2CAP.

A race condition in Bluetooth L2CAP when a socket buffer is queued and
dequeued by two flows running in parallel can lead to a use-after-free.
A remote attacker could use this flaw for a denial-of-service or
for privilege escalation.

* CVE-2022-3524: Memory-leak in IPv6 networking.

A race condition in IPv6 networking when converting an IPv6 socket into
IPv4 could lead to a memory-leak. A local user could use this flaw to
exhaust the system's memory and cause denial-of-service.

* CVE-2022-42896: Use-after-free in Bluetooth L2CAP.

A flaw in Bluetooth L2CAP protocol when accepting incoming connection
requests could lead to a use-after-free. A remote attacker could use
this flaw for a denial-of-service or for privilege escalation.

* CVE-2022-42895: Information disclosure in Bluetooth subsystem.

A missing sanity check when parsing a configuration request in Bluetooth
L2CAP implementation could result in out-of-bounds memory access.
A physically proximate attacker could use this flaw for information
disclosure.

* CVE-2022-3640: Use-after-free in Bluetooth subsystem.

A logic flaw in receive data path of the Bluetooth subsystem could
result in a use-after-free. A local user could use this flaw to cause
a denial-of-service or execute arbitrary code.

* CVE-2022-3628: Code execution in Broadcom FullMAC USB WiFi driver.

A missing sanity check when setting up the Broadcom FullMAC USB WiFi
driver could result in out-of-bounds access. A physically proximate
user could use this flaw to craft a malicious USB device and cause
a denial-of-service or execute arbitrary code.

* CVE-2022-3623: Information disclosure in hugetlb.

A race condition in hugetlb when multiple threads are looking up
CONT-PTE/PMD pages could lead to page table inconsistencies. A local
attacker could use this to cause a denial-of-service or expose sensitive
information.

* CVE-2022-3543: Denial-of-service in Unix domain sockets.

Improperly released resources in the AF_UNIX sockets when closing
sockets with unconsumed out-of-band buffers could lead to a memory leak.
A local user could use this flaw to exhaust kernel memory and cause de
denial-of-service.

* CVE-2022-3619: Denial-of-Service in Bluetooth L2CAP.

Improperly released resources in Bluetooth L2CAP when handling
fragmented frames could result in a memory leak. A remote user could
use this flaw to exhaust the kernel memory and cause a
denial-of-service.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.