[El-errata] New Ksplice updates for RHCK 9 (ELSA-2024-0461)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2024-0461 can now be patched using Ksplice
CVEs: CVE-2022-36402 CVE-2023-20569 CVE-2023-4623 CVE-2023-52562 CVE-2023-5633 CVE-2023-6679

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2024-0461.
More information about this errata can be found at
https://linux.oracle.com/errata/ELSA-2024-0461.html

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running RHCK 9 install
these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2023-52562: Memory corruption after slab cache deletion.

A double-free exists in the kernel memory cache slab manager, that could
result in a in a corruption of the global list of slab caches. A
malicious user with the ability to remove kernel modules could exploit
this to cause a a denial-of-service or potentially overwrite kernel
memory.


* CVE-2022-36402: Denial-of-service in VMware Linux graphics driver.

A lack of user input validation in VMware Linux graphics driver can
lead to an integer overflow flaw. A local attacker can use this flaw
to cause denial-of-service or escalate their privileges.


* Note: Oracle will not provide a zero-downtime update for CVE-2023-5633.

Oracle has determined that patching CVE-2023-5633 at runtime would not
be safe and recommends disabling 3D acceleration on virtualized systems,
or preventing the 'vmwgfx' kernel module from loading.


* Note: Oracle will not provide a zero-downtime update for CVE-2023-20569.

Oracle has determined that patching CVE-2023-20569 on a running system
would not be safe and recommends a reboot.


* Note: Oracle has determined that CVE-2023-4623 is not applicable.

A flaw in net/sched: sch_hfsc component may lead to a use-after-free. A
local user could use this flaw for privilege escalation.

The kernel is not affected by CVE-2023-4623 since the code under
consideration is not compiled.


* Note: Oracle has determined that CVE-2023-6679 is not applicable.

A missing check in Digital Phase Locked Loop (DPLL) subsystem
can lead to a null-pointer dereference error. A local attacker
could use this flaw to cause denial-of-service.

The kernel is not affected by CVE-2023-6679 since the code under
consideration is not vulnerable.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.