[El-errata] New Ksplice updates for UEKR4 4.1.12 on OL6 and OL7 (ELBA-2024-12467)

[Errata Announcements for Oracle Linux]

Synopsis: ELBA-2024-12467 can now be patched using Ksplice
CVEs: CVE-2023-0590 CVE-2023-1206 CVE-2023-4623 CVE-2023-6932

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Bug Fix Advisory, ELBA-2024-12467.
More information about this errata can be found at
https://linux.oracle.com/errata/ELBA-2024-12467.html

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR4 4.1.12 on
OL6 and OL7 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2023-0590: Use-after-free in network scheduler.

A race condition in net scheduler when dropping the reference of a queue
discipline object in qdisc_graft() may lead to a use-after-free. A local
user could use this flaw to cause a denial-of-service.

Orabug: 35250827


* CVE-2023-4623: Use-after-free in in the Traffic Control subsystem.

A flaw in net/sched: sch_hfsc component may lead to a use-after-free. A
local user could use this flaw for privilege escalation.

Orabug: 35810544


* CVE-2023-6932: Use-after-free in IGMP networking stack.

A use-after-free error was found in the IGMP networking stack when
receiving query message if the device is down. A local attacker can
exploit this to cause a denial-of-service or privilege escalation.

Orabug: 36654101


* Note: Oracle will not provide a zero-downtime update for CVE-2023-1206.

Oracle has determined that patching CVE-2023-1206 on a running system
would not be safe and recommends a reboot.

Orabug: 35754477

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.