[El-errata] New Ksplice updates for UEKR7 5.15.0 on OL8 and OL9 (ELSA-2024-12796)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2024-12796 can now be patched using Ksplice
CVEs: CVE-2024-26681 CVE-2024-27397 CVE-2024-35959 CVE-2024-40940 CVE-2024-42269 CVE-2024-42270 CVE-2024-45017 CVE-2024-46738 CVE-2024-47674

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2024-12796.
More information about this errata can be found at
https://linux.oracle.com/errata/ELSA-2024-12796.html

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR7 5.15.0 on
OL8 and OL9 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2024-26681: Denial-of-service in Simulated networking device driver.

A race condition when scheduling delayed work in the Simulated
networking device driver could lead to a deadlock. A local attacker
could use this flaw to cause a denial-of-service.

Orabug: 36530387


* CVE-2024-27397: Privilege escalation in netfilter subsystem.

A logic error when using the netfilter subsystem could lead to a use-
after-free. A local attacker could use this flaw to escalate privileges.

Orabug: 36630431


* CVE-2024-35959: Denial-of-service in Mellanox devices driver.

A locking error when using the Mellanox devices driver could lead to a
deadlock. A local attacker could use this flaw to cause a
denial-of-service.

Orabug: 36643379


* CVE-2024-40940: Memory corruption in Mellanox devices driver.

A logic error when using the Mellanox devices driver could lead to a
use-after-free. A local attacker could use this flaw to cause memory
corruption.

Orabug: 36835804


* CVE-2024-42269: Denial-of-service in ip6tables NAT driver.

A race condition when initializing the ip6tables NAT driver could lead
to a NULL pointer dereference. A local attacker could use this flaw to
cause a denial-of-service.

Orabug: 36964001


* CVE-2024-42270: Denial-of-service in iptables NAT driver.

A race condition when initializing the iptables NAT driver could lead to
a NULL pointer dereference. A local attacker could use this flaw to
cause a denial-of-service.

Orabug: 36964003


* CVE-2024-45017: Denial-of-service in Mellanox devices driver.

A logic error when IPsec creation over a slave device in the Mellanox
devices driver could lead to a deadlock. A local attacker could use this
flaw to cause a denial-of-service.

Orabug: 37000459


* CVE-2024-46738: Privilege escalation in VMware VMCI.

A missing check when removing a resource in the VMware VMCI driver could
lead to a use-after-free. A local attacker could use this flaw to gain
root privileges.

Orabug: 37037203


* CVE-2024-47674: Privilege escalation in MMU-based Paged Memory Management driver.

A logic error in the MMU-based Paged Memory Management driver could lead
to use of uninitialized memory. A local attacker could use this flaw to
escalate privileges.

Orabug: 37174198


* Note: Oracle has determined some CVEs are not applicable.

The kernel is not affected by the following CVEs
since the code under consideration is not compiled.

CVE-2024-36477

Orabug: 36670372

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.