[Ksplice-Fedora-26-updates] New Ksplice updates for Fedora 26 (FEDORA-2018-709268aa8a)

Oracle Ksplice ksplice-support_ww at oracle.com
Mon Apr 16 13:50:29 PDT 2018


Synopsis: FEDORA-2018-709268aa8a can now be patched using Ksplice

Systems running Fedora 26 can now use Ksplice to patch against the
latest Fedora kernel update, FEDORA-2018-709268aa8a.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Fedora 26
install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* Denial-of-service in traffic control tunnel encapsulation or decapsulation.

A failure to properly deal with a missing set/unset mode when calling tc
actions on tunnel_key could lead to a invalid pointer dereference and kernel
panic.  This could be used to cause a denial-of-service.


* NULL pointer dereference in 802.15.4 IPv6 personal area network device events.

A failure to verify the device type in the 802.15.4 lowpan code could lead
to a NULL pointer dereference.  This could be exploited for a
denial-of-service attack.


* Denial-of-service in IPv4 inet fragment eviction.

A race condition in the IPv4 inet fragment code could lead to memory
corruption and possible kernel panic.  This could be used to cause a
denial-of-service.


* Denial-of-service in DCCP message send.

A logic error in the dccp code could lead to a NULL pointer dereference
when transmitting messages, leading to a kernel panic.  An attacker could
use this to cause a denial-of-service.


* Denial-of-service in layer 2 tunnel protocol tunnel creation.

A failure to verify socket type in the l2tp code could lead to an invalid
memory access and possible kernel panic.  This could be exploited to cause a
denial-of-service.


* Double free in generic netlink multicast.

A logic error in the generic netlink message multicast code could lead to a
double free and possible memory corruption or kernel panic.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.





More information about the Ksplice-Fedora-26-Updates mailing list