[Ksplice-Fedora-26-updates] New Ksplice updates for Fedora 26 (FEDORA-2018-4c99c98ee1)

Oracle Ksplice ksplice-support_ww at oracle.com
Tue Apr 17 07:32:26 PDT 2018


Synopsis: FEDORA-2018-4c99c98ee1 can now be patched using Ksplice

Systems running Fedora 26 can now use Ksplice to patch against the
latest Fedora kernel update, FEDORA-2018-4c99c98ee1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Fedora 26
install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* NULL pointer dereferences when using RDMA Userspace Connection Manager Access driver.

Missing checks on user inputs or device state when using RDMA Userspace
Connection Manager Access driver could lead to NULL pointer dereferences.
A local attacker could use this flaw to cause a denial-of-service.


* Use-after-free when using RDMA Userspace Connection Manager Access driver.

Logic errors when processing requests or when creating device ids in
RDMA Userspace Connection Manager Access driver could lead to multiple
use-after-free. A local attacker could use this flaw to cause a
denial-of-service.


* Out-of-bounds access when using RDMA Userspace Connection Manager Access driver.

A missing check on user input could lead to an out-of-bounds access when
using RDMA Userspace Connection Manager Access driver. A local attacker
could use this flaw to cause a denial-of-service.


* Deadlock while running garbage collector on IPV6 routes.

A locking error when running garbage collector and computing ages of
IPV6 elements could lead to a deadlock. A local attacker could use this
flaw to cause a denial-of-service.


* Denial-of-service when initializing IP Payload Compression Protocol.

A logic error when initializing IP Payload Compression Protocol could
lead to a kernel assert. A local attacker could use this flaw to cause a
denial-of-service.


* Denial-of-service when allocating Netfilter Xtables.

An error in a flag passed to the kernel allocator when allocating
Netfilter Xtables could allow an attacker to exhaust kernel memory and
cause a denial-of-service.


* Out-of-bounds access when using EBT among filters.

A missing check on user input when using EBT among filters could lead to
a out-of-bounds access. A local attacker could use this flaw to cause a
denial-of-service.


* Use-after-free when creating l2tp tunnel with IPV4-mapped IPV6 addresses.

A logic error when creating l2tp tunnel with IPV4-mapped IPV6 addresses
could lead to a use-after-free if the socket is provided by user-space.
A local attacker could use this flaw to cause a denial-of-service.


* Denial-of-service when using IPV4 connection tracking.

A missing drop of connection tracker template when a connection tracker
is skipped could lead to a kernel panic. A local attacker could use this
flaw to cause a denial-of-service.


* Double-free when registering USBTV007 video driver.

A logic error in error path when registering USBTV007 video driver could
lead to a double-free. A local attacker could use this flaw to cause a
denial-of-service.


* Information leak when releasing memory in LRW crypto driver.

A missing zeroing of sensitive data used to encrypt / decrypt
information could lead to an information leak in LRW crypto driver. A
local attacker could use this flaw to decrypt sensitive information.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.





More information about the Ksplice-Fedora-26-Updates mailing list