[Ksplice-Fedora-30-updates] New Ksplice updates for Fedora 30 (FEDORA-2019-1689d3fe07)

[Allan Xavier]

Synopsis: FEDORA-2019-1689d3fe07 can now be patched using Ksplice
CVEs: CVE-2014-9900 CVE-2018-12207 CVE-2019-0154 CVE-2019-0155 CVE-2019-11135
CVE-2019-18813 CVE-2019-19044 CVE-2019-19045 CVE-2019-19047 CVE-2019-19051
CVE-2019-19052 CVE-2019-19529 CVE-2019-19534 CVE-2019-19807

Systems running Fedora 30 can now use Ksplice to patch against the
latest Fedora kernel update, FEDORA-2019-1689d3fe07.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Fedora 30
install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2019-11135: Side-channel information leak in Intel TSX.

A side-channel information leak on some generations of Intel processors
could allow the leaking of internal microarchitectural buffers during
asynchronous aborts in a TSX transaction.  For CPUs that are vulnerable
to Microarchitectural Data Sampling, existing mitigations cover
CVE-2019-11135, for newer CPUs with hardware fixes for MDS, TSX is
transparently disabled.  On these newer CPUs, TSX functionality can be
restored by writing 0 to /sys/kernel/debug/x86/tsx_force_abort.


* CVE-2018-12207: Machine Check Exception on page size change.

A hardware bug in Intel x86 processors can result in a Machine Check Exception
when a page table mapping for currently executing instructions is changed. A
privileged user in a guest VM could use this flaw to crash the host, leading to
a denial-of-service.


* CVE-2019-0155: Privilege escalation in Intel i915 graphics driver.

Missing validation of MMIO commands to the Intel i915 device driver could
result in illicit page table modifications. An attacker could use this to
access sensitive information or elevate privileges.


* CVE-2019-0154: Denial-of-service in Intel i915 graphics driver.

Due to a hardware error, the Intel i915 device state could get corrupted.
A malicious user could use this to cause denial-of-service.


* CVE-2014-9900: Information disclosure in Wake-On-LAN driver.

Due to a failure to correctly clear memory, sensitive kernel information
can be disclosed to userspace when information about Wake-On-LAN support
is requested. A local attacker could use this flaw to facilitate a
further attack on the kernel.


* CVE-2019-19807: Use-after-free when registering timer in ALSA driver.

A logic error when registering timer in ALSA driver fails could lead to
a use-after-free. A local attacker could use this flaw to cause a
denial-of-service.


* CVE-2019-19052: Memory leak when opening USB Socket CAN device driver.

A missing free of resources when opening USB Socket CAN device driver
fails could lead to a memory leak. A local attacker could use this flaw
to exhaust kernel memory and cause a denial-of-service.


* CVE-2019-19529: Use-after-free when disconnecting Microchip CAN BUS Analyzer
device.

A logic error when disconnecting Microchip CAN BUS Analyzer device could
lead to a use-after-free. A local attacker could use this flaw to cause
a denial-of-service.


* CVE-2019-19534: Information leak using PEAK PCAN-USB/USB Pro interfaces for
CAN 2.0b/CAN-FD.

A missing zeroing of heap buffer passed to user space in PEAK
PCAN-USB/USB Pro interfaces for CAN 2.0b/CAN-FD driver could lead to an
information leak. A local attacker could use this flaw to leak
information about running kernel and facilitate an attack.


* CVE-2019-19045: Memory leak when creating CQ in Mellanox Technologies Innova
driver.

A missing free of resources when creating CQ in Mellanox Technologies
Innova driver fails could lead to a memory leak. A local attacker could
use this flaw to exhaust kernel memory and cause a denial-of-service.


* CVE-2019-19047: Memory leak in Mellanox 5th generation network adapters core
driver.

A missing free of resources in Mellanox 5th generation network adapters
core driver could lead to a memory leak. A local attacker could use this
flaw to exhaust kernel memory and cause a denial-of-service.


* CVE-2019-18813: Memory leak when registering USB DWC3 driver fails.

A missing free of resources in error path when registering USB dwc3
driver fails could lead to a memory leak. A local attacker could use
this flaw to leak information about running kernel and facilitate an
attack.


* CVE-2019-19051: Memory leak when changing power status of Intel Wireless WiMAX
Connection 2400 driver.

A missing free of resources when changing power status of Intel Wireless
WiMAX Connection 2400 driver could lead to a memory leak. A local
attacker could use this flaw to leak information about running kernel
and facilitate an attack.


* Kernel crash in OCFS2 direct IO cluster allocation.

Missing locking when allocating clusters during a direct IO operation
could result in triggering a kernel assertion and subsequent crash.


* Missing MDS and Spectre v2 mitigations on EIBRS supported CPUs.

On systems that support Enhanced IBRS (EIBRS), the mitigations could be
incorrectly set when toggling the symmetric multithreading (SMT) feature
at runtime.


* CVE-2019-19044: Memory leak in Broadcom V3D driver.

A user-triggerable memory leak in the Broadcom V3D driver's ioctl submit
path can cause a system to waste memory, which will degrade performance,
and could potentially lead to a denial-of-service.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.