[Ksplice][Ubuntu-11.04-Updates] New updates available via Ksplice (USN-1193-1)

[Anders Kaseorg]

Synopsis: USN-1193-1 can now be patched using Ksplice
CVEs: CVE-2011-1017 CVE-2011-1577 CVE-2011-1581 CVE-2011-2484 CVE-2011-2493

Systems running Ubuntu 11.04 Natty can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-1193-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack on Ubuntu 11.04 Natty
install these updates.  You can install these updates by running:

# /usr/sbin/uptrack-upgrade -y

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any additional action.


DESCRIPTION

* CVE-2011-1581: Denial of service in Ethernet bonding driver.

The bond_select_queue function in drivers/net/bonding/bond_main.c, when
a network device with a large number of receive queues is installed but
the default tx_queues setting is used, does not properly restrict queue
indexes, which allows remote attackers to cause a denial of service (BUG
and system crash) or possibly have unspecified other impact by sending
network traffic.


* Additional fix for CVE-2011-1577.

Ubuntu provided an additional fix for CVE-2011-1577 (Missing boundary
checks in GPT partition handling).


* Additional fix for CVE-2011-1017.

Ubuntu provided an additional fix for CVE-2011-1017 (Missing boundary
checks in LDM partition table parsing).


* CVE-2011-2484: Denial of service in taskstats subsystem.

The add_del_listener function in kernel/taskstats.c in the Linux kernel
did not prevent multiple registrations of exit handlers, which allowed
local users to cause a denial of service (memory and CPU consumption),
and bypass the OOM Killer, via a crafted application.


* CVE-2011-2493: Denial of service on ext4 mount failure.

When mounting a corrupted ext4 filesystem, the kernel may attempt to use
an uninitialize timer, leading to denial of service (kernel oops).

SUPPORT

Ksplice support is available at support at ksplice.com or +1 765-577-5423.