[Ksplice][Ubuntu-14.04-Updates] New updates available via Ksplice (USN-3018-1)
Oracle Ksplice
ksplice-support_ww at oracle.com
Wed Jun 29 05:34:57 PDT 2016
Synopsis: USN-3018-1 can now be patched using Ksplice
CVEs: CVE-2016-3134 CVE-2016-4482 CVE-2016-4565 CVE-2016-4569 CVE-2016-4578 CVE-2016-4580 CVE-2016-4913 CVE-2016-4997 CVE-2016-4998
Systems running Ubuntu 14.04 Trusty can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-3018-1.
INSTALLING THE UPDATES
We recommend that all users of Ksplice Uptrack on Ubuntu 14.04 Trusty
install these updates.
On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.
Alternatively, you can install these updates by running:
# /usr/sbin/uptrack-upgrade -y
DESCRIPTION
* CVE-2016-4578, CVE-2016-4569: Information leak in sound timers.
Missing initialization of stack data structures could result in leaking
the contents of kernel stack memory to user-space. A local user with
access to the sound device could use this flaw to infer the layout of
kernel memory.
* CVE-2016-4580: Kernel stack information leak in X25 facility negotiation.
Missing initialization of a stack data structure could result in leaking
up to 8 bytes of kernel stack information to a local, unprivileged user.
* CVE-2016-4913: Information leak in ISO9660 filename parsing.
Incorrect handling of NUL termination bytes could result in reading
excessive data from a kernel buffer into user-space. A local user with
permissions to mount a maliciously crafted filesystem could use this
flaw to leak the contents of sensitive memory.
* CVE-2016-4482: Information leak in USB devfs ioctl.
The USB devfs driver can leak the contents on the kernel stack to
userspace when performing a USBDEVFS_CONNECTINFO operation.
* CVE-2016-4565: Privilege escalation in Infiniband ioctl.
The Infiniband ioctl interface does not correctly validate parameters
from userspace which can allow local users to corrupt kernel memory and
escalate privileges.
* CVE-2016-3134, CVE-2016-4997, CVE-2016-4998: Memory corruption in SO_SET_REPLACE netfilter interface.
The netfilter subsystem does not correctly validate IPT_SO_SET_REPLACE
data from userspace which can allow local users with CAP_NET_ADMIN
privileges to trigger kernel memory corruption and possibly gain
elevated privileges.
SUPPORT
Ksplice support is available at ksplice-support_ww at oracle.com.
More information about the Ksplice-Ubuntu-14.04-updates
mailing list