[Ksplice][Ubuntu-18.10-Updates] New Ksplice updates for Ubuntu 18.10 Cosmic (USN-3980-1)

[Oracle Ksplice]

Synopsis: USN-3980-1 can now be patched using Ksplice
CVEs: CVE-2017-5753 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2018-16884 CVE-2019-11091 CVE-2019-11477 CVE-2019-11478 CVE-2019-3874 CVE-2019-3882 CVE-2019-3887 CVE-2019-9500 CVE-2019-9503

Systems running Ubuntu 18.10 Cosmic can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-3980-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 18.10
Cosmic install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2019-11477, CVE-2019-11478: Remote Denial-of-service in TCP stack.

A number of errors in the TCP stack could result in a remotely
triggerable denial of service on links with a small Maximum Segment Size
(MSS).  A remote user could use a maliciously crafted TCP stream to
either panic the system or exhaust resources.


* CVE-2019-3887: Denial-of-service when running a nested guest in KVM.

A missing check when running a nested guest in KVM could let a L1 guest
access x2APIC Machine Specific Register (MSR) using a L2 guest. A local
attacker running from a L1 guest could use this flaw to cause a
denial-of-service.


* CVE-2019-9503: Denial-of-service when receiving firmware event frames over a Broadcom WLAN USB dongle.

A failure to validate firmware event frames received over a Broadcom
WLAN USB dongle could let a remote attacker cause a denial-of-service.


* CVE-2019-9500: Potential heap overflow in Broadcom FullMAC WLAN driver.

A missing length check in the brcmfmac driver can lead to a buffer
overflow on the heap.  This could cause a system to exhibit unexpected
behavior, and could potentially lead to a denial-of-service.


* Improved fix for CVE-2017-5753: Speculative execution in DRM legacy buffer free.

The DRM legacy buffer management implementation is vulnerable to a Spectre
variant 1 side-channel attack. A local user could use this flaw to read
arbitrary kernel memory.


* Improved fix for Spectre v1: Information leak in SGI GRU driver.

An unsanitized user-controlled value is used as an index to a buffer
in SGI's Global Reference Unit driver.  This could be exploited to leak
information about the running system.


* Improved fix for Spectre v1: Bounds-check bypass in multicast ioctls.

The ioctl handlers for the ip6mr and ipmr multicast routing systems are
potentially vulnerable to Spectre variant 1 speculative execution
attacks.


* Improved fix for Spectre v1: Bounds-check bypass in asynchronous I/O subsystem.

A missing sanitization of array index after bounds check in asynchronous
I/O subsystem could lead to an information leak. A local attacker
could use this flaw to leak information about running system.


* Improved fix for Spectre v1: Bounds-check bypass in ALSA sound drivers.

Several ALSA sound device drivers contain array accesses whose values
are controlled by userspace input, and might therefore be vulnerable to
a Spectre variant 1 speculative bounds-check bypass attack.


* Improved fix for CVE-2017-5753: Spectre v1 vulnerability in DRM driver's ioctl handler.

A value that is indirectly controlled by userspace is used to index a
buffer in drm_ioctl.  A local attacker could use a Spectre-style attack
to exploit this flaw and cause unexpected behavior, or a
denial-of-service.


* Improved fix for CVE-2017-5753: Spectre v1 vulnerability in ACP Modem driver.

A user-controlled value is used to index an array in the ACP Modem
driver.  This flaw could be exploited using a Spectre v1 style attack to
leak information about the running system.


* Improved fix for Spectre v1: Bounds-check bypass in applicom driver.

Some array accesses in Applicom driver, when performing write and ioctl
syscalls, are potentially vulnerable to Spectre v1 speculative execution
attack.


* Improved fix for Spectre v1: Bounds-check bypass in IPMI subsystem.

A missing sanitization of array index after bounds check during multiple
user-controlled configuration operations in the IPMI subsystem could lead
to an information leak. A local attacker could use this flaw to escalate
privilege.


* Improved fix to Spectre v1: bounds-check bypass in various ALSA sound drivers.

Several arrays in subsystems of the ALSA sound device driver code are
potentially vulnerable to a Spectre variant 1 speculative execution
attack.


* Denial-of-service in the XFS filesystem when writeback cache is enabled.

A lock acquisition order violation when writing to a file in an XFS
filesystem leads to a deadlock when writeback cache is enabled. An
unprivileged local user could trigger this bug and cause a
denial-of-service.


* CVE-2019-3882: Denial-of-service when repeatedly DMA mapping device MMIO.

By repeatedly mapping device MMIO memory via mmap, a malicious user
could potentially consume unbounded system memory, resulting in resource
starvation and a denial-of-service.


* CVE-2019-3874: Denial-of-service in the SCTP socket subsystem.

The SCTP socket buffer used by a userspace application is not accounted by
the cgroups subsystem. An attacker can use this flaw to exhaust kernel
memory and cause a denial-of-service.


* Improved fix for CVE-2017-5753: Information leak during array access in cfg80211.

Speculative execution of array accesses when receiving a cfg80211 packet
allows a local user to mount a Spectre v1-style attack and read privileged
kernel memory.


* Note: Oracle will not be providing a zero downtime update for CVE-2018-16884.




* CVE-2019-11091, CVE-2018-12126, CVE-2018-12130, CVE-2018-12127: Microarchitectural Data Sampling.

A hardware vulnerability on various Intel x86 processors can allow a process to
speculatively access privileged information stored in CPU microarchitectural
buffers. A local user or guest VM could use this flaw to learn information
about the host kernel or hypervisor and use this to facilitate a further
attack.

Updated microcode is required for the mitigation to be effective, please see
the output of /sys/devices/system/cpu/vulnerabilities/mds to determine whether
the microcode supports the mitigation.

This update does not mitigate the vulnerability when SMT is in use. SMT can be
disabled with the following command:

echo off > /sys/devices/system/cpu/smt/control

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.