[Ksplice][Ubuntu-19.04-Updates] New Ksplice updates for Ubuntu 19.04 Disco (USN-3979-1)

[Oracle Ksplice]

Synopsis: USN-3979-1 can now be patched using Ksplice
CVEs: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 CVE-2019-11477 CVE-2019-11478 CVE-2019-11683 CVE-2019-3874 CVE-2019-3882 CVE-2019-3887 CVE-2019-9500 CVE-2019-9503

Systems running Ubuntu 19.04 Disco can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-3979-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 19.04
Disco install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2019-11477, CVE-2019-11478: Remote Denial-of-service in TCP stack.

A number of errors in the TCP stack could result in a remotely
triggerable denial of service on links with a small Maximum Segment Size
(MSS).  A remote user could use a maliciously crafted TCP stream to
either panic the system or exhaust resources.


* KPTI enablement for Ksplice.




* CVE-2019-11091, CVE-2018-12126, CVE-2018-12130, CVE-2018-12127: Microarchitectural Data Sampling.

A hardware vulnerability on various Intel x86 processors can allow a process to
speculatively access privileged information stored in CPU microarchitectural
buffers. A local user or guest VM could use this flaw to learn information
about the host kernel or hypervisor and use this to facilitate a further
attack.

Updated microcode is required for the mitigation to be effective, please see
the output of /sys/devices/system/cpu/vulnerabilities/mds to determine whether
the microcode supports the mitigation.

This update does not mitigate the vulnerability when SMT is in use. SMT can be
disabled with the following command:

echo off > /sys/devices/system/cpu/smt/control


* CVE-2019-3887: Denial-of-service when running a nested guest in KVM.

A missing check when running a nested guest in KVM could let a L1 guest
access x2APIC Machine Specific Register (MSR) using a L2 guest. A local
attacker running from a L1 guest could use this flaw to cause a
denial-of-service.


* CVE-2019-3882: Denial-of-service when repeatedly DMA mapping device MMIO.

By repeatedly mapping device MMIO memory via mmap, a malicious user
could potentially consume unbounded system memory, resulting in resource
starvation and a denial-of-service.


* CVE-2019-9503: Denial-of-service when receiving firmware event frames over a Broadcom WLAN USB dongle.

A failure to validate firmware event frames received over a Broadcom
WLAN USB dongle could let a remote attacker cause a denial-of-service.


* CVE-2019-9500: Potential heap overflow in Broadcom FullMAC WLAN driver.

A missing length check in the brcmfmac driver can lead to a buffer
overflow on the heap.  This could cause a system to exhibit unexpected
behavior, and could potentially lead to a denial-of-service.


* CVE-2019-3874: Denial-of-service in the SCTP socket subsystem.

The SCTP socket buffer used by a userspace application is not accounted by
the cgroups subsystem. An attacker can use this flaw to exhaust kernel
memory and cause a denial-of-service.


* CVE-2019-11683: Remote denial of service in UDP generic receive offloading.

Due to missing input validation, UDP packets with a zero-sized payload
or other specially crafted sizes could cause buffer overflows and kernel
crashes.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.