[Ksplice][Ubuntu-22.04-Updates] New Ksplice updates for Ubuntu 22.04 Jammy (USN-5594-1)

[Julian Pidancet]

Synopsis: USN-5594-1 can now be patched using Ksplice
CVEs: CVE-2021-33061 CVE-2022-1012 CVE-2022-1729 CVE-2022-1852 CVE-2022-1943 CVE-2022-1973 CVE-2022-2503 CVE-2022-2873 CVE-2022-2959

Systems running Ubuntu 22.04 Jammy can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-5594-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 22.04
Jammy install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* Provide an interface to freeze tasks.




* CVE-2022-1852: Denial-of-service in Kernel-based Virtual Machine.

A logic flaw in decoding instructions for emulation of Kernel-based
Virtual Machine could result in staling of emulation context. A local
user could use this flaw for denial-of-service.


* Denial-of-service during internal data structure garbage collection.

A logic error in the associative array libraries garbage collection
routine may cause an assertion error. A local user could use this flaw
for denial-of-service.


* CVE-2022-1729: Privilege escalation in Performance Events due to improper locking.

Improper locking in the Performance Events implementation when opening
and associating a performance event to a task/CPU could result in a race
condition. A local, unprivileged user could use this flaw for privilege
escalation.


* CVE-2022-1943: Out-of-bounds memory access in UDF file system.

An uninitialized memory access in the UDF filesystem when invoking
udf_write_fi() through an ioctl could lead to an out-of-bounds write
access. A local attacker could use this flaw to crash the system or gain
code execution.


* CVE-2022-1012: Information disclosure in TCP.

Insufficient randomness in TCP source port number generation when
opening TCP connections to remote host could lead to an information
leak. A remote attacker can use this to fingerprint a network host.


* CVE-2022-2959: Use-after-free in pipe.

A race condition when trying to resize pipe ring buffers may lead to a
use-after-free. A local attacker could use this flaw to cause a denial
of service or elevate privileges on the system.


* CVE-2022-1973: Code execution in NTFS3 file system.

An uninitialized pointer free in log_replay could result in memory leaks
and data corruption. A local user could use this flaw for
denial-of-service or gain arbitrary code execution.


* CVE-2022-2503: Filesystem integrity check bypass in dm-verity.

A flaw in dm-verity allows users to switch out dm-verity target with
equivalent dm-linear targets and bypass filesystem integrity
verification. A privileged user could use this to load untrusted kernel
modules and firmware.


* Note: Oracle will not provide a zero-downtime update for CVE-2021-33061 (INTEL-SA-00571).

CVE-2021-33061 (INTEL-SA-00571) is scored CVSSv3 5.5 (medium severity)
and is due to improper isolation of shared resources in network on chip
for the Intel(R) 82599 Ethernet Controllers and Adapters. This
vulnerability could allow an authenticated user to potentially enable
denial of service via local access. A patch for this vulnerability
exist in the linux kernel's ixgbe driver.

Hosts without Intel(R) 82599 Ethernet adapter are not affected by this
issue.

Oracle has determined that patching CVE-2021-33061 (INTEL-SA-00571) on a
running system would not be safe and recommends a reboot if using an
Intel(R) Ethernet adapter.


* CVE-2022-2873: Out-of-bounds memory access in iSMT.

A missing sanity check for a user controlled value in the Intel's iSMT
SMBus host controller driver when processing an SMBus command may lead
to a memory corruption by writing past the end of a buffer. A local
user could use this flaw for denial-of-service or code execution.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.