[Ksplice][Ubuntu-22.04-Updates] New Ksplice updates for Ubuntu 22.04 Jammy (USN-5729-1)

[Julian Pidancet]

Synopsis: USN-5729-1 can now be patched using Ksplice
CVEs: CVE-2022-1184 CVE-2022-2905 CVE-2022-2978 CVE-2022-3028 CVE-2022-3061 CVE-2022-3625 CVE-2022-3629 CVE-2022-3633 CVE-2022-3635 CVE-2022-39190 CVE-2022-40476 CVE-2022-40768

Systems running Ubuntu 22.04 Jammy can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-5729-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 22.04
Jammy install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2022-3028: Out-of-bounds memory access in IP framework XFRM subsystem.

A race condition can occur when multiple calls to the same function
in the IP framework can lead to a race condition, and subsequent
out-of-bounds memory accesses.  A local attacker could exploit this flaw
to leak kernel memory, or make arbitrary writes to kernel memory.


* CVE-2022-2905: Out-of-bounds memory access in BPF subsystem.

Improper range check in the BPF subsystem when the JIT compiler is
invoked could result in an out-of-bounds read access. A local attacker
could possibly use this to cause a denial of service (system crash) or
expose sensitive information (kernel memory).


* CVE-2022-39190: Denial-of-service in netfilter.

A missing sanity-check in netfilter does not properly prevent binding
to an already bound chain. A local attacker could use this to cause a
denial-of-service.


* CVE-2022-3061: Denial-of-service in i740fb framebuffer driver.

Improper checking of userspace provided arguments in i740fb when
setting the 'pixclock' hardware property may lead to a divide-by-zero
bug. A local attacker could use this flaw for a denial-of-service.


* CVE-2022-1184: Use-after-free when handling corrupted hash tree in ext4.

A logic error when handling corrupted hash tree directory in ext4
filesystems could lead to a use-after-free. A local attacker could use
this flaw and a malicious ext4 image to cause a denial-of-service.


* CVE-2022-3635: Denial-of-service in IDT 77252 ATM PCI driver.

A missing removal of a timer in IDT 77252 ATM PCI driver could lead to
usage of resources after the device exit. A local attacker could use
this flaw to cause a denial-of-service.


* CVE-2022-3629: Memory leak in virtual socket protocol.

A race condition in VMware vSockets Driver when attempting to connect a
vsock in non-blocking mode may lead to a reference count leak. A local
attacker could use this flaw to exhaust kernel memory and eventually
cause a denial-of-service.


* CVE-2022-3625: Denial-of-service in the Netlink device interface implementation.

A missing check when setting or getting Netlink device parameters could
lead to a use-after-free. A local attacker could use this flaw to cause
a denial-of-service or possibly execute arbitrary code.


* CVE-2022-3633: Denial-of-Service in j1939 CAN driver.

A reference counting flaw in the j1939 CAN driver when destroying a
session could lead to a memory-leak of socket buffers. A local attacker
could use this flaw to exhaust kernel memory and eventually cause a
denial-of-service.


* CVE-2022-40768: Information leak using scsi driver.

A missing zeroing of on-stack memory passed to userspace in scsi driver
could lead to an information leak. A local attacker could use this flaw
to leak information about running kernel and facilitate an attack.


* CVE-2022-40476: Denial-of-Service in io_uring.

A flaw in io_uring during inflight tracking could lead to a NULL
pointer dereference. A local user could use this flaw for a
denial-of-service.


* Use-after-free in usbnet driver during device disconnect.

Certain sequences of events can lead to a use-after-free in the usbnet
device driver.  An attacker could exploit this flaw to cause a
denial-of-service, or to potentially aid in another type of attack.


* CVE-2022-2978: Denial-of-service when initializing inodes.

A logic error when initializing inodes could lead to an invalid memory
access. A local attacker could use this flaw to cause a denial-of-
service.


* Denial-of-service when checking if an address is a jump label.

The jump label sub-system has an assertion that can be triggered while
installing Ksplice updates.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.