[Ksplice][Ubuntu-22.10-Updates] New Ksplice updates for Ubuntu 22.10 Kinetic (USN-5754-1)

Thu Feb 2 09:19:09 UTC 2023

Synopsis: USN-5754-1 can now be patched using Ksplice
CVEs: CVE-2022-1184 CVE-2022-20421 CVE-2022-2308 CVE-2022-2663 CVE-2022-3524 CVE-2022-3543 CVE-2022-3564 CVE-2022-3565 CVE-2022-3566 CVE-2022-3567 CVE-2022-3586 CVE-2022-3594 CVE-2022-3621 CVE-2022-3643 CVE-2022-3646 CVE-2022-3649 CVE-2022-3910 CVE-2022-3977 CVE-2022-40307 CVE-2022-4095 CVE-2022-41850 CVE-2022-42896 CVE-2022-43750 CVE-2022-4378 CVE-2022-43945 CVE-2022-45934 CVE-2022-4662

Systems running Ubuntu 22.10 Kinetic can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-5754-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 22.10
Kinetic install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y

DESCRIPTION

* CVE-2022-43945: Out-of-bounds memory access in NFSD.

A logic error in NFSD when a small RPC Call message arrives in an
oversized RPC record can lead to a buffer overflow. A remote attacker
could use this flaw for a denial-of-service or privilege escalation.

* CVE-2022-3594: Denial-of-service in r8152 USB network driver.

Improper management of logging in the r8152 driver when handling
interrupts can lead to logging of excessive data. A remote attacker
could use this flaw to flood the system logs and hinder the ability to
detect anomalous conditions.

* CVE-2022-3564: Use-after-free in Bluetooth L2CAP.

A race condition in Bluetooth L2CAP when a socket buffer is queued and
dequeued by two flows running in parallel can lead to a use-after-free.
A remote attacker could use this flaw for a denial-of-service or
for privilege escalation.

* CVE-2022-3524: Memory-leak in IPv6 networking.

A race condition in IPv6 networking when converting an IPv6 socket into
IPv4 could lead to a memory-leak. A local user could use this flaw to
exhaust the system's memory and cause denial-of-service.

* CVE-2022-3621: Denial-of-service in NILFS2 file system.

A missing sanity check in nilfs2 when handling corrupted on-disk
filesystem data could lead to a NULL pointer dereference. A local user
could use this flaw for a denial-of-service.

* CVE-2022-3565: Use-after-free in modular ISDN driver.

A race condition in mISDN when l1oip_cleanup is called while a timer
handler is running may lead to a use-after-free. A local user could use
this flaw for a denial-of-service or privilege escalation.

* CVE-2022-3566, CVE-2022-3567: Denial-of-service in IPv6 networking.

A race condition in IPv6 networking when converting an IPv6 socket into
IPv4 could lead to a data corruption. A local user could use this flaw
for a denial-of-service.

* CVE-2022-3586: Use-after-free in network scheduler.

A race condition in net scheduler when enqueuing a socket buffer into a
queue discipline may lead to a use-after-free. A local user could use
this flaw to cause a denial-of-service or disclose sensitive
information.

* CVE-2022-3649: Use-after-free in NILFS2 file system.

A missing sanity check in nilfs2 when handling corrupted on-disk
filesystem data could lead to a use-after-free. An attacker could use
this flaw to cause a denial-of-service or escalate privileges.

* CVE-2022-4095: Use-after-free in rtl8712 USB networking driver.

A flaw in the rtl8712 driver may lead to a use-after-free when
processing the command queue. A local attacker could use this flaw to
cause a denial-of-service or escalate privileges.

* CVE-2022-3646: Memory-leak in NILFS2 file system.

A flaw in NILFS2 when failing to create a log write thread could lead to
a memory leak. A local attacker could use this flaw to exhaust system
memory and cause a denial-of-service.

* CVE-2022-2663: Firewall bypass in IRC connection tracking.

An issue in nf_conntrack_irc in unencrypted IRC protocol message
handling could result in messages being incorrectly matched by the
firewall. A remote user could use this flaw to bypass local firewall
rules.

* CVE-2022-2308: Information disclosure in Virtio Data Path Acceleration.

Improperly initialized memory in vDPA when a vDPA Device in Userspace
(VDUSE) application requests configuration data from the driver may lead
to leaking kernel stack memory. This could cause undefined behavior or
data leaks in Virtio drivers.

* CVE-2022-41850: Use-after-free in Roccat support driver.

A race condition in Roccat support driver may lead to a
read-after-free. A local user could use this flaw to gain
sensitive information as a part of another type of attack.

* CVE-2022-40307: Use-after-free in EFI capsule loader.

A race condition in EFI capsule loader when simultaneously performing a
write and a close operation on the device node may lead to a
use-after-free. A local user could use this flaw to cause a
denial-of-service or escalate privileges.

* CVE-2022-20421: Use-after-free in Android binder.

A race condition in the binder subsystem could lead to a use-after-free
after a failed transaction. An unprivileged user could use this flaw to
cause a denial-of-service or escalate privileges.

* Updated fix to CVE-2022-1184: Use-after-free when handling corrupted hash tree in ext4.

A logic error when handling corrupted hash tree directory in ext4
filesystems could lead to a use-after-free. A local attacker could use
this flaw and a malicious ext4 image to cause a denial-of-service.

* CVE-2022-43750: Use-after-free in USB monitor.

Incorrect permission flags set on userspace memory mappings in usbmon
could lead to a use-after-free. A local attacker could use this flaw for
a denial-of-service or escalate privileges.

* CVE-2022-4662: Denial-of-service in USB core.

Lack of protection from nested device resets in the USB core implementation
could lead to a system crash. A local attacker could use this flaw to cause
a denial-of-service.

* CVE-2022-3910: Privilege escalation in IO Uring support driver.

Improper resources management in IO Uring driver could lead to
use-after-free error. A local attacker may use this flaw to
cause denial-of-service or privilege escalation.

* CVE-2022-3977: Use-after-free in MCTP support driver.

There is a race condition in Management Component Transport Protocol
(MCTP) between DROPTAG ioctl and socket close call that could lead to
a use-after-free vulnerability. A local attacker may use this flaw to
cause denial-of-service or escalate privileges.

* CVE-2022-3543: Memory-leak in UNIX Domain sockets.

A flaw in UNIX domain sockets when sending out-of-band data could lead
to a memory leak. A local attacker could use this flaw to exhaust
system memory and cause a denial-of-service.

* CVE-2022-42896: Use-after-free in Bluetooth L2CAP.

A flaw in Bluetooth L2CAP protocol when accepting incoming connection
requests could lead to a use-after-free. A remote attacker could use
this flaw for a denial-of-service or for privilege escalation.

* CVE-2022-4378: Out-of-bounds memory access in sysctl.

A flaw parsing character strings in the sysctl subsystem when changing
kernel parameters can lead to a stack overflow. A local user could use
this flaw for a denial-of-service or arbitrary code execution.

* CVE-2022-45934: Denial-of-Service in Bluetooth L2CAP.

And integer overflow flaw in Bluetooth L2CAP when sending L2CAP
configuration request packets could result in a system crash. A local
user could use this flaw to cause a denial-of-service.

* CVE-2022-3643: Denial-of-host-service via malicious Xen netfront packet.

The Xen netback handler does not properly handle packets with protocol
headers that span multiple slots. A malicious guest might exploit this
to crash certain varieties of network interface on the host.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.