[Ksplice][Ubuntu-22.10-Updates] New Ksplice updates for Ubuntu 22.10 Kinetic (USN-5793-1)

Thu Feb 2 09:20:07 UTC 2023

Synopsis: USN-5793-1 can now be patched using Ksplice
CVEs: CVE-2022-1184 CVE-2022-20421 CVE-2022-2308 CVE-2022-2663 CVE-2022-3303 CVE-2022-3535 CVE-2022-3541 CVE-2022-3542 CVE-2022-3543 CVE-2022-3544 CVE-2022-3586 CVE-2022-3623 CVE-2022-3643 CVE-2022-3646 CVE-2022-3649 CVE-2022-3910 CVE-2022-3977 CVE-2022-40307 CVE-2022-4095 CVE-2022-41850 CVE-2022-42896 CVE-2022-43750 CVE-2022-4378 CVE-2022-45934 CVE-2022-4662

Systems running Ubuntu 22.10 Kinetic can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-5793-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 22.10
Kinetic install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y

DESCRIPTION

* CVE-2022-3586: Use-after-free in network scheduler.

A race condition in net scheduler when enqueuing a socket buffer into a
queue discipline may lead to a use-after-free. A local user could use
this flaw to cause a denial-of-service or disclose sensitive
information.

* CVE-2022-3649: Use-after-free in NILFS2 file system.

A missing sanity check in nilfs2 when handling corrupted on-disk
filesystem data could lead to a use-after-free. An attacker could use
this flaw to cause a denial-of-service or escalate privileges.

* CVE-2022-4095: Use-after-free in rtl8712 USB networking driver.

A flaw in the rtl8712 driver may lead to a use-after-free when
processing the command queue. A local attacker could use this flaw to
cause a denial-of-service or escalate privileges.

* CVE-2022-3646: Memory-leak in NILFS2 file system.

A flaw in NILFS2 when failing to create a log write thread could lead to
a memory leak. A local attacker could use this flaw to exhaust system
memory and cause a denial-of-service.

* CVE-2022-2663: Firewall bypass in IRC connection tracking.

An issue in nf_conntrack_irc in unencrypted IRC protocol message
handling could result in messages being incorrectly matched by the
firewall. A remote user could use this flaw to bypass local firewall
rules.

* CVE-2022-2308: Information disclosure in Virtio Data Path Acceleration.

Improperly initialized memory in vDPA when a vDPA Device in Userspace
(VDUSE) application requests configuration data from the driver may lead
to leaking kernel stack memory. This could cause undefined behavior or
data leaks in Virtio drivers.

* CVE-2022-41850: Use-after-free in Roccat support driver.

A race condition in Roccat support driver may lead to a
read-after-free. A local user could use this flaw to gain
sensitive information as a part of another type of attack.

* CVE-2022-40307: Use-after-free in EFI capsule loader.

A race condition in EFI capsule loader when simultaneously performing a
write and a close operation on the device node may lead to a
use-after-free. A local user could use this flaw to cause a
denial-of-service or escalate privileges.

* CVE-2022-20421: Use-after-free in Android binder.

A race condition in the binder subsystem could lead to a use-after-free
after a failed transaction. An unprivileged user could use this flaw to
cause a denial-of-service or escalate privileges.

* Updated fix to CVE-2022-1184: Use-after-free when handling corrupted hash tree in ext4.

A logic error when handling corrupted hash tree directory in ext4
filesystems could lead to a use-after-free. A local attacker could use
this flaw and a malicious ext4 image to cause a denial-of-service.

* CVE-2022-43750: Use-after-free in USB monitor.

Incorrect permission flags set on userspace memory mappings in usbmon
could lead to a use-after-free. A local attacker could use this flaw for
a denial-of-service or escalate privileges.

* CVE-2022-4662: Denial-of-service in USB core.

Lack of protection from nested device resets in the USB core implementation
could lead to a system crash. A local attacker could use this flaw to cause
a denial-of-service.

* CVE-2022-3910: Privilege escalation in IO Uring support driver.

Improper resources management in IO Uring driver could lead to
use-after-free error. A local attacker may use this flaw to
cause denial-of-service or privilege escalation.

* CVE-2022-3977: Use-after-free in MCTP support driver.

There is a race condition in Management Component Transport Protocol
(MCTP) between DROPTAG ioctl and socket close call that could lead to
a use-after-free vulnerability. A local attacker may use this flaw to
cause denial-of-service or escalate privileges.

* CVE-2022-3543: Memory-leak in UNIX Domain sockets.

A flaw in UNIX domain sockets when sending out-of-band data could lead
to a memory leak. A local attacker could use this flaw to exhaust
system memory and cause a denial-of-service.

* Note: Oracle has determined that CVE-2022-3303 is not applicable.

Improper locking flaw in ioctls of OSS digital audio (PCM) emulation
could result in a system crash. A local user could use this flaw for
a denial-of-service.

The kernel is not affected by CVE-2022-3303 since the code under
consideration is not compiled.

* Note: Oracle has determined that CVE-2022-3542 is not applicable.

The kernel is not affected by CVE-2022-3542 since the code under
consideration is not compiled.

* Note: Oracle has determined that CVE-2022-3544 is not applicable.

The kernel is not affected by CVE-2022-3544 since the code under
consideration is not compiled.

* Note: Oracle has determined that CVE-2022-3541 is not applicable.

The kernel is not affected by CVE-2022-3541 since the code under
consideration is not compiled.

* Note: Oracle has determined that CVE-2022-3535 is not applicable.

The kernel is not affected by CVE-2022-3535 since the code under
consideration is not compiled.

* Note: Oracle has determined that CVE-2022-3623 is not applicable.

The kernel is not affected by CVE-2022-3623 since the vulnerability
is architecture specific and x86_64 is not vulnerable.

* CVE-2022-42896: Use-after-free in Bluetooth L2CAP.

A flaw in Bluetooth L2CAP protocol when accepting incoming connection
requests could lead to a use-after-free. A remote attacker could use
this flaw for a denial-of-service or for privilege escalation.

* CVE-2022-4378: Out-of-bounds memory access in sysctl.

A flaw parsing character strings in the sysctl subsystem when changing
kernel parameters can lead to a stack overflow. A local user could use
this flaw for a denial-of-service or arbitrary code execution.

* CVE-2022-45934: Denial-of-Service in Bluetooth L2CAP.

And integer overflow flaw in Bluetooth L2CAP when sending L2CAP
configuration request packets could result in a system crash. A local
user could use this flaw to cause a denial-of-service.

* CVE-2022-3643: Denial-of-host-service via malicious Xen netfront packet.

The Xen netback handler does not properly handle packets with protocol
headers that span multiple slots. A malicious guest might exploit this
to crash certain varieties of network interface on the host.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.