[Ksplice][Ubuntu-Oracle-Updates] New Ksplice updates for Ubuntu OCI kernel (USN-5003-1)

[Oracle Ksplice]

Synopsis: USN-5003-1 can now be patched using Ksplice
CVEs: CVE-2021-23133 CVE-2021-3444 CVE-2021-3600 CVE-2021-3609

Systems running Ubuntu OCI kernel can now use Ksplice to patch against
the latest Ubuntu Security Notice, USN-5003-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu OCI
kernel install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2021-23133: Multiple vulnerabilities due to a race condition in SCTP.

A flaw in socket functionality of Stream Control Transmission Protocol
could lead to a race condition. A local user with network service
privileges could use this flaw for privilege escalation, information
disclosure or denial-of-service.


* CVE-2021-3609: Privilege escalation in CAN BCM due to use-after-free.

A race condition in the CAN BCM implementation could lead to use-after-free
vulnerability. A local attacker could potentially use this to execute
arbitrary code.


* CVE-2021-3600: Arbitrary code execution in BPF div/mod operations.

BPF verifier did not properly track bounds information for 32-bit
registers when performing div and mod operations. A local user
could potentially use this flaw to execute arbitrary code.


* CVE-2021-3444: Multiple vulnerabilities in BPF verifier.

A flaw in the BPF verifier implementation could result in out-of-bounds
reads or out-of-bounds writes. A local attacker with the ability to load
BPF programs could potentially use this to cause information disclosure
or code execution.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.