Synopsis: ELSA-2021-4358 can now be patched using Ksplice CVEs: CVE-2021-27645 CVE-2021-33574 CVE-2021-35942
Users with Oracle Linux Premier Support can now use Ksplice to patch against the latest Oracle Linux Security Advisory, ELSA-2021-4358. INSTALLING THE UPDATES We recommend that all users of Ksplice on OL 8 install these updates. You can install these updates by running: # ksplice -y user upgrade 32-bit applications should be restarted after upgrading the on-disk glibc RPMs and statically linked applications using glibc should be rebuilt to include these fixes. Ksplice user-space patching requires installation of Ksplice-aware packages and the system must be rebooted after the first installation of these packages. Refer to the installation instructions for the Enhanced Ksplice Client in the Ksplice User's Guide for more details. Systems may be prepared for Ksplice patching by installing the Ksplice aware packages in advance, prior to installing the enhanced Ksplice client. DESCRIPTION * Note: Oracle will not provide a zero downtime update for CVE-2021-27645. CVE-2021-27645 is a denial-of-service when using the nameserver caching daemon. * CVE-2021-35942: Information leak when performing word expansion. A logic error when performing word expansion using wordexp() could lead to an invalid memory access or an information leak. A local attacker could use this flow and crafted arguments to leak information and facilitate an attack. * CVE-2021-33574: Denial-of-service when using POSIX message queues. A logic error when using mq_notify() function of POSIX message queues could lead to a use-after-free. A local attacker could use this flaw to cause a denial-of-service. SUPPORT Ksplice support is available at [email protected]. _______________________________________________ El-errata mailing list [email protected] https://oss.oracle.com/mailman/listinfo/el-errata
