Ranjivosti jezgre operacijskog sustava

Detalji os-a: LRH
Važnost: IMP
Operativni sustavi: L
Kategorije: LRH

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kernel security and bug fix update
Advisory ID: RHSA-2016:0185-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-0185.html
Issue date: 2016-02-16
CVE Names: CVE-2015-5157 CVE-2015-7872
=====================================================================

1. Summary:

Updated kernel packages that fix two security issues and several bugs are
now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) – noarch, x86_64
Red Hat Enterprise Linux Client Optional (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) – noarch, x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) – x86_64
Red Hat Enterprise Linux Server (v. 7) – noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) – ppc64, ppc64le, x86_64
Red Hat Enterprise Linux Workstation (v. 7) – noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) – x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

* It was found that the Linux kernel’s keys subsystem did not correctly
garbage collect uninstantiated keyrings. A local attacker could use this
flaw to crash the system or, potentially, escalate their privileges on the
system. (CVE-2015-7872, Important)

* A flaw was found in the way the Linux kernel handled IRET faults during
the processing of NMIs. An unprivileged, local user could use this flaw to
crash the system or, potentially (although highly unlikely), escalate their
privileges on the system. (CVE-2015-5157, Moderate)

This update also fixes the following bugs:

* Previously, processing packets with a lot of different IPv6 source
addresses caused the kernel to return warnings concerning soft-lockups due
to high lock contention and latency increase. With this update, lock
contention is reduced by backing off concurrent waiting threads on the
lock. As a result, the kernel no longer issues warnings in the described
scenario. (BZ#1285370)

* Prior to this update, block device readahead was artificially limited.
As a consequence, the read performance was poor, especially on RAID
devices. Now, per-device readahead limits are used for each device instead
of a global limit. As a result, read performance has improved, especially
on RAID devices. (BZ#1287550)

* After injecting an EEH error, the host was previously not recovering and
observing I/O hangs in HTX tool logs. This update makes sure that when one
or both of EEH_STATE_MMIO_ACTIVE and EEH_STATE_MMIO_ENABLED flags is marked
in the PE state, the PE’s IO path is regarded as enabled as well. As a
result, the host no longer hangs and recovers as expected. (BZ#1289101)

* The genwqe device driver was previously using the GFP_ATOMIC flag for
allocating consecutive memory pages from the kernel’s atomic memory pool,
even in non-atomic situations. This could lead to allocation failures
during memory pressure. With this update, the genwqe driver’s memory
allocations use the GFP_KERNEL flag, and the driver can allocate memory
even during memory pressure situations. (BZ#1289450)

* The nx842 co-processor for IBM Power Systems could in some circumstances
provide invalid data due to a data corruption bug during uncompression.
With this update, all compression and uncompression calls to the nx842
co-processor contain a cyclic redundancy check (CRC) flag, which forces all
compression and uncompression operations to check data integrity and
prevents the co-processor from providing corrupted data. (BZ#1289451)

* A failed “updatepp” operation on the little-endian variant of IBM Power
Systems could previously cause a wrong hash value to be used for the next
hash insert operation in the page table. This could result in a missing
hash pte update or invalidate operation, potentially causing memory
corruption. With this update, the hash value is always recalculated after a
failed “updatepp” operation, avoiding memory corruption. (BZ#1289452)

* Large Receive Offload (LRO) flag disabling was not being propagated
downwards from above devices in vlan and bond hierarchy, breaking the flow
of traffic. This problem has been fixed and LRO flags now propagate
correctly. (BZ#1292072)

* Due to rounding errors in the CPU frequency of the intel_pstate driver,
the CPU frequency never reached the value requested by the user. A kernel
patch has been applied to fix these rounding errors. (BZ#1296276)

* When running several containers (up to 100), reports of hung tasks were
previously reported. This update fixes the AB-BA deadlock in the
dm_destroy() function, and the hung reports no longer occur. (BZ#1296566)

All kernel users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The system must be
rebooted for this update to take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1259577 – CVE-2015-5157 kernel: x86-64: IRET faults during NMIs processing
1272371 – CVE-2015-7872 kernel: Keyrings crash triggerable by unprivileged user

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
kernel-3.10.0-327.10.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-327.10.1.el7.noarch.rpm
kernel-doc-3.10.0-327.10.1.el7.noarch.rpm

x86_64:
kernel-3.10.0-327.10.1.el7.x86_64.rpm
kernel-debug-3.10.0-327.10.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-327.10.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm
kernel-devel-3.10.0-327.10.1.el7.x86_64.rpm
kernel-headers-3.10.0-327.10.1.el7.x86_64.rpm
kernel-tools-3.10.0-327.10.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-327.10.1.el7.x86_64.rpm
perf-3.10.0-327.10.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm
python-perf-3.10.0-327.10.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-327.10.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
kernel-3.10.0-327.10.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-327.10.1.el7.noarch.rpm
kernel-doc-3.10.0-327.10.1.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Red Hat Enterprise Linux Server (v. 7):

Source:
kernel-3.10.0-327.10.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-327.10.1.el7.noarch.rpm
kernel-doc-3.10.0-327.10.1.el7.noarch.rpm

ppc64:
kernel-3.10.0-327.10.1.el7.ppc64.rpm
kernel-bootwrapper-3.10.0-327.10.1.el7.ppc64.rpm
kernel-debug-3.10.0-327.10.1.el7.ppc64.rpm
kernel-debug-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm
kernel-debug-devel-3.10.0-327.10.1.el7.ppc64.rpm
kernel-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm
kernel-debuginfo-common-ppc64-3.10.0-327.10.1.el7.ppc64.rpm
kernel-devel-3.10.0-327.10.1.el7.ppc64.rpm
kernel-headers-3.10.0-327.10.1.el7.ppc64.rpm
kernel-tools-3.10.0-327.10.1.el7.ppc64.rpm
kernel-tools-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm
kernel-tools-libs-3.10.0-327.10.1.el7.ppc64.rpm
perf-3.10.0-327.10.1.el7.ppc64.rpm
perf-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm
python-perf-3.10.0-327.10.1.el7.ppc64.rpm
python-perf-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm

ppc64le:
kernel-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-bootwrapper-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-debug-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-devel-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-headers-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-tools-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-tools-libs-3.10.0-327.10.1.el7.ppc64le.rpm
perf-3.10.0-327.10.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm
python-perf-3.10.0-327.10.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm

s390x:
kernel-3.10.0-327.10.1.el7.s390x.rpm
kernel-debug-3.10.0-327.10.1.el7.s390x.rpm
kernel-debug-debuginfo-3.10.0-327.10.1.el7.s390x.rpm
kernel-debug-devel-3.10.0-327.10.1.el7.s390x.rpm
kernel-debuginfo-3.10.0-327.10.1.el7.s390x.rpm
kernel-debuginfo-common-s390x-3.10.0-327.10.1.el7.s390x.rpm
kernel-devel-3.10.0-327.10.1.el7.s390x.rpm
kernel-headers-3.10.0-327.10.1.el7.s390x.rpm
kernel-kdump-3.10.0-327.10.1.el7.s390x.rpm
kernel-kdump-debuginfo-3.10.0-327.10.1.el7.s390x.rpm
kernel-kdump-devel-3.10.0-327.10.1.el7.s390x.rpm
perf-3.10.0-327.10.1.el7.s390x.rpm
perf-debuginfo-3.10.0-327.10.1.el7.s390x.rpm
python-perf-3.10.0-327.10.1.el7.s390x.rpm
python-perf-debuginfo-3.10.0-327.10.1.el7.s390x.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64:
kernel-debug-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm
kernel-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm
kernel-debuginfo-common-ppc64-3.10.0-327.10.1.el7.ppc64.rpm
kernel-tools-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm
kernel-tools-libs-devel-3.10.0-327.10.1.el7.ppc64.rpm
perf-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm
python-perf-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm

ppc64le:
kernel-debug-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-debug-devel-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm
kernel-tools-libs-devel-3.10.0-327.10.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
kernel-3.10.0-327.10.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-327.10.1.el7.noarch.rpm
kernel-doc-3.10.0-327.10.1.el7.noarch.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5157
https://access.redhat.com/security/cve/CVE-2015-7872
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iD8DBQFWwyLbXlSAg2UNWIIRAgxrAKCtgSp0IG2VRgkKgqz9sZZG53TswgCfapXF
7d2BElAqDl89HA698MnHeP0=
=0swE
—–END PGP SIGNATURE—–

—
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

********* *BEGIN ENCRYPTED or SIGNED PART* *********

=====================================================================
Red Hat Security Advisory

Synopsis:          Important: kernel-rt security, bug fix, and enhancement update
Advisory ID:       RHSA-2016:0224-01
Product:           Red Hat Enterprise MRG for RHEL-6
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-0224.html
Issue date:        2016-02-16
CVE Names:         CVE-2015-5157 CVE-2015-7872
=====================================================================

1. Summary:

Updated kernel-rt packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise MRG 2.5.

2. Relevant releases/architectures:

MRG Realtime for RHEL 6 Server v.2 – noarch, x86_64

3. Description:

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

This update provides a build of the kernel-rt package for Red Hat
Enterprise MRG 2.5 that is layered on Red Hat Enterprise Linux 6, and
provides a number of bug fixes and enhancements, including:

* [md] dm: fix AB-BA deadlock in __dm_destroy()

* [md] revert “dm-mpath: fix stalls when handling invalid ioctl

* [cpufreq] intel_pstate: Fix limits->max_perf and limits->max_policy_pct
rounding errors

* [cpufreq] revert “intel_pstate: fix rounding error in max_freq_pct”

* [crypto] nx: 842 – Add CRC and validation support

* [of] return NUMA_NO_NODE from fallback of_node_to_nid()

(BZ#1277670)

The HP Smart Array (hpsa) SCSI driver has been updated to the latest
version included in a Red Hat release. (BZ#1224096)

This update also fixes the following bugs:

* A heavy load of incoming packets on a fast networking driver (like the
i40e) will both stress the softirq mechanism on the realtime kernel (as
described in BZ#1293229) and exercise the possible livelock in the netpoll
NAPI/busy polling routines (as described in BZ#1293230). The fixes applied
to both BZ#1293229 and BZ#1293230 will address these issues by hardening
the locking mechanism for the netpoll NAPI/busy polling and by enhancing
the way softirqs are serviced. These fixes also create a failsafe to
avoiding RCU stalls on a heavily loaded system and allows the networking
driver to work as expected. (BZ#1200766)

* The nohz_full code in older versions of the MRG-Realtime kernels was
incomplete and known to be problematic due to the way the old
implementation interacted with the real time features in the kernel.
The nohz_full kernel code has been updated enabling this feature to
function as expected and allowing this feature to be enabled in the
realtime kernel. (BZ#1278511)

* Because the realtime kernel replaces most of the spinlocks with
rtmutexes, the locking scheme used in both NAPI polling and busy polling
could become out of synchronization with the State Machine they protected.
This could cause system performance degradation or even a livelock
situation when a machine with faster NICs (10g or 40g) was subject to a
heavy pressure receiving network packets. The locking schemes on NAPI
polling and busy polling routines were hardened to enforce the State
machine sanity to help ensure the system continues to function properly
under pressure. (BZ#1295884)

* A possible livelock in the NAPI polling and busy polling routines could
lead the system to a livelock on threads running at high, realtime,
priorities. The threads running at priorities lower than the ones of the
threads involved in the livelock would be prevented from running on the
CPUs affected by the livelock. Among those lower priority threads are the
rcuc/ threads. Right before (4 jiffies) a RCU stall is detected, the rcuc/
threads on the CPUs facing the livelock have their priorities boosted above
the priority of the threads involved in the livelock. The softirq code was
also updated to be more robust. These modifications allowed the rcuc/
threads to execute even under system pressure, mitigating the RCU stalls.
(BZ#1295885)

All kernel-rt users are advised to upgrade to these updated packages, which
correct these issues and add these enhancements. The system must be
rebooted for this update to take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1259577 – CVE-2015-5157 kernel: x86-64: IRET faults during NMIs processing
1272371 – CVE-2015-7872 kernel: Keyrings crash triggerable by unprivileged user
1277670 – update the MRG 2.5.x 3.10 kernel-rt sources
1278511 – nohz_full still not working even with nohz=on

6. Package List:

MRG Realtime for RHEL 6 Server v.2:

Source:
kernel-rt-3.10.0-327.rt56.171.el6rt.src.rpm

noarch:
kernel-rt-doc-3.10.0-327.rt56.171.el6rt.noarch.rpm
kernel-rt-firmware-3.10.0-327.rt56.171.el6rt.noarch.rpm

x86_64:
kernel-rt-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-debug-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-debug-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-debug-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-trace-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-trace-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-trace-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-vanilla-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-vanilla-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm
kernel-rt-vanilla-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5157
https://access.redhat.com/security/cve/CVE-2015-7872
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

********** *END ENCRYPTED or SIGNED PART* **********

—
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

Autor	Tomislav Protega
Cert id	NCERT-REF-2016-02-0005-ADV
Cve	CVE-2015-5157 CVE-2015-7872
ID izvornika	RHSA-2016:0185-01
Proizvod	kernel
Izvor	http://www.redhat.com

Ranjivosti jezgre operacijskog sustava

Archives

More in Preporuke

Ranjivost programskog paketa polkit