—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kernel-alt security, bug fix, and enhancement update
Advisory ID: RHSA-2018:2948-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2948
Issue date: 2018-10-30
CVE Names: CVE-2017-13166 CVE-2017-16648 CVE-2017-17805
CVE-2017-17806 CVE-2017-18075 CVE-2017-18208
CVE-2017-18344 CVE-2018-1065 CVE-2018-1068
CVE-2018-1092 CVE-2018-1094 CVE-2018-1095
CVE-2018-1118 CVE-2018-1120 CVE-2018-3639
CVE-2018-5344 CVE-2018-5390 CVE-2018-5391
CVE-2018-5750 CVE-2018-5803 CVE-2018-5848
CVE-2018-7566 CVE-2018-7757 CVE-2018-8781
CVE-2018-9363 CVE-2018-10322 CVE-2018-10877
CVE-2018-10878 CVE-2018-10879 CVE-2018-10880
CVE-2018-10881 CVE-2018-10882 CVE-2018-10883
CVE-2018-10940 CVE-2018-11506 CVE-2018-12232
CVE-2018-13405 CVE-2018-14619 CVE-2018-14641
CVE-2018-1000026 CVE-2018-1000200 CVE-2018-1000204
=====================================================================

1. Summary:

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) – aarch64, noarch, ppc64le, s390x
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) – aarch64, noarch, ppc64le

3. Description:

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es):

* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639, aarch64)

* A flaw named SegmentSmack was found in the way the Linux kernel handled
specially crafted TCP packets. A remote attacker could use this flaw to
trigger time and calculation expensive calls to tcp_collapse_ofo_queue()
and tcp_prune_ofo_queue() functions by sending specially modified packets
within ongoing TCP sessions which could lead to a CPU saturation and hence
a denial of service on the system. Maintaining the denial of service
condition requires continuous two-way TCP sessions to a reachable open
port, thus the attacks cannot be performed using spoofed IP addresses.
(CVE-2018-5390)

* A flaw named FragmentSmack was found in the way the Linux kernel handled
reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use
this flaw to trigger time and calculation expensive fragment reassembly
algorithm by sending specially crafted packets which could lead to a CPU
saturation and hence a denial of service on the system. (CVE-2018-5391)

Space precludes documenting all of the security fixes in this advisory. See
the descriptions of the remaining security fixes in the related Knowledge
Article:

https://access.redhat.com/articles/3658021

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting CVE-2018-3639;
Juha-Matti Tilli (Aalto University – Department of Communications and
Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and
CVE-2018-5391; Qualys Research Labs for reporting CVE-2018-1120; David
Rientjes (Google) for reporting CVE-2018-1000200; and Wen Xu for reporting
CVE-2018-1092, CVE-2018-1094, and CVE-2018-1095. The CVE-2018-14619 issue
was discovered by Florian Weimer (Red Hat) and Ondrej Mosnacek (Red Hat).

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.6 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1516257 – CVE-2017-16648 kernel: Use-after-free in drivers/media/dvb-core/dvb_frontend.c
1528312 – CVE-2017-17805 kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service
1528323 – CVE-2017-17806 kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service
1533909 – CVE-2018-5344 kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial-of-service
1539508 – CVE-2017-18075 kernel: Mishandled freeing of instances in pcrypt.c can allow a local user to cause a denial of service
1539706 – CVE-2018-5750 kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass
1541846 – CVE-2018-1000026 kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via crafted packet
1547824 – CVE-2018-1065 kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash
1548412 – CVE-2017-13166 kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation
1550142 – CVE-2018-7566 kernel: race condition in snd_seq_write() may lead to UAF or OOB-access
1551051 – CVE-2018-5803 kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service
1551565 – CVE-2017-18208 kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service
1552048 – CVE-2018-1068 kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c
1553361 – CVE-2018-7757 kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c
1560777 – CVE-2018-1092 kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image
1560788 – CVE-2018-1094 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
1560793 – CVE-2018-1095 kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
1568744 – CVE-2018-1000200 kernel: NULL pointer dereference on OOM kill of large mlocked process
1571062 – CVE-2018-8781 kernel: Integer overflow in drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() can allow attackers to execute code in kernel space
1571623 – CVE-2018-10322 kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image allowing denial of service
1573699 – CVE-2018-1118 kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg()
1575472 – CVE-2018-1120 kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service
1577408 – CVE-2018-10940 kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c
1583210 – CVE-2018-11506 kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact
1589324 – CVE-2018-1000204 kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
1590215 – CVE-2018-12232 kernel: NULL pointer dereference if close and fchownat system calls share a socket file descriptor
1590799 – CVE-2018-5848 kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory corruption
1596795 – CVE-2018-10877 kernel: out-of-bound access in ext4_ext_drop_refs function with a crafted ext4 image
1596802 – CVE-2018-10878 kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image
1596806 – CVE-2018-10879 kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file
1596812 – CVE-2018-10880 kernel: stack-out-of-bounds write in ext4_update_inline_data function
1596828 – CVE-2018-10881 kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image
1596842 – CVE-2018-10882 kernel: stack-out-of-bounds write infs/jbd2/transaction.c
1596846 – CVE-2018-10883 kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function
1599161 – CVE-2018-13405 kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
1601704 – CVE-2018-5390 kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack)
1609664 – CVE-2018-5391 kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack)
1610958 – CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c
1622004 – CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto api.
1623067 – CVE-2018-9363 kernel: Buffer overflow in hidp_process_report
1629636 – CVE-2018-14641 kernel: a bug in ip_frag_reasm() can cause a crash in ip_do_fragment()

6. Package List:

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):

Source:
kernel-alt-4.14.0-115.el7a.src.rpm

aarch64:
kernel-4.14.0-115.el7a.aarch64.rpm
kernel-debug-4.14.0-115.el7a.aarch64.rpm
kernel-debug-debuginfo-4.14.0-115.el7a.aarch64.rpm
kernel-debug-devel-4.14.0-115.el7a.aarch64.rpm
kernel-debuginfo-4.14.0-115.el7a.aarch64.rpm
kernel-debuginfo-common-aarch64-4.14.0-115.el7a.aarch64.rpm
kernel-devel-4.14.0-115.el7a.aarch64.rpm
kernel-headers-4.14.0-115.el7a.aarch64.rpm
kernel-tools-4.14.0-115.el7a.aarch64.rpm
kernel-tools-debuginfo-4.14.0-115.el7a.aarch64.rpm
kernel-tools-libs-4.14.0-115.el7a.aarch64.rpm
perf-4.14.0-115.el7a.aarch64.rpm
perf-debuginfo-4.14.0-115.el7a.aarch64.rpm
python-perf-4.14.0-115.el7a.aarch64.rpm
python-perf-debuginfo-4.14.0-115.el7a.aarch64.rpm

noarch:
kernel-abi-whitelists-4.14.0-115.el7a.noarch.rpm
kernel-doc-4.14.0-115.el7a.noarch.rpm

ppc64le:
kernel-4.14.0-115.el7a.ppc64le.rpm
kernel-bootwrapper-4.14.0-115.el7a.ppc64le.rpm
kernel-debug-4.14.0-115.el7a.ppc64le.rpm
kernel-debug-debuginfo-4.14.0-115.el7a.ppc64le.rpm
kernel-debuginfo-4.14.0-115.el7a.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.14.0-115.el7a.ppc64le.rpm
kernel-devel-4.14.0-115.el7a.ppc64le.rpm
kernel-headers-4.14.0-115.el7a.ppc64le.rpm
kernel-tools-4.14.0-115.el7a.ppc64le.rpm
kernel-tools-debuginfo-4.14.0-115.el7a.ppc64le.rpm
kernel-tools-libs-4.14.0-115.el7a.ppc64le.rpm
perf-4.14.0-115.el7a.ppc64le.rpm
perf-debuginfo-4.14.0-115.el7a.ppc64le.rpm
python-perf-4.14.0-115.el7a.ppc64le.rpm
python-perf-debuginfo-4.14.0-115.el7a.ppc64le.rpm

s390x:
kernel-4.14.0-115.el7a.s390x.rpm
kernel-debug-4.14.0-115.el7a.s390x.rpm
kernel-debug-debuginfo-4.14.0-115.el7a.s390x.rpm
kernel-debug-devel-4.14.0-115.el7a.s390x.rpm
kernel-debuginfo-4.14.0-115.el7a.s390x.rpm
kernel-debuginfo-common-s390x-4.14.0-115.el7a.s390x.rpm
kernel-devel-4.14.0-115.el7a.s390x.rpm
kernel-headers-4.14.0-115.el7a.s390x.rpm
kernel-kdump-4.14.0-115.el7a.s390x.rpm
kernel-kdump-debuginfo-4.14.0-115.el7a.s390x.rpm
kernel-kdump-devel-4.14.0-115.el7a.s390x.rpm
perf-4.14.0-115.el7a.s390x.rpm
perf-debuginfo-4.14.0-115.el7a.s390x.rpm
python-perf-4.14.0-115.el7a.s390x.rpm
python-perf-debuginfo-4.14.0-115.el7a.s390x.rpm

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7):

aarch64:
kernel-debug-debuginfo-4.14.0-115.el7a.aarch64.rpm
kernel-debuginfo-4.14.0-115.el7a.aarch64.rpm
kernel-debuginfo-common-aarch64-4.14.0-115.el7a.aarch64.rpm
kernel-tools-debuginfo-4.14.0-115.el7a.aarch64.rpm
kernel-tools-libs-devel-4.14.0-115.el7a.aarch64.rpm
perf-debuginfo-4.14.0-115.el7a.aarch64.rpm
python-perf-debuginfo-4.14.0-115.el7a.aarch64.rpm

noarch:
kernel-doc-4.14.0-115.el7a.noarch.rpm

ppc64le:
kernel-debug-debuginfo-4.14.0-115.el7a.ppc64le.rpm
kernel-debug-devel-4.14.0-115.el7a.ppc64le.rpm
kernel-debuginfo-4.14.0-115.el7a.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.14.0-115.el7a.ppc64le.rpm
kernel-tools-debuginfo-4.14.0-115.el7a.ppc64le.rpm
kernel-tools-libs-devel-4.14.0-115.el7a.ppc64le.rpm
perf-debuginfo-4.14.0-115.el7a.ppc64le.rpm
python-perf-debuginfo-4.14.0-115.el7a.ppc64le.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2017-13166
https://access.redhat.com/security/cve/CVE-2017-16648
https://access.redhat.com/security/cve/CVE-2017-17805
https://access.redhat.com/security/cve/CVE-2017-17806
https://access.redhat.com/security/cve/CVE-2017-18075
https://access.redhat.com/security/cve/CVE-2017-18208
https://access.redhat.com/security/cve/CVE-2017-18344
https://access.redhat.com/security/cve/CVE-2018-1065
https://access.redhat.com/security/cve/CVE-2018-1068
https://access.redhat.com/security/cve/CVE-2018-1092
https://access.redhat.com/security/cve/CVE-2018-1094
https://access.redhat.com/security/cve/CVE-2018-1095
https://access.redhat.com/security/cve/CVE-2018-1118
https://access.redhat.com/security/cve/CVE-2018-1120
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/cve/CVE-2018-5344
https://access.redhat.com/security/cve/CVE-2018-5390
https://access.redhat.com/security/cve/CVE-2018-5391
https://access.redhat.com/security/cve/CVE-2018-5750
https://access.redhat.com/security/cve/CVE-2018-5803
https://access.redhat.com/security/cve/CVE-2018-5848
https://access.redhat.com/security/cve/CVE-2018-7566
https://access.redhat.com/security/cve/CVE-2018-7757
https://access.redhat.com/security/cve/CVE-2018-8781
https://access.redhat.com/security/cve/CVE-2018-9363
https://access.redhat.com/security/cve/CVE-2018-10322
https://access.redhat.com/security/cve/CVE-2018-10877
https://access.redhat.com/security/cve/CVE-2018-10878
https://access.redhat.com/security/cve/CVE-2018-10879
https://access.redhat.com/security/cve/CVE-2018-10880
https://access.redhat.com/security/cve/CVE-2018-10881
https://access.redhat.com/security/cve/CVE-2018-10882
https://access.redhat.com/security/cve/CVE-2018-10883
https://access.redhat.com/security/cve/CVE-2018-10940
https://access.redhat.com/security/cve/CVE-2018-11506
https://access.redhat.com/security/cve/CVE-2018-12232
https://access.redhat.com/security/cve/CVE-2018-13405
https://access.redhat.com/security/cve/CVE-2018-14619
https://access.redhat.com/security/cve/CVE-2018-14641
https://access.redhat.com/security/cve/CVE-2018-1000026
https://access.redhat.com/security/cve/CVE-2018-1000200
https://access.redhat.com/security/cve/CVE-2018-1000204
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/articles/3553061
https://access.redhat.com/security/vulnerabilities/ssbd
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index
https://access.redhat.com/articles/3658021

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBW9gc9NzjgjWX9erEAQgGxA//b8LcMQbL3HI3jz1k0YMvfIVQZmlm6s9u
ZG8FOn14/Z6jYQxt6rER8sqwj8Lygl62A6+7q+U0xi+EYQRUl3vGTRXBaAQ240RI
Wff1owjpZqNUtLlxY5gT7sbaEK8nnUZ/dSbTYUy0z1xR2ql7Vfh7tPm7W71ly37S
ZghKqOhIhMWfMz2lq2avcfhWDiH8D3WVy9tT4brPyTkrcGOXkcY/B5SFlE9Q1Ek9
ExOchDcA6nIDr1evytmWUn7Z3F/CUXrEmY5NqvAPaHtTDqvpphW9F8vt5/qMMEI1
2ojA1Ad4CB6ZefCW4mskhsZJl/ItJcwYG5eEvrTK3hUToSQYsYz9PMcyYhNfhhvy
msyosSZNOgM7ZiBqcVW9R+IhYtbQFFHbq5a/9zhCgLQd0LDtP3GM65r/GYlQQICq
ymwtemcDc947qGL59G+UxQz43JWOlFNbAIr7oVNuox6GB25SkJRKT8IevtA5m9P4
E8qh2uMH7fIlvRQKwGTvxS03Uoc/ofuq0CSIfPHYrVXvPwAZ2GGAYx8Tixk4oYPH
uLi02oCafZJ1LDaEVhfHWWe76quBUAlhono08kFA2DwLf+iOIaqn39RRo5iS7tai
WkXSWDtg2WC6xUOlfa8EtreZXR2bpDqeMMoy3iR24W+oANY+R89oJBIZZbyqLvJ0
N9tKpG93dec=
=vCL1
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce