Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Red Hat Enterprise Linux 7 Kernel Update RHSA-2016:2574-02 Important DoS
red hat
November 3, 2016
An update for kernel is now available for Red Hat Enterprise Linux 7
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Summary
The kernel packages contain the Linux kernel, the core of any Linux
operating system.
Security Fix(es):
* It was found that the Linux kernel's IPv6 implementation mishandled
socket options. A local attacker could abuse concurrent access to the
socket options to escalate their privileges, or cause a denial of service
(use-after-free and system crash) via a crafted sendmsg system call.
(CVE-2016-3841, Important)
* Several Moderate and Low impact security issues were found in the Linux
kernel. Space precludes documenting each of these issues in this advisory.
Refer to the CVE links in the References section for a description of each
of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543,
CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069,
CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412,
CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327,
CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384,
CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)
Red Hat would like to thank Philip Pettersson (Samsung) for reporting
CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo
kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto
(HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by
Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845
issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the
CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the
CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the
CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.3 Release Notes linked from the References section.
Topics Covered
References
https://access.redhat.com/security/cve/CVE-2013-4312 https://access.redhat.com/security/cve/CVE-2015-8374 https://access.redhat.com/security/cve/CVE-2015-8543 https://access.redhat.com/security/cve/CVE-2015-8746 https://access.redhat.com/security/cve/CVE-2015-8812 https://access.redhat.com/security/cve/CVE-2015-8844 https://access.redhat.com/security/cve/CVE-2015-8845 https://access.redhat.com/security/cve/CVE-2015-8956 https://access.redhat.com/security/cve/CVE-2016-2053 https://access.redhat.com/security/cve/CVE-2016-2069 https://access.redhat.com/security/cve/CVE-2016-2117 https://access.redhat.com/security/cve/CVE-2016-2384 https://access.redhat.com/security/cve/CVE-2016-2847 https://access.redhat.com/security/cve/CVE-2016-3070 https://access.redhat.com/security/cve/CVE-2016-3156 https://access.redhat.com/security/cve/CVE-2016-3699 https://access.redhat.com/security/cve/CVE-2016-3841 https://access.redhat.com/security/cve/CVE-2016-4569 https://access.redhat.com/security/cve/CVE-2016-4578 https://access.redhat.com/security/cve/CVE-2016-4581 https://access.redhat.com/security/cve/CVE-2016-4794 https://access.redhat.com/security/cve/CVE-2016-5412 https://access.redhat.com/security/cve/CVE-2016-5828 https://access.redhat.com/security/cve/CVE-2016-5829 Read the Full Advisory
Package List
Red Hat Enterprise Linux Client (v. 7):
Source:
kernel-3.10.0-514.el7.src.rpm
noarch:
kernel-abi-whitelists-3.10.0-514.el7.noarch.rpm
kernel-doc-3.10.0-514.el7.noarch.rpm
x86_64:
kernel-3.10.0-514.el7.x86_64.rpm
kernel-debug-3.10.0-514.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-514.el7.x86_64.rpm
kernel-debug-devel-3.10.0-514.el7.x86_64.rpm
kernel-debuginfo-3.10.0-514.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-514.el7.x86_64.rpm
kernel-devel-3.10.0-514.el7.x86_64.rpm
kernel-headers-3.10.0-514.el7.x86_64.rpm
kernel-tools-3.10.0-514.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-514.el7.x86_64.rpm
kernel-tools-libs-3.10.0-514.el7.x86_64.rpm
perf-3.10.0-514.el7.x86_64.rpm
perf-debuginfo-3.10.0-514.el7.x86_64.rpm
python-perf-3.10.0-514.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-514.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
kernel-debug-debuginfo-3.10.0-514.el7.x86_64.rpm
kernel-debuginfo-3.10.0-514.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-514.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-514.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-514.el7.x86_64.rpm
perf-debuginfo-3.10.0-514.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-514.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
kernel-3.10.0-514.el7.src.rpm
Read the Full Advisory
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Advisory ID: RHSA-2016:2574-02
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2016:2574.html
Issue date: 2016-11-03
Topic
An update for kernel is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topics Covered
Relevant Releases Architectures
Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
Red Hat Enterprise Linux for Containers (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Bugs Fixed
1141249 - Xen guests may hang after migration or suspend/resume
1234586 - Backtrace after unclean shutdown with XFS v5 and project quotas
1267042 - XFS needs to better handle EIO and ENOSPC
1277863 - Test case failure: Screen - Resolution after no Screen Boot on Intel Valley View Gen7 [8086:0f31]
1278224 - panic in iscsi_target.c
1283341 - cannot mount RHEL7 NFS server with nfsvers=4.1,sec=krb5 but nfsvers=4.0,sec=krb5 works
1286261 - CVE-2015-8374 kernel: Information leak when truncating of compressed/inlined extents on BTRFS
1286500 - Tool thin_dump failing to show 'mappings'
1290475 - CVE-2015-8543 kernel: IPv6 connect causes DoS via NULL pointer dereference
1292481 - device mapper hung tasks on an openshift/docker system
1295802 - CVE-2015-8746 kernel: when NFSv4 migration is executed, kernel oops occurs at NFS client
1297813 - CVE-2013-4312 kernel: File descriptors passed over unix sockets are not properly accounted
1299662 - VFIO: include no-IOMMU mode - not supported
1300023 - soft lockup in nfs4_put_stid with 3.10.0-327.4.4.el7
1300237 - CVE-2016-2053 kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature()
1301893 - CVE-2016-2069 kernel: race condition in the TLB flush logic
1302166 - MAC address of VF is not editable even when attached to host
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!