-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: kernel-rt security, and enhancement update
Advisory ID:       RHSA-2018:2165-01
Product:           Red Hat Enterprise MRG for RHEL-6
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2165
Issue date:        2018-07-10
CVE Names:         CVE-2017-13305 CVE-2018-3665 
====================================================================
1. Summary:

Updated kernel-rt packages that fix two security issues and add one
enhancement are now available for Red Hat Enterprise MRG 2.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat MRG Realtime for RHEL 6 Server v.2 - noarch, x86_64

3. Description:

The kernel-rt packages provide the Real Time Linux Kernel, which enables
fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: Buffer over-read in keyring subsystem allows exposing potentially
sensitive information to local attacker (CVE-2017-13305)

* Kernel: FPU state information leakage via lazy FPU restore
(CVE-2018-3665)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank Julian Stecklina (Amazon.de), Thomas Prescher
(cyberus-technology.de), and Zdenek Sojka (sysgo.com) for reporting
CVE-2018-3665.

Enhancement(s):

* The kernel-rt packages have been upgraded to version
3.10.0-693.35.1.rt56.623, which provides a number of bug fixes over the
previous version. (BZ#1579972)

Users of kernel-rt are advised to upgrade to these updated packages, which
add this enhancement.

The system must be rebooted for this update to take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1579972 - Update the kernel-rt sources with the latest 3.10 sources.
1581637 - CVE-2017-13305 kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker
1585011 - CVE-2018-3665 Kernel: FPU state information leakage via lazy FPU restore

6. Package List:

Red Hat MRG Realtime for RHEL 6 Server v.2:

Source:
kernel-rt-3.10.0-693.35.1.rt56.625.el6rt.src.rpm

noarch:
kernel-rt-doc-3.10.0-693.35.1.rt56.625.el6rt.noarch.rpm
kernel-rt-firmware-3.10.0-693.35.1.rt56.625.el6rt.noarch.rpm

x86_64:
kernel-rt-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-debug-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-debug-debuginfo-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-debug-devel-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-debuginfo-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-devel-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-trace-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-trace-debuginfo-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-trace-devel-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-vanilla-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-vanilla-debuginfo-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
kernel-rt-vanilla-devel-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2017-13305
https://access.redhat.com/security/cve/CVE-2018-3665
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW0TqE9zjgjWX9erEAQgCcQ/+KZE3vwR2SxWBBAwuaxyydGRXAR5frynw
4ADYBgdV1mDFStGFp3Eby/Uble+NTha1GWwpk7lvWeouwalVxVhXadwQHPCxQueo
WpwgCWiMXfdV0SmhpUaX8PXC6cObebdKtLF5QR2M97oCHxz/G9SSrCYv1Exqz9CX
npGBmFQPwGTxrAfLxOd5UQ9K8qyRBVKxbFa07jKAXhYRM2lRzx9QV9PV9ffR+76X
e5Jqmlm8RazlzpWcHckeFY/BWfIZHhRBk5b4dqoEmSkgG+PdW8btvwZYgoRd0PNk
0he+LTXjBcEfAU3bzrbRWfjewEJ9h6kaMBc1Yc60e/LvZZc13kgUZRQb7aTyDfWg
o+HXuqHK2T1Dl5dvjOZJtbKiKYXy8eIYvYQysAoVZ3kJ6IgsiaM00Fb4Y62SAeX1
oMVHekIXBL7KbQsWFj2OLjJEpoD+UcBMnzribsWIIstL5kDtqumBcZUFEXV7svQu
3hWspmaFVag+ogf05uf8aAJhv6xqslyNZnvabwoUS4y6LDTtAHe2vtqpb87tf9YS
nl/Qk4+48e2MLk+v7y6WqJoo9dYfGGQ14vuavhVTERq5f9nBMUjognvbhztoe5dp
PFg76T0KuMj/+nSrkMexDqeKFOlA7D4hSNEcIk4wpNBLots8tVfmUg0fo39gewLA
nhJ7o32zOcM=qUb0
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2018-2165:01 Moderate: kernel-rt security,

Updated kernel-rt packages that fix two security issues and add one enhancement are now available for Red Hat Enterprise MRG 2

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker (CVE-2017-13305)
* Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Julian Stecklina (Amazon.de), Thomas Prescher (cyberus-technology.de), and Zdenek Sojka (sysgo.com) for reporting CVE-2018-3665.
Enhancement(s):
* The kernel-rt packages have been upgraded to version 3.10.0-693.35.1.rt56.623, which provides a number of bug fixes over the previous version. (BZ#1579972)
Users of kernel-rt are advised to upgrade to these updated packages, which add this enhancement.
The system must be rebooted for this update to take effect.



Summary


Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2017-13305 https://access.redhat.com/security/cve/CVE-2018-3665 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat MRG Realtime for RHEL 6 Server v.2:
Source: kernel-rt-3.10.0-693.35.1.rt56.625.el6rt.src.rpm
noarch: kernel-rt-doc-3.10.0-693.35.1.rt56.625.el6rt.noarch.rpm kernel-rt-firmware-3.10.0-693.35.1.rt56.625.el6rt.noarch.rpm
x86_64: kernel-rt-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-debug-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-debug-debuginfo-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-debug-devel-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-debuginfo-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-debuginfo-common-x86_64-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-devel-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-trace-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-trace-debuginfo-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-trace-devel-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-vanilla-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-vanilla-debuginfo-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm kernel-rt-vanilla-devel-3.10.0-693.35.1.rt56.625.el6rt.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2018:2165-01
Product: Red Hat Enterprise MRG for RHEL-6
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2165
Issued Date: : 2018-07-10
CVE Names: CVE-2017-13305 CVE-2018-3665

Topic

Updated kernel-rt packages that fix two security issues and add oneenhancement are now available for Red Hat Enterprise MRG 2.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat MRG Realtime for RHEL 6 Server v.2 - noarch, x86_64


Bugs Fixed

1579972 - Update the kernel-rt sources with the latest 3.10 sources.

1581637 - CVE-2017-13305 kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker

1585011 - CVE-2018-3665 Kernel: FPU state information leakage via lazy FPU restore


Related News