-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: kernel-rt security, bug fix, and enhancement update
Advisory ID:       RHSA-2018:3096-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3096
Issue date:        2018-10-30
CVE Names:         CVE-2015-8830 CVE-2016-4913 CVE-2017-0861 
                   CVE-2017-10661 CVE-2017-17805 CVE-2017-18208 
                   CVE-2017-18232 CVE-2017-18344 CVE-2018-1092 
                   CVE-2018-1094 CVE-2018-1118 CVE-2018-1120 
                   CVE-2018-1130 CVE-2018-5344 CVE-2018-5391 
                   CVE-2018-5803 CVE-2018-5848 CVE-2018-7740 
                   CVE-2018-7757 CVE-2018-8781 CVE-2018-10322 
                   CVE-2018-10878 CVE-2018-10879 CVE-2018-10881 
                   CVE-2018-10883 CVE-2018-10902 CVE-2018-10940 
                   CVE-2018-13405 CVE-2018-1000026 
====================================================================
1. Summary:

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux for Real Time (v. 7) - noarch, x86_64
Red Hat Enterprise Linux for Real Time for NFV (v. 7) - noarch, x86_64

3. Description:

The kernel-rt packages provide the Real Time Linux Kernel, which enables
fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* A flaw named FragmentSmack was found in the way the Linux kernel handled
reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use
this flaw to trigger time and calculation expensive fragment reassembly
algorithm by sending specially crafted packets which could lead to a CPU
saturation and hence a denial of service on the system. (CVE-2018-5391)

* kernel: out-of-bounds access in the show_timer function in
kernel/time/posix-timers.c (CVE-2017-18344)

* kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute
code in kernel space (CVE-2018-8781)

* kernel: MIDI driver race condition leads to a double-free
(CVE-2018-10902)

* kernel: Missing check in inode_init_owner() does not clear SGID bit on
non-directories for non-members (CVE-2018-13405)

* kernel: AIO write triggers integer overflow in some protocols
(CVE-2015-8830)

* kernel: Use-after-free in snd_pcm_info function in ALSA subsystem
potentially leads to privilege escalation (CVE-2017-0861)

* kernel: Handling of might_cancel queueing is not properly pretected
against race (CVE-2017-10661)

* kernel: Salsa20 encryption algorithm does not correctly handle
zero-length inputs allowing local attackers to cause denial of service
(CVE-2017-17805)

* kernel: Inifinite loop vulnerability in madvise_willneed() function
allows local denial of service (CVE-2017-18208)

* kernel: fuse-backed file mmap-ed onto process cmdline arguments causes
denial of service (CVE-2018-1120)

* kernel: a null pointer dereference in dccp_write_xmit() leads to a system
crash (CVE-2018-1130)

* kernel: drivers/block/loop.c mishandles lo_release serialization allowing
denial of service (CVE-2018-5344)

* kernel: Missing length check of payload in _sctp_make_chunk() function
allows denial of service (CVE-2018-5803)

* kernel: buffer overflow in
drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory
corruption (CVE-2018-5848)

* kernel: out-of-bound write in ext4_init_block_bitmap function with a
crafted ext4 image (CVE-2018-10878)

* kernel: Improper validation in bnx2x network card driver can allow for
denial of service attacks via crafted packet (CVE-2018-1000026)

* kernel: Information leak when handling NM entries containing NUL
(CVE-2016-4913)

* kernel: Mishandling mutex within libsas allowing local Denial of Service
(CVE-2017-18232)

* kernel: NULL pointer dereference in ext4_process_freed_data() when
mounting crafted ext4 image (CVE-2018-1092)

* kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash
with crafted ext4 image (CVE-2018-1094)

* kernel: vhost: Information disclosure in vhost.c:vhost_new_msg()
(CVE-2018-1118)

* kernel: Denial of service in resv_map_release function in mm/hugetlb.c
(CVE-2018-7740)

* kernel: Memory leak in the sas_smp_get_phy_events function in
drivers/scsi/libsas/sas_expander.c (CVE-2018-7757)

* kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when
mounting crafted xfs image allowing denial of service (CVE-2018-10322)

* kernel: use-after-free detected in ext4_xattr_set_entry with a crafted
file (CVE-2018-10879)

* kernel: out-of-bound access in ext4_get_group_info() when mounting and
operating a crafted ext4 image (CVE-2018-10881)

* kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function
(CVE-2018-10883)

* kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c
(CVE-2018-10940)

Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department
of Communications and Networking and Nokia Bell Labs) for reporting
CVE-2018-5391; Trend Micro Zero Day Initiative for reporting
CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120; Evgenii
Shatokhin (Virtuozzo Team) for reporting CVE-2018-1130; and Wen Xu for
reporting CVE-2018-1092 and CVE-2018-1094.

4. Solution:

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.6 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1314275 - CVE-2015-8830 kernel: AIO write triggers integer overflow in some protocols
1337528 - CVE-2016-4913 kernel: Information leak when handling NM entries containing NUL
1481136 - CVE-2017-10661 kernel: Handling of might_cancel queueing is not properly pretected against race
1510602 - locking: bring in upstream PREEMPT_RT rtlock patches to fix single-reader limitation
1512875 - WARNING: CPU: 7 PID: 1090 at drivers/target/target_core_transport.c:3009 __transport_check_aborted_status+0x153/0x190 [target_core_mod]
1528312 - CVE-2017-17805 kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service
1533909 - CVE-2018-5344 kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial-of-service
1541846 - CVE-2018-1000026 kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via crafted packet
1551051 - CVE-2018-5803 kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service
1551565 - CVE-2017-18208 kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service
1552867 - CVE-2018-7740 kernel: Denial of service in resv_map_release function in mm/hugetlb.c
1553351 - RT: update kernel-rt source tree to match RHEL 7.6 tree
1553361 - CVE-2018-7757 kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c
1558066 - CVE-2017-18232 kernel: Mishandling mutex within libsas allowing local Denial of Service
1560777 - CVE-2018-1092 kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image
1560788 - CVE-2018-1094 kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
1563994 - CVE-2017-0861 kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege escalation
1569910 - Call Trace shows in guest when running determine_maximum_mpps.sh
1571062 - CVE-2018-8781 kernel: Integer overflow in drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() can allow attackers to execute code in kernel space
1571623 - CVE-2018-10322 kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image allowing denial of service
1573699 - CVE-2018-1118 kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg()
1575472 - CVE-2018-1120 kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service
1576419 - CVE-2018-1130 kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash
1577408 - CVE-2018-10940 kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c
1590720 - CVE-2018-10902 kernel: MIDI driver race condition leads to a double-free
1590799 - CVE-2018-5848 kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory corruption
1596802 - CVE-2018-10878 kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image
1596806 - CVE-2018-10879 kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file
1596828 - CVE-2018-10881 kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image
1596846 - CVE-2018-10883 kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function
1599161 - CVE-2018-13405 kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members1608672 - RT system hang due to wrong of rq's nr_running
1609664 - CVE-2018-5391 kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack)
1610958 - CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c

6. Package List:

Red Hat Enterprise Linux for Real Time for NFV (v. 7):

Source:
kernel-rt-3.10.0-957.rt56.910.el7.src.rpm

noarch:
kernel-rt-doc-3.10.0-957.rt56.910.el7.noarch.rpm

x86_64:
kernel-rt-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debug-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debug-debuginfo-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debug-devel-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debug-kvm-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debug-kvm-debuginfo-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debuginfo-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-devel-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-kvm-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-kvm-debuginfo-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-trace-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-trace-debuginfo-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-trace-devel-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-trace-kvm-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-trace-kvm-debuginfo-3.10.0-957.rt56.910.el7.x86_64.rpm

Red Hat Enterprise Linux for Real Time (v. 7):

Source:
kernel-rt-3.10.0-957.rt56.910.el7.src.rpm

noarch:
kernel-rt-doc-3.10.0-957.rt56.910.el7.noarch.rpm

x86_64:
kernel-rt-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debug-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-debug-devel-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-devel-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-trace-3.10.0-957.rt56.910.el7.x86_64.rpm
kernel-rt-trace-devel-3.10.0-957.rt56.910.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-8830
https://access.redhat.com/security/cve/CVE-2016-4913
https://access.redhat.com/security/cve/CVE-2017-0861
https://access.redhat.com/security/cve/CVE-2017-10661
https://access.redhat.com/security/cve/CVE-2017-17805
https://access.redhat.com/security/cve/CVE-2017-18208
https://access.redhat.com/security/cve/CVE-2017-18232
https://access.redhat.com/security/cve/CVE-2017-18344
https://access.redhat.com/security/cve/CVE-2018-1092
https://access.redhat.com/security/cve/CVE-2018-1094
https://access.redhat.com/security/cve/CVE-2018-1118
https://access.redhat.com/security/cve/CVE-2018-1120
https://access.redhat.com/security/cve/CVE-2018-1130
https://access.redhat.com/security/cve/CVE-2018-5344
https://access.redhat.com/security/cve/CVE-2018-5391
https://access.redhat.com/security/cve/CVE-2018-5803
https://access.redhat.com/security/cve/CVE-2018-5848
https://access.redhat.com/security/cve/CVE-2018-7740
https://access.redhat.com/security/cve/CVE-2018-7757
https://access.redhat.com/security/cve/CVE-2018-8781
https://access.redhat.com/security/cve/CVE-2018-10322
https://access.redhat.com/security/cve/CVE-2018-10878
https://access.redhat.com/security/cve/CVE-2018-10879
https://access.redhat.com/security/cve/CVE-2018-10881
https://access.redhat.com/security/cve/CVE-2018-10883
https://access.redhat.com/security/cve/CVE-2018-10902
https://access.redhat.com/security/cve/CVE-2018-10940
https://access.redhat.com/security/cve/CVE-2018-13405
https://access.redhat.com/security/cve/CVE-2018-1000026
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/articles/3553061
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.6_Release_Notes/index.html

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW9gRpNzjgjWX9erEAQim6xAAl0my7Mu97zvsTFUj9Tq4Lpj7kJ2fkPcW
4GfKQWeJwCBY3LAeeRFvaU0v7eHA7ddI3hXC0sRLRfz53aebtq/hG126VvRo3jMD
fEO0m5s49sNazMKYlnYGhca8/XTzuyS5ar44rIBgeJ2p4aUzhk8G3Oi8sDYLXElq
bMs1va0oB4vwqqcY+Oc9XB6Wg4t1+OrsmBlm9+Wqeu4qt9R2f9B31TMcBIlNqr+M
fH2hSKw/G/E0KL7ODK4LkyP5d9i9GW/GuCdF3QMPv/2rVwI0OpK4wVxOAQJ4o8/Q
U0tqAVCLkn2i5qZ5Y1x0+9OdTnHIfZnypJeZ+VWD4Y0PKcokNFYu7FBbcMfQBCkg
7xD0PTPjayeilUsNlRYIXFjmUQ9n+UGJEuP0LhJ6150zuSvPJl15FS6IMkAk6bYr
3u3I1ZTcPiCm/7oiC9MHnjIiuld8UgsILkYvG3xK9QMnhl41r/Nr4jb2vtrDgw5R
e9GF4vwievFDmp7tnENUHrL7VgAZ0jS07fyi3IRl/YbaJX8IuUGhMv08GCbb7qgr
DuTLLTlU0wvLaJ6qNU01RAeYz7GZiJYRrPdRhGgxSnNWcIULy4PRSk9Zd1tlflBP
cAOPIHJV2Kf3kKj/wIVs2WzcSV2uEKY1EW4vptl5t5jX1ZUUtHFL0tpFFjJkJGD1
lq8DIVubbnc=1RFn
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce