Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

RedHat: RHSA-2019-0512-01 Important: Kernel Security Issues and Fixes

red hat
Calendar Grey March 13, 2019
Dist Redhat Esm H88
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ====================================================
An update for kernel is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)
* kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks (CVE-2018-17972)
* kernel: Faulty computation of numberic bounds in the BPF verifier (CVE-2018-18445)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es) and Enhancement(s):
* kernel fuse invalidates cached attributes during reads (BZ#1657921)
* [NetApp-FC-NVMe] RHEL7.6: nvme reset gets hung indefinitely (BZ#1659937)
* Memory reclaim deadlock calling __sock_create() after memalloc_noio_save() (BZ#1660392)
* hardened usercopy is causing crash (BZ#1660815)
* Backport: xfrm: policy: init locks early (BZ#1660887)
* AWS m5 instance type loses NVMe mounted volumes [was: Unable to Mount StatefulSet PV in AWS EBS] (BZ#1661947)
* RHEL 7.6 running on a VirtualBox guest with a GUI has a mouse problem (BZ#1662848)
* Kernel bug report in cgroups on heavily contested 3.10 node (BZ#1663114)
* [PCIe] SHPC probe crash on Non-ACPI/Non-SHPC ports (BZ#1663241)
* [Cavium 7.7 Feat] qla2xxx: Update to latest upstream. (BZ#1663508)
* Regression in lpfc and the CNE1000 (BE2 FCoE) adapters that no longer initialize (BZ#1664067)
* [csiostor] call trace after command: modprobe csiostor (BZ#1665370)
* libceph: fall back to sendmsg for slab pages (BZ#1665814)
* Deadlock between stop_one_cpu_nowait() and stop_two_cpus() (BZ#1667328)
* Soft lockups occur when the sd driver passes a device size of 1 sector to string_get_size() (BZ#1667989)
* [RHEL7.7] BUG: unable to handle kernel paging request at ffffffffffffffff (BZ#1668208)
* RHEL7.6 - powerpc/pseries: Disable CPU hotplug across migrations / powerpc/rtas: Fix a potential race between CPU-Offline & Migration (LPM) (BZ#1669044)
* blk-mq: fix corruption with direct issue (BZ#1670511)
* [RHEL7][patch] iscsi driver can block reboot/shutdown (BZ#1670680)
* [DELL EMC 7.6 BUG] Unable to create-namespace over Dell NVDIMM-N (BZ#1671743)
* efi_bgrt_init fails to ioremap error during boot (BZ#1671745)
* Unable to mount a share on kernel- 3.10.0-957.el7. The share can be mounted on kernel-3.10.0-862.14.4.el7 (BZ#1672448)
* System crash with RIP nfs_readpage_async+0x43 -- BUG: unable to handle kernel NULL pointer dereference (BZ#1672510)
Users of kernel are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

References

https://access.redhat.com/security/cve/CVE-2018-9568 https://access.redhat.com/security/cve/CVE-2018-17972 https://access.redhat.com/security/cve/CVE-2018-18445 https://access.redhat.com/security/updates/classification#important

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: kernel-3.10.0-957.10.1.el7.src.rpm
noarch: kernel-abi-whitelists-3.10.0-957.10.1.el7.noarch.rpm kernel-doc-3.10.0-957.10.1.el7.noarch.rpm
x86_64: bpftool-3.10.0-957.10.1.el7.x86_64.rpm kernel-3.10.0-957.10.1.el7.x86_64.rpm kernel-debug-3.10.0-957.10.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-957.10.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-957.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-957.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-957.10.1.el7.x86_64.rpm kernel-devel-3.10.0-957.10.1.el7.x86_64.rpm kernel-headers-3.10.0-957.10.1.el7.x86_64.rpm kernel-tools-3.10.0-957.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-957.10.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-957.10.1.el7.x86_64.rpm perf-3.10.0-957.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-957.10.1.el7.x86_64.rpm python-perf-3.10.0-957.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-957.10.1.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: kernel-debug-debuginfo-3.10.0-957.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-957.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-957.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-957.10.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-957.10.1.el7.x86_64.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2019:0512-01
Product: Red Hat Enterprise Linux
Issue date: 2019-03-13

Topic

An update for kernel is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Bugs Fixed

1636349 - CVE-2018-17972 kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks

1640596 - CVE-2018-18445 kernel: Faulty computation of numberic bounds in the BPF verifier

1655904 - CVE-2018-9568 kernel: Memory corruption due to incorrect socket cloning

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here