Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 516
Alerts This Week
Warning Icon 1 516

RedHat: RHSA-2019-2865-01 Important: kpatch-patch Buffer Overflow Risk

red hat
Calendar Grey September 23, 2019
Dist Redhat Esm H88
Important kpatch patch update for RHEL-7.6 assessed as substantial, addressing a critical buffer overflow vulnerability that impacts security.
An update for kpatch-patch is now available for RHEL-7.6

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel.
Security Fix(es):
* A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host. (CVE-2019-14835)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory buffer overflow kernel patch Red Hat Enterprise Linux important kpatch

References

https://access.redhat.com/security/cve/CVE-2019-14835 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/kernel-vhost

Package List

Red Hat Enterprise Linux Server EUS (v. 7.6):
Source: kpatch-patch-3_10_0-957_35_1-1-1.el7.src.rpm
ppc64le: kpatch-patch-3_10_0-957_35_1-1-1.el7.ppc64le.rpm kpatch-patch-3_10_0-957_35_1-debuginfo-1-1.el7.ppc64le.rpm
x86_64: kpatch-patch-3_10_0-957_35_1-1-1.el7.x86_64.rpm kpatch-patch-3_10_0-957_35_1-debuginfo-1-1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2019:2865-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2865
Issue date: 2019-09-23

Topic

An update for kpatch-patch is now available for RHEL-7.6.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory buffer overflow kernel patch Red Hat Enterprise Linux important kpatch

Relevant Releases Architectures

Red Hat Enterprise Linux Server EUS (v. 7.6) - ppc64le, x86_64

Bugs Fixed

1750727 - CVE-2019-14835 kernel: vhost-net: guest to host kernel escape during migration

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.