Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2014.1208 Important: kernel-rt security update 23 July 2014 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kernel-rt Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 6 Impact/Access: Root Compromise -- Existing Account Access Privileged Data -- Existing Account Denial of Service -- Remote/Unauthenticated Read-only Data Access -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2014-4699 CVE-2014-4667 CVE-2014-4027 CVE-2014-3940 CVE-2014-3917 CVE-2014-3153 CVE-2014-3145 CVE-2014-3144 CVE-2014-0206 CVE-2014-0181 Reference: ESB-2014.1183 ESB-2014.1085 ESB-2014.1062 ESB-2014.1044 ESB-2014.1028 ESB-2014.1006 ESB-2014.0967 ESB-2014.0894.2 ESB-2014.0893 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2014-0913.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel-rt security update Advisory ID: RHSA-2014:0913-01 Product: Red Hat Enterprise MRG for RHEL-6 Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0913.html Issue date: 2014-07-22 CVE Names: CVE-2014-0181 CVE-2014-0206 CVE-2014-3144 CVE-2014-3145 CVE-2014-3153 CVE-2014-3917 CVE-2014-3940 CVE-2014-4027 CVE-2014-4667 CVE-2014-4699 ===================================================================== 1. Summary: Updated kernel-rt packages that fix multiple security issues are now available for Red Hat Enterprise MRG 2.5. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: MRG Realtime for RHEL 6 Server v.2 - noarch, x86_64 3. Description: The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-3153, Important) * It was found that the Linux kernel's ptrace subsystem allowed a traced process' instruction pointer to be set to a non-canonical memory address without forcing the non-sysret code path when returning to user space. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-4699, Important) Note: The CVE-2014-4699 issue only affected systems using an Intel CPU. * It was found that the permission checks performed by the Linux kernel when a netlink message was received were not sufficient. A local, unprivileged user could potentially bypass these restrictions by passing a netlink socket as stdout or stderr to a more privileged process and altering the output of this process. (CVE-2014-0181, Moderate) * It was found that the aio_read_events_ring() function of the Linux kernel's Asynchronous I/O (AIO) subsystem did not properly sanitize the AIO ring head received from user space. A local, unprivileged user could use this flaw to disclose random parts of the (physical) memory belonging to the kernel and/or other processes. (CVE-2014-0206, Moderate) * An out-of-bounds memory access flaw was found in the Netlink Attribute extension of the Berkeley Packet Filter (BPF) interpreter functionality in the Linux kernel's networking implementation. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space via a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145, Moderate) * An out-of-bounds memory access flaw was found in the Linux kernel's system call auditing implementation. On a system with existing audit rules defined, a local, unprivileged user could use this flaw to leak kernel memory to user space or, potentially, crash the system. (CVE-2014-3917, Moderate) * A flaw was found in the way Linux kernel's Transparent Huge Pages (THP) implementation handled non-huge page migration. A local, unprivileged user could use this flaw to crash the kernel by migrating transparent hugepages. (CVE-2014-3940, Moderate) * An integer underflow flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation processed certain COOKIE_ECHO packets. By sending a specially crafted SCTP packet, a remote attacker could use this flaw to prevent legitimate connections to a particular SCTP server socket to be made. (CVE-2014-4667, Moderate) * An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp) backend driver of the iSCSI Target subsystem of the Linux kernel. A privileged user could use this flaw to leak the contents of kernel memory to an iSCSI initiator remote client. (CVE-2014-4027, Low) Red Hat would like to thank Kees Cook of Google for reporting CVE-2014-3153, Andy Lutomirski for reporting CVE-2014-4699 and CVE-2014-0181, and Gopal Reddy Kodudula of Nokia Siemens Networks for reporting CVE-2014-4667. Google acknowledges Pinkie Pie as the original reporter of CVE-2014-3153. The CVE-2014-0206 issue was discovered by Mateusz Guzik of Red Hat. Users are advised to upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.10.33-rt32.43 and correct these issues. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system. 5. Bugs fixed (https://bugzilla.redhat.com/): 1094265 - CVE-2014-0181 kernel: net: insufficient permision checks of netlink messages 1094602 - CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring() 1096775 - CVE-2014-3144 CVE-2014-3145 Kernel: filter: prevent nla extensions to peek beyond the end of the message 1102571 - CVE-2014-3917 kernel: DoS with syscall auditing 1103626 - CVE-2014-3153 kernel: futex: pi futexes requeue issue 1104097 - CVE-2014-3940 Kernel: missing check during hugepage migration 1108744 - CVE-2014-4027 Kernel: target/rd: imformation leakage 1113967 - CVE-2014-4667 kernel: sctp: sk_ack_backlog wrap-around problem 1115927 - CVE-2014-4699 kernel: x86_64: ptrace: sysret to non-canonical address 6. Package List: MRG Realtime for RHEL 6 Server v.2: Source: kernel-rt-3.10.33-rt32.43.el6rt.src.rpm noarch: kernel-rt-doc-3.10.33-rt32.43.el6rt.noarch.rpm kernel-rt-firmware-3.10.33-rt32.43.el6rt.noarch.rpm x86_64: kernel-rt-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-debug-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-debug-debuginfo-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-debug-devel-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-debuginfo-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-debuginfo-common-x86_64-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-devel-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-trace-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-trace-debuginfo-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-trace-devel-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-vanilla-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-vanilla-debuginfo-3.10.33-rt32.43.el6rt.x86_64.rpm kernel-rt-vanilla-devel-3.10.33-rt32.43.el6rt.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-0181.html https://www.redhat.com/security/data/cve/CVE-2014-0206.html https://www.redhat.com/security/data/cve/CVE-2014-3144.html https://www.redhat.com/security/data/cve/CVE-2014-3145.html https://www.redhat.com/security/data/cve/CVE-2014-3153.html https://www.redhat.com/security/data/cve/CVE-2014-3917.html https://www.redhat.com/security/data/cve/CVE-2014-3940.html https://www.redhat.com/security/data/cve/CVE-2014-4027.html https://www.redhat.com/security/data/cve/CVE-2014-4667.html https://www.redhat.com/security/data/cve/CVE-2014-4699.html https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTzronXlSAg2UNWIIRArVpAKCkgJOnYjb7yjtHsGw5upf04nuVCgCdHPgl t/C/rKSGYdFAx2jHSiE4s7U= =JzfF - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBU88LZhLndAQH1ShLAQIzqw/+OayAasc0DZShG+QYDVdbMPu4s4xECvNv wUDEiXqyVehDMJCRR1ZBCT6OF8HtAMfXlzZj3tRX2ca5qg0pto2P4KAPaeGD7Ubr u48nZ0dbJSRDkgxg/xmvagvQ4rnuwwO6h5QD6sv466FLlL5CG8SnJJ0b0pkaRomM 6TvUx9ag4CqGrmBFlmYlOXKFk/yEKXYZxYMNyC5Nbda1Fme6yT/TeIXd20cNo6cx TzYrkxGutI/EAUoOX3Rnjn7uZ7jbHpk244LUQ5M6zvmUFSVGL34TSLSLBGBpTNer JyqsksBrjOG+5SEZK8n8kzkFtEE6WjpT6mpOvd6dFLtclMLPuuyAfjwuk48+oYL4 qFWDx2kCRXT1WsbHP9o1sAmZREMIaEKy6u16dvMNE1CV10R0cM2V2Ze5B3+9489Q w1GBWGv6VJWynKmlE8oIZq88YRw22ZM/OWh51Vs4yB6B2YNnv9AXIYUguXgpyFVI E9CbW5yvhr0MPM/yDyokBDCtzd9RCB1+aWs9wuXRK3Xgzw6qdKBBvNF6LfrDg6IV TcNwUi5w1/MWJwkTvGKFybMpHszvmWb/EVsl4Gr696wJ/VP0jTDPLL3yuCa1+jC8 98X8hamSzUce7SOKt89gsmoQ8ZcYfegbQ0S9otuwzkFzCmA6gubkz4rSDVMkl/c0 TiHYkzxfK0Q= =ZpPj -----END PGP SIGNATURE-----