Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2016.0388 Important: kernel security updates 17 February 2016 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kernel kernel-rt Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 7 Red Hat Enterprise Linux WS/Desktop 7 Red Hat Enterprise Linux Server 6 Impact/Access: Root Compromise -- Existing Account Denial of Service -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2015-7872 CVE-2015-5157 Reference: ESB-2015.3143 ESB-2015.2806.2 ESB-2015.1942 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2016-0185.html https://rhn.redhat.com/errata/RHSA-2016-0212.html https://rhn.redhat.com/errata/RHSA-2016-0224.html Comment: This bulletin contains three (3) Red Hat security advisories. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2016:0185-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-0185.html Issue date: 2016-02-16 CVE Names: CVE-2015-5157 CVE-2015-7872 ===================================================================== 1. Summary: Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. * It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2015-7872, Important) * A flaw was found in the way the Linux kernel handled IRET faults during the processing of NMIs. An unprivileged, local user could use this flaw to crash the system or, potentially (although highly unlikely), escalate their privileges on the system. (CVE-2015-5157, Moderate) This update also fixes the following bugs: * Previously, processing packets with a lot of different IPv6 source addresses caused the kernel to return warnings concerning soft-lockups due to high lock contention and latency increase. With this update, lock contention is reduced by backing off concurrent waiting threads on the lock. As a result, the kernel no longer issues warnings in the described scenario. (BZ#1285370) * Prior to this update, block device readahead was artificially limited. As a consequence, the read performance was poor, especially on RAID devices. Now, per-device readahead limits are used for each device instead of a global limit. As a result, read performance has improved, especially on RAID devices. (BZ#1287550) * After injecting an EEH error, the host was previously not recovering and observing I/O hangs in HTX tool logs. This update makes sure that when one or both of EEH_STATE_MMIO_ACTIVE and EEH_STATE_MMIO_ENABLED flags is marked in the PE state, the PE's IO path is regarded as enabled as well. As a result, the host no longer hangs and recovers as expected. (BZ#1289101) * The genwqe device driver was previously using the GFP_ATOMIC flag for allocating consecutive memory pages from the kernel's atomic memory pool, even in non-atomic situations. This could lead to allocation failures during memory pressure. With this update, the genwqe driver's memory allocations use the GFP_KERNEL flag, and the driver can allocate memory even during memory pressure situations. (BZ#1289450) * The nx842 co-processor for IBM Power Systems could in some circumstances provide invalid data due to a data corruption bug during uncompression. With this update, all compression and uncompression calls to the nx842 co-processor contain a cyclic redundancy check (CRC) flag, which forces all compression and uncompression operations to check data integrity and prevents the co-processor from providing corrupted data. (BZ#1289451) * A failed "updatepp" operation on the little-endian variant of IBM Power Systems could previously cause a wrong hash value to be used for the next hash insert operation in the page table. This could result in a missing hash pte update or invalidate operation, potentially causing memory corruption. With this update, the hash value is always recalculated after a failed "updatepp" operation, avoiding memory corruption. (BZ#1289452) * Large Receive Offload (LRO) flag disabling was not being propagated downwards from above devices in vlan and bond hierarchy, breaking the flow of traffic. This problem has been fixed and LRO flags now propagate correctly. (BZ#1292072) * Due to rounding errors in the CPU frequency of the intel_pstate driver, the CPU frequency never reached the value requested by the user. A kernel patch has been applied to fix these rounding errors. (BZ#1296276) * When running several containers (up to 100), reports of hung tasks were previously reported. This update fixes the AB-BA deadlock in the dm_destroy() function, and the hung reports no longer occur. (BZ#1296566) All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1259577 - CVE-2015-5157 kernel: x86-64: IRET faults during NMIs processing 1272371 - CVE-2015-7872 kernel: Keyrings crash triggerable by unprivileged user 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: kernel-3.10.0-327.10.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-327.10.1.el7.noarch.rpm kernel-doc-3.10.0-327.10.1.el7.noarch.rpm x86_64: kernel-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm kernel-devel-3.10.0-327.10.1.el7.x86_64.rpm kernel-headers-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-327.10.1.el7.x86_64.rpm perf-3.10.0-327.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm python-perf-3.10.0-327.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-327.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: kernel-3.10.0-327.10.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-327.10.1.el7.noarch.rpm kernel-doc-3.10.0-327.10.1.el7.noarch.rpm x86_64: kernel-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm kernel-devel-3.10.0-327.10.1.el7.x86_64.rpm kernel-headers-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-327.10.1.el7.x86_64.rpm perf-3.10.0-327.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm python-perf-3.10.0-327.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-327.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: kernel-3.10.0-327.10.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-327.10.1.el7.noarch.rpm kernel-doc-3.10.0-327.10.1.el7.noarch.rpm ppc64: kernel-3.10.0-327.10.1.el7.ppc64.rpm kernel-bootwrapper-3.10.0-327.10.1.el7.ppc64.rpm kernel-debug-3.10.0-327.10.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm kernel-debug-devel-3.10.0-327.10.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-327.10.1.el7.ppc64.rpm kernel-devel-3.10.0-327.10.1.el7.ppc64.rpm kernel-headers-3.10.0-327.10.1.el7.ppc64.rpm kernel-tools-3.10.0-327.10.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm kernel-tools-libs-3.10.0-327.10.1.el7.ppc64.rpm perf-3.10.0-327.10.1.el7.ppc64.rpm perf-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm python-perf-3.10.0-327.10.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm ppc64le: kernel-3.10.0-327.10.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-327.10.1.el7.ppc64le.rpm kernel-debug-3.10.0-327.10.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-327.10.1.el7.ppc64le.rpm kernel-devel-3.10.0-327.10.1.el7.ppc64le.rpm kernel-headers-3.10.0-327.10.1.el7.ppc64le.rpm kernel-tools-3.10.0-327.10.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-327.10.1.el7.ppc64le.rpm perf-3.10.0-327.10.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm python-perf-3.10.0-327.10.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm s390x: kernel-3.10.0-327.10.1.el7.s390x.rpm kernel-debug-3.10.0-327.10.1.el7.s390x.rpm kernel-debug-debuginfo-3.10.0-327.10.1.el7.s390x.rpm kernel-debug-devel-3.10.0-327.10.1.el7.s390x.rpm kernel-debuginfo-3.10.0-327.10.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-327.10.1.el7.s390x.rpm kernel-devel-3.10.0-327.10.1.el7.s390x.rpm kernel-headers-3.10.0-327.10.1.el7.s390x.rpm kernel-kdump-3.10.0-327.10.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-327.10.1.el7.s390x.rpm kernel-kdump-devel-3.10.0-327.10.1.el7.s390x.rpm perf-3.10.0-327.10.1.el7.s390x.rpm perf-debuginfo-3.10.0-327.10.1.el7.s390x.rpm python-perf-3.10.0-327.10.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.s390x.rpm x86_64: kernel-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm kernel-devel-3.10.0-327.10.1.el7.x86_64.rpm kernel-headers-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-327.10.1.el7.x86_64.rpm perf-3.10.0-327.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm python-perf-3.10.0-327.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: kernel-debug-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-327.10.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm kernel-tools-libs-devel-3.10.0-327.10.1.el7.ppc64.rpm perf-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.ppc64.rpm ppc64le: kernel-debug-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-327.10.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-327.10.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-327.10.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.ppc64le.rpm x86_64: kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-327.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: kernel-3.10.0-327.10.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-327.10.1.el7.noarch.rpm kernel-doc-3.10.0-327.10.1.el7.noarch.rpm x86_64: kernel-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm kernel-devel-3.10.0-327.10.1.el7.x86_64.rpm kernel-headers-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-327.10.1.el7.x86_64.rpm perf-3.10.0-327.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm python-perf-3.10.0-327.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: kernel-debug-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-327.10.1.el7.x86_64.rpm perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.10.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5157 https://access.redhat.com/security/cve/CVE-2015-7872 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWwyLbXlSAg2UNWIIRAgxrAKCtgSp0IG2VRgkKgqz9sZZG53TswgCfapXF 7d2BElAqDl89HA698MnHeP0= =0swE - -----END PGP SIGNATURE----- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel-rt security, bug fix, and enhancement update Advisory ID: RHSA-2016:0212-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-0212.html Issue date: 2016-02-16 CVE Names: CVE-2015-5157 CVE-2015-7872 ===================================================================== 1. Summary: Updated kernel-rt packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Realtime (v. 7) - noarch, x86_64 3. Description: The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. * It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2015-7872, Important) * A flaw was found in the way the Linux kernel handled IRET faults during the processing of NMIs. An unprivileged, local user could use this flaw to crash the system or, potentially (although highly unlikely), escalate their privileges on the system. (CVE-2015-5157, Moderate) The kernel-rt packages have been upgraded to version 3.10.0-327.10.1, which provides a number of bug fixes and enhancements, including: * [md] dm: fix AB-BA deadlock in __dm_destroy() * [md] revert "dm-mpath: fix stalls when handling invalid ioctl * [cpufreq] intel_pstate: Fix limits->max_perf and limits->max_policy_pct rounding errors * [cpufreq] revert "intel_pstate: fix rounding error in max_freq_pct" * [crypto] nx: 842 - Add CRC and validation support * [of] return NUMA_NO_NODE from fallback of_node_to_nid() (BZ#1282591) This update also fixes the following bugs: * Because the realtime kernel replaces most of the spinlocks with rtmutexes, the locking scheme used in both NAPI polling and busy polling could become out of synchronization with the State Machine they protected. This could cause system performance degradation or even a livelock situation when a machine with faster NICs (10g or 40g) was subject to a heavy pressure receiving network packets. The locking schemes on NAPI polling and busy polling routines have been hardened to enforce the State machine sanity to help ensure the system continues to function properly under pressure. (BZ#1293230) * A possible livelock in the NAPI polling and busy polling routines could lead the system to a livelock on threads running at high, realtime, priorities. The threads running at priorities lower than the ones of the threads involved in the livelock were prevented from running on the CPUs affected by the livelock. Among those lower priority threads are the rcuc/ threads. With this update, right before (4 jiffies) a RCU stall is detected, the rcuc/ threads on the CPUs facing the livelock have their priorities boosted above the priority of the threads involved in the livelock. The softirq code has also been updated to be more robust. These modifications allow the rcuc/ threads to execute even under system pressure, mitigating the RCU stalls. (BZ#1293229) * Multiple CPUs trying to take an rq lock previously caused large latencies on machines with many CPUs. On systems with more than 32 cores, this update uses the "push" rather than "pull" approach and provides multiple changes to the scheduling of rq locks. As a result, machines no longer suffer from multiplied latencies on large CPU systems. (BZ#1282597) * Previously, the SFC driver for 10 GB cards executed polling in NAPI mode, using a locking mechanism similar to a "trylock". Consequently, when running on a Realtime kernel, a livelock could occur. This update modifies the locking mechanism so that once the lock is taken it is not released until the operation is complete. (BZ#1282609) All kernel-rt users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1259577 - CVE-2015-5157 kernel: x86-64: IRET faults during NMIs processing 1272371 - CVE-2015-7872 kernel: Keyrings crash triggerable by unprivileged user 1282591 - kernel-rt: update to the RHEL7.2.z batch 2 source tree 1293229 - RCU stalls message on realtime kernel 1293230 - rt: netpoll: live lock with NAPI polling and busy polling on realtime kernel 6. Package List: Red Hat Enterprise Linux Realtime (v. 7): Source: kernel-rt-3.10.0-327.10.1.rt56.211.el7_2.src.rpm noarch: kernel-rt-doc-3.10.0-327.10.1.rt56.211.el7_2.noarch.rpm x86_64: kernel-rt-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-debug-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-debug-debuginfo-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-debug-devel-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-debuginfo-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-debuginfo-common-x86_64-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-devel-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-trace-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-trace-debuginfo-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm kernel-rt-trace-devel-3.10.0-327.10.1.rt56.211.el7_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5157 https://access.redhat.com/security/cve/CVE-2015-7872 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWwyQ1XlSAg2UNWIIRAk6uAJ4kyBoHx56B7UyvOzVpWglSftM3qACgjsLj xbmYnoygGvrnJ0orjtnWTlw= =vq1c - -----END PGP SIGNATURE----- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel-rt security, bug fix, and enhancement update Advisory ID: RHSA-2016:0224-01 Product: Red Hat Enterprise MRG for RHEL-6 Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-0224.html Issue date: 2016-02-16 CVE Names: CVE-2015-5157 CVE-2015-7872 ===================================================================== 1. Summary: Updated kernel-rt packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.5. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: MRG Realtime for RHEL 6 Server v.2 - noarch, x86_64 3. Description: The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. * It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2015-7872, Important) * A flaw was found in the way the Linux kernel handled IRET faults during the processing of NMIs. An unprivileged, local user could use this flaw to crash the system or, potentially (although highly unlikely), escalate their privileges on the system. (CVE-2015-5157, Moderate) This update provides a build of the kernel-rt package for Red Hat Enterprise MRG 2.5 that is layered on Red Hat Enterprise Linux 6, and provides a number of bug fixes and enhancements, including: * [md] dm: fix AB-BA deadlock in __dm_destroy() * [md] revert "dm-mpath: fix stalls when handling invalid ioctl * [cpufreq] intel_pstate: Fix limits->max_perf and limits->max_policy_pct rounding errors * [cpufreq] revert "intel_pstate: fix rounding error in max_freq_pct" * [crypto] nx: 842 - Add CRC and validation support * [of] return NUMA_NO_NODE from fallback of_node_to_nid() (BZ#1277670) The HP Smart Array (hpsa) SCSI driver has been updated to the latest version included in a Red Hat release. (BZ#1224096) This update also fixes the following bugs: * A heavy load of incoming packets on a fast networking driver (like the i40e) will both stress the softirq mechanism on the realtime kernel (as described in BZ#1293229) and exercise the possible livelock in the netpoll NAPI/busy polling routines (as described in BZ#1293230). The fixes applied to both BZ#1293229 and BZ#1293230 will address these issues by hardening the locking mechanism for the netpoll NAPI/busy polling and by enhancing the way softirqs are serviced. These fixes also create a failsafe to avoiding RCU stalls on a heavily loaded system and allows the networking driver to work as expected. (BZ#1200766) * The nohz_full code in older versions of the MRG-Realtime kernels was incomplete and known to be problematic due to the way the old implementation interacted with the real time features in the kernel. The nohz_full kernel code has been updated enabling this feature to function as expected and allowing this feature to be enabled in the realtime kernel. (BZ#1278511) * Because the realtime kernel replaces most of the spinlocks with rtmutexes, the locking scheme used in both NAPI polling and busy polling could become out of synchronization with the State Machine they protected. This could cause system performance degradation or even a livelock situation when a machine with faster NICs (10g or 40g) was subject to a heavy pressure receiving network packets. The locking schemes on NAPI polling and busy polling routines were hardened to enforce the State machine sanity to help ensure the system continues to function properly under pressure. (BZ#1295884) * A possible livelock in the NAPI polling and busy polling routines could lead the system to a livelock on threads running at high, realtime, priorities. The threads running at priorities lower than the ones of the threads involved in the livelock would be prevented from running on the CPUs affected by the livelock. Among those lower priority threads are the rcuc/ threads. Right before (4 jiffies) a RCU stall is detected, the rcuc/ threads on the CPUs facing the livelock have their priorities boosted above the priority of the threads involved in the livelock. The softirq code was also updated to be more robust. These modifications allowed the rcuc/ threads to execute even under system pressure, mitigating the RCU stalls. (BZ#1295885) All kernel-rt users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1259577 - CVE-2015-5157 kernel: x86-64: IRET faults during NMIs processing 1272371 - CVE-2015-7872 kernel: Keyrings crash triggerable by unprivileged user 1277670 - update the MRG 2.5.x 3.10 kernel-rt sources 1278511 - nohz_full still not working even with nohz=on 6. Package List: MRG Realtime for RHEL 6 Server v.2: Source: kernel-rt-3.10.0-327.rt56.171.el6rt.src.rpm noarch: kernel-rt-doc-3.10.0-327.rt56.171.el6rt.noarch.rpm kernel-rt-firmware-3.10.0-327.rt56.171.el6rt.noarch.rpm x86_64: kernel-rt-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-debug-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-debug-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-debug-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-debuginfo-common-x86_64-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-trace-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-trace-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-trace-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-vanilla-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-vanilla-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm kernel-rt-vanilla-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5157 https://access.redhat.com/security/cve/CVE-2015-7872 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWw0bFXlSAg2UNWIIRAhJ9AJ4me67AcalhWd+KUtQ/e/Z/SNvkGACeLayE OVmcF/3wKbUMhuleb6PXFcs= =XMP8 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBVsO64X6ZAP0PgtI9AQLlzBAAgei2MqAoflc6DzhsldP/a3qyZO9IlOdB YhhyD5nhzaSYpg6GP8m0r8DFY01wQ/t0aZn2rkfwE6EP7YiR53+/1HrwzI1l/PVC 6FSlN9wJbBMKBfarqzV7BNUSlLy9m7Io2BzFp2cnvyYTRtI2s+scLV/meBsEbvHn tXnwPg7rwRon6uxtanUmOeWgQayPfNnwboNnVWGE8heJWCaaWdp74rYhBIO+jZc4 BFRc9OOwQH71L7Hx0ZiBfK2uSPKCLX+Ar6gnhY1WDhyE50tSPa2zmBYz9rLJTToY jp89Yr4nWFA1ng5asuMZxaTMIQvXuP3aO78A9fJkiwE9vdCruX2BnNGXWvccoDqq H9W0q0rbJ2L5v2XVIjMcP5h6ZJI9vEhxPFS8lCiO7m4fzAeczxfHnBz1yPYu4m4F Gc10O+bvIpJAChFqBZ/+awYdtfrulpE7MhEv2umnYWrX3X5i0DQD9TukxVdJgsN1 n3dF4u7FZLt6Lj0xpAPneI7fWvC3ywNcjKWGZqwnwpkBt1z4DHuugPFMO7rDweRV GZgSD7EAcIw8xEPcC2WwMPkKuFKd7VXiG04absZ2afbzaz5uF61L0yDdn8dqXjv1 54d+UplHtiV7Lm9Fox8NxD6yheg78Pg+sONc1PHBPkqE3U0LPTr5v+Cb0oUBfidb AtL9AhbQhiM= =Esoz -----END PGP SIGNATURE-----