Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.0270
Important: kernel-rt security and bug fix update
29 January 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: kernel-rt
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Server 7
Impact/Access: Root Compromise -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-15649 CVE-2017-7472 CVE-2015-8539
Reference: ESB-2018.0252
ESB-2018.0102
ESB-2018.0057
ESB-2016.1078
ESB-2016.0821
Original Bulletin:
https://access.redhat.com/errata/RHSA-2018:0152
https://access.redhat.com/errata/RHSA-2018:0181
Comment: This bulletin contains two (2) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: kernel-rt security and bug fix update
Advisory ID: RHSA-2018:0152-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:0152
Issue date: 2018-01-25
CVE Names: CVE-2015-8539 CVE-2017-7472 CVE-2017-15649
=====================================================================
1. Summary:
An update for kernel-rt is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Realtime (v. 7) - noarch, x86_64
Red Hat Enterprise Linux for Real Time for NFV (v. 7) - noarch, x86_64
3. Description:
The kernel-rt packages provide the Real Time Linux Kernel, which enables
fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* A flaw was found in the Linux kernel's key management system where it was
possible for an attacker to escalate privileges or crash the machine. If a
user key gets negatively instantiated, an error code is cached in the
payload area. A negatively instantiated key may be then be positively
instantiated by updating it with valid data. However, the ->update key type
method must be aware that the error code may be there. (CVE-2015-8539,
Important)
* It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux
kernel, before version 4.13.6, allows local users to gain privileges via
crafted system calls that trigger mishandling of packet_fanout data
structures, because of a race condition (involving fanout_add and
packet_do_bind) that leads to a use-after-free bug. (CVE-2017-15649,
Important)
* A vulnerability was found in the Linux kernel where the
keyctl_set_reqkey_keyring() function leaks the thread keyring. This allows
an unprivileged local user to exhaust kernel memory and thus cause a DoS.
(CVE-2017-7472, Moderate)
Red Hat would like to thank Dmitry Vyukov of Google engineering for
reporting CVE-2015-8539.
Bug Fix(es):
* The kernel-rt packages have been upgraded to 3.10.0-693.15.1 source tree,
which provides a number of bug fixes over the previous version.
(BZ#1519506)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1284450 - CVE-2015-8539 kernel: local privesc in key management
1442086 - CVE-2017-7472 kernel: keyctl_set_reqkey_keyring() leaks thread keyrings
1504574 - CVE-2017-15649 kernel: Use-after-free in the af_packet.c
1519506 - kernel-rt: update to the RHEL7.4.z batch#4 source tree
6. Package List:
Red Hat Enterprise Linux for Real Time for NFV (v. 7):
Source:
kernel-rt-3.10.0-693.17.1.rt56.636.el7.src.rpm
noarch:
kernel-rt-doc-3.10.0-693.17.1.rt56.636.el7.noarch.rpm
x86_64:
kernel-rt-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debug-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debug-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debug-devel-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debug-kvm-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debug-kvm-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-devel-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-kvm-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-kvm-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-trace-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-trace-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-trace-devel-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-trace-kvm-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-trace-kvm-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
Red Hat Enterprise Linux Realtime (v. 7):
Source:
kernel-rt-3.10.0-693.17.1.rt56.636.el7.src.rpm
noarch:
kernel-rt-doc-3.10.0-693.17.1.rt56.636.el7.noarch.rpm
x86_64:
kernel-rt-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debug-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debug-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debug-devel-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-devel-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-trace-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-trace-debuginfo-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
kernel-rt-trace-devel-3.10.0-693.17.1.rt56.636.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2015-8539
https://access.redhat.com/security/cve/CVE-2017-7472
https://access.redhat.com/security/cve/CVE-2017-15649
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFaab8nXlSAg2UNWIIRAmOZAJ9KftM3RBpeAG5F6HeCRWQVFrNefwCgjk2u
60Wo1hZen+Hjf68frzLxmYM=
=MsCT
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: kernel-rt security and bug fix update
Advisory ID: RHSA-2018:0181-01
Product: Red Hat Enterprise MRG for RHEL-6
Advisory URL: https://access.redhat.com/errata/RHSA-2018:0181
Issue date: 2018-01-25
CVE Names: CVE-2015-8539 CVE-2017-7472 CVE-2017-15649
=====================================================================
1. Summary:
An update for kernel-rt is now available for Red Hat Enterprise MRG 2.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat MRG Realtime for RHEL 6 Server v.2 - noarch, x86_64
3. Description:
The kernel-rt packages provide the Real Time Linux Kernel, which enables
fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* A flaw was found in the Linux kernel's key management system where it was
possible for an attacker to escalate privileges or crash the machine. If a
user key gets negatively instantiated, an error code is cached in the
payload area. A negatively instantiated key may be then be positively
instantiated by updating it with valid data. However, the ->update key type
method must be aware that the error code may be there. (CVE-2015-8539,
Important)
* It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux
kernel, before version 4.13.6, allows local users to gain privileges via
crafted system calls that trigger mishandling of packet_fanout data
structures, because of a race condition (involving fanout_add and
packet_do_bind) that leads to a use-after-free bug. (CVE-2017-15649,
Important)
* A vulnerability was found in the Linux kernel where the
keyctl_set_reqkey_keyring() function leaks the thread keyring. This allows
an unprivileged local user to exhaust kernel memory and thus cause a DoS.
(CVE-2017-7472, Moderate)
Red Hat would like to thank Dmitry Vyukov of Google engineering for
reporting CVE-2015-8539.
Bug Fix(es):
* The mlx5 driver has a number of configuration options, including the
selective support for network protocols, such as InfiniBand and Ethernet.
Due to a regression in the configuration of the MRG-RT kernel, the Ethernet
mode of the driver was turned off. The regression has been resolved by
enabling the mlx5 Ethernet mode, making the Ethernet protocol to work
again. (BZ#1422778)
* The migrate_disable/enable() kernel operations are used to pin a thread
to a CPU temporarily. This method is a kernel-rt specific. To keep
RHEL-RT's kernel up-to-date with the latest real-time kernel, the
migrate_disable/enable routine was updated to the version present on kernel
v4.9-rt. However, this version showed to be problematic. The changes in the
migrate_disable/enabled have been thus reverted to a stable version,
avoiding the kernel BUG. (BZ#1507831)
* The kernel-rt packages have been upgraded to version
3.10.0-693.15.1.rt56.601, which provides a number of security and bug fixes
over the previous version. (BZ#1519504)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1284450 - CVE-2015-8539 kernel: local privesc in key management
1422778 - [mlx5] Failed to create device for nic_driver mlx5_core
1442086 - CVE-2017-7472 kernel: keyctl_set_reqkey_keyring() leaks thread keyrings
1504574 - CVE-2017-15649 kernel: Use-after-free in the af_packet.c
1519504 - update the MRG 2.5.z 3.10 kernel-rt sources
6. Package List:
Red Hat MRG Realtime for RHEL 6 Server v.2:
Source:
kernel-rt-3.10.0-693.17.1.rt56.604.el6rt.src.rpm
noarch:
kernel-rt-doc-3.10.0-693.17.1.rt56.604.el6rt.noarch.rpm
kernel-rt-firmware-3.10.0-693.17.1.rt56.604.el6rt.noarch.rpm
x86_64:
kernel-rt-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-debug-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-debug-debuginfo-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-debug-devel-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-debuginfo-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-devel-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-trace-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-trace-debuginfo-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-trace-devel-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-vanilla-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-vanilla-debuginfo-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
kernel-rt-vanilla-devel-3.10.0-693.17.1.rt56.604.el6rt.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2015-8539
https://access.redhat.com/security/cve/CVE-2017-7472
https://access.redhat.com/security/cve/CVE-2017-15649
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFaab+eXlSAg2UNWIIRAmu+AKCsRug1IDvuiGJefiRVOk97r5FliwCeOuJ/
2EAhyWCqeNnyRw0UvHMp3qc=
=ZfP2
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWm5vwIx+lLeg9Ub1AQjyGw//bX/ZTMGJrJDNFmhUqBnCGW4+2zGxnV4l
ipzC0NZODQEH3RbcvyCNa56x+ijg4CpoYZ6qH4JKB+FRIMRh0FYpYNvXXQZUCLNH
Ug6fwXvlcKYuOlyT1hrHRJIhe1sATmI3lfAho3J0kGpxN3Ag5j4DgaXLmo9lw6DI
JnH9wL38vJlozeGetAmOllPALoMRj1Lt/Pwi8qaVQB6udLDjnZu8u7IrDC0VJR9X
K2cHlwC09rTRnCddE3jBDgMzmW+TUZDNqkFGefE2KP6pqZ+6pa9ZfEl1/9kxsKX6
+CsTn7Eyq3MEqsi4MCKf304FksXDWVaO0o0vucWH0AMxkUvyXD3PjutHZk8tfmUQ
GelLrZ96RlFwTTfU72ju1Gn/jSGFH0CqJtXwloWpINkyLm9JtlH7vpdOUk7hmV7Y
z4vQ6qLp9Y7FHp692Bp6HFpgsOk05kh+gbTPStDF6YtDL0a8RwwvLRPTAe0/JAq5
YNwqCtucWHnwOZ2o+zomOzTI9ef8pn7qmgD2xFchVSWgDZAgOjgT6RLgTaTwBNUF
Li31+HUKdNUGofmGrixFTJMCTZ52TLmMAj3RAxHh7cldsq6SVI2u8ZDr6ywOJXPM
4UnC5vFyLUFRW/HirZf32tqRkZjj/iRsmw3w+bfvElQJC3x8frABe9Nf4wtrTgWK
2ut48qDQmjc=
=2H3P
-----END PGP SIGNATURE-----