-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: kernel-rt security and bug fix update
Advisory ID:       RHSA-2019:1190-01
Product:           Red Hat Enterprise MRG for RHEL-6
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:1190
Issue date:        2019-05-14
CVE Names:         CVE-2016-7913 CVE-2016-8633 CVE-2017-11600 
                   CVE-2017-12190 CVE-2017-13215 CVE-2017-16939 
                   CVE-2017-17558 CVE-2018-1068 CVE-2018-3665 
                   CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 
                   CVE-2018-18559 CVE-2019-11091 
=====================================================================

1. Summary:

An update for kernel-rt is now available for Red Hat Enterprise MRG 2.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat MRG Realtime for RHEL 6 Server v.2 - noarch, x86_64

3. Description:

The kernel-rt packages provide the Real Time Linux Kernel, which enables
fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* A flaw was found in the implementation of the "fill buffer", a mechanism
used by modern CPUs when a cache-miss is made on L1 CPU cache. If an
attacker can generate a load operation that would create a page fault, the
execution will continue speculatively with incorrect data from the fill
buffer while the data is fetched from higher level caches. This response
time can be measured to infer data in the fill buffer. (CVE-2018-12130)

* Modern Intel microprocessors implement hardware-level micro-optimizations
to improve the performance of writing data back to CPU caches. The write
operation is split into STA (STore Address) and STD (STore Data)
sub-operations. These sub-operations allow the processor to hand-off
address generation logic into these sub-operations for optimized writes.
Both of these sub-operations write to a shared distributed processor
structure called the 'processor store buffer'. As a result, an unprivileged
attacker could use this flaw to read private data resident within the CPU's
processor store buffer. (CVE-2018-12126)

* Microprocessors use a ‘load port’ subcomponent to perform load operations
from memory or IO. During a load operation, the load port receives data
from the memory or IO subsystem and then provides the data to the CPU
registers and operations in the CPU’s pipelines. Stale load operations
results are stored in the 'load port' table until overwritten by newer
operations. Certain load-port operations triggered by an attacker can be
used to reveal data about previous stale requests leaking data back to the
attacker via a timing side-channel. (CVE-2018-12127)

* Uncacheable memory on some microprocessors utilizing speculative
execution may allow an authenticated user to potentially enable information
disclosure via a side channel with local access. (CVE-2019-11091)

* kernel: Buffer overflow in firewire driver via crafted incoming packets
(CVE-2016-8633)

* kernel: crypto: privilege escalation in skcipher_recvmsg function
(CVE-2017-13215)

* Kernel: ipsec: xfrm: use-after-free leading to potential privilege
escalation (CVE-2017-16939)

* kernel: Out-of-bounds write via userland offsets in ebt_entry struct in
netfilter/ebtables.c (CVE-2018-1068)

* kernel: Use-after-free due to race condition in AF_PACKET implementation
(CVE-2018-18559)

* kernel: media: use-after-free in [tuner-xc2028] media driver
(CVE-2016-7913)

* kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
(CVE-2017-11600)

* kernel: memory leak when merging buffers in SCSI IO vectors
(CVE-2017-12190)

* kernel: Unallocated memory access by malicious USB device via
bNumInterfaces overflow (CVE-2017-17558)

* Kernel: FPU state information leakage via lazy FPU restore
(CVE-2018-3665)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* update the MRG 2.5.z 3.10 kernel-rt sources (BZ#1692711)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1391490 - CVE-2016-8633 kernel: Buffer overflow in firewire driver via crafted incoming packets
1402885 - CVE-2016-7913 kernel: media: use-after-free in [tuner-xc2028] media driver
1474928 - CVE-2017-11600 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
1495089 - CVE-2017-12190 kernel: memory leak when merging buffers in SCSI IO vectors
1517220 - CVE-2017-16939 Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation
1525474 - CVE-2017-17558 kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow
1535173 - CVE-2017-13215 kernel: crypto: privilege escalation in skcipher_recvmsg function
1552048 - CVE-2018-1068 kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c
1585011 - CVE-2018-3665 Kernel: FPU state information leakage via lazy FPU restore
1641878 - CVE-2018-18559 kernel: Use-after-free due to race condition in AF_PACKET implementation
1646781 - CVE-2018-12126 hardware: Microarchitectural Store Buffer Data Sampling (MSBDS)
1646784 - CVE-2018-12130 hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS)
1667782 - CVE-2018-12127 hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS)
1692711 - update the MRG 2.5.z 3.10 kernel-rt sources
1705312 - CVE-2019-11091 hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

6. Package List:

Red Hat MRG Realtime for RHEL 6 Server v.2:

Source:
kernel-rt-3.10.0-693.47.2.rt56.641.el6rt.src.rpm

noarch:
kernel-rt-doc-3.10.0-693.47.2.rt56.641.el6rt.noarch.rpm
kernel-rt-firmware-3.10.0-693.47.2.rt56.641.el6rt.noarch.rpm

x86_64:
kernel-rt-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-debug-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-debug-debuginfo-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-debug-devel-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-debuginfo-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-devel-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-trace-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-trace-debuginfo-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-trace-devel-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-vanilla-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-vanilla-debuginfo-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm
kernel-rt-vanilla-devel-3.10.0-693.47.2.rt56.641.el6rt.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-7913
https://access.redhat.com/security/cve/CVE-2016-8633
https://access.redhat.com/security/cve/CVE-2017-11600
https://access.redhat.com/security/cve/CVE-2017-12190
https://access.redhat.com/security/cve/CVE-2017-13215
https://access.redhat.com/security/cve/CVE-2017-16939
https://access.redhat.com/security/cve/CVE-2017-17558
https://access.redhat.com/security/cve/CVE-2018-1068
https://access.redhat.com/security/cve/CVE-2018-3665
https://access.redhat.com/security/cve/CVE-2018-12126
https://access.redhat.com/security/cve/CVE-2018-12127
https://access.redhat.com/security/cve/CVE-2018-12130
https://access.redhat.com/security/cve/CVE-2018-18559
https://access.redhat.com/security/cve/CVE-2019-11091
https://access.redhat.com/security/vulnerabilities/mds
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXNsknNzjgjWX9erEAQjpAQ/9HuV7LWnQ41hASz4HSbew0m6Pg5mLLrXz
zr8VoS3lTX2DLT34YwnOIuFhb+iJd8ky1qbjP9xBqnX66e2WHDeoTIfCM+bxSkKo
gEM6CcheaOar+5HUORbjVnG7MQzcUpNzzGlD/CH37nNkTfNSA5zYFbtW5kOb2ULP
v5jekOtNOKn87uEz3WNJD5EHwrP8JNGeVIped2GT/vNfcJsHtTUElP+J15zbzlE8
4XiNu2yKEJowKrzlk5VlJH9cfwyoy++hrknVPuSnc1dXqxIjeyGGGgmlDqeyLKqg
BpDLP/MsFBKcOm+xwGx52a1f7TRZ1uznmSThI5RyqJS0Gg1805Z/aFlfhcqBSJn4
osk1Q/WbdRSaK4wW229Pd66BPF7p9C81k9Q0/AUqQpmoxj7kdvHQ3jWhOGfuoDOn
pXXfv2VALdE1Pcc7CmqR+g0aEOI0DJ2by4zRs10yIKBHgCRLuksZIMfCAexrQcmu
XiB2GmezJFw9ViF6/RFxScbNpiLtPSyocbswXSaCPeGq7MFzY2aVSRBaP9xfuXrJ
61/6202eRs8ey+BxYOTbYRikeTX7ZaNvqxZFlqaiUpEew5GuIZZSeszK+fRudNxd
uRfBFjmTHYOzD4s+aLIh9t2NJkDr+SIUKea9Wpg4B7QJG8AyW7aiQd+MvfNZqCB3
8rHiMppn5pQ=
=EOJK
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce