-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2018:2785-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:2785 Issue date: 2018-09-25 CVE Names: CVE-2018-5390 CVE-2018-5391 CVE-2018-10675 ==================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7.3 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode EUS (v. 7.3) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3) - x86_64 Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 7.3) - ppc64, ppc64le, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port, thus the attacks cannot be performed using spoofed IP addresses. (CVE-2018-5390) * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391) * kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact (CVE-2018-10675) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and CVE-2018-5391. Bug Fix(es): * On systems running Red Hat Enterprise Linux 7 with Red Hat OpenShift Container Platform 3.5, a node sometimes got into "NodeNotReady" state after a CPU softlockup. Consequently, the node was not available. This update fixes an irq latency source in memory compaction. As a result, nodes no longer get into "NodeNotReady" state under the described circumstances. (BZ#1596281) * Previously, the kernel source code was missing support to report the Speculative Store Bypass Disable (SSBD) vulnerability status on IBM Power Systems and the little-endian variants of IBM Power Systems. As a consequence, the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file incorrectly reported "Not affected" on both CPU architectures. This fix updates the kernel source code to properly report the SSBD status either as "Vulnerable" or "Mitigation: Kernel entry/exit barrier (TYPE)" where TYPE is one of "eieio", "hwsync", "fallback", or "unknown". (BZ#1612351) * The hypervisors of Red Hat Enterprise Linux 7 virtual machines (VMs) in certain circumstances mishandled the microcode update in the kernel. As a consequence, the VMs sometimes became unresponsive when booting. This update applies an upstream patch to avoid early microcode update when running under a hypervisor. As a result, kernel hangs no longer occur in the described scenario. (BZ#1618388) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1575065 - CVE-2018-10675 kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact 1601704 - CVE-2018-5390 kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack) 1609664 - CVE-2018-5391 kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) 6. Package List: Red Hat Enterprise Linux ComputeNode EUS (v. 7.3): Source: kernel-3.10.0-514.58.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-514.58.1.el7.noarch.rpm kernel-doc-3.10.0-514.58.1.el7.noarch.rpm x86_64: kernel-3.10.0-514.58.1.el7.x86_64.rpm kernel-debug-3.10.0-514.58.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-514.58.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-514.58.1.el7.x86_64.rpm kernel-devel-3.10.0-514.58.1.el7.x86_64.rpm kernel-headers-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-514.58.1.el7.x86_64.rpm perf-3.10.0-514.58.1.el7.x86_64.rpm perf-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm python-perf-3.10.0-514.58.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3): x86_64: kernel-debug-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-514.58.1.el7.x86_64.rpm perf-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm Red Hat Enterprise Linux Server EUS (v. 7.3): Source: kernel-3.10.0-514.58.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-514.58.1.el7.noarch.rpm kernel-doc-3.10.0-514.58.1.el7.noarch.rpm ppc64: kernel-3.10.0-514.58.1.el7.ppc64.rpm kernel-bootwrapper-3.10.0-514.58.1.el7.ppc64.rpm kernel-debug-3.10.0-514.58.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm kernel-debug-devel-3.10.0-514.58.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-514.58.1.el7.ppc64.rpm kernel-devel-3.10.0-514.58.1.el7.ppc64.rpm kernel-headers-3.10.0-514.58.1.el7.ppc64.rpm kernel-tools-3.10.0-514.58.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm kernel-tools-libs-3.10.0-514.58.1.el7.ppc64.rpm perf-3.10.0-514.58.1.el7.ppc64.rpm perf-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm python-perf-3.10.0-514.58.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm ppc64le: kernel-3.10.0-514.58.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-514.58.1.el7.ppc64le.rpm kernel-debug-3.10.0-514.58.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-514.58.1.el7.ppc64le.rpm kernel-devel-3.10.0-514.58.1.el7.ppc64le.rpm kernel-headers-3.10.0-514.58.1.el7.ppc64le.rpm kernel-tools-3.10.0-514.58.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-514.58.1.el7.ppc64le.rpm perf-3.10.0-514.58.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm python-perf-3.10.0-514.58.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm s390x: kernel-3.10.0-514.58.1.el7.s390x.rpm kernel-debug-3.10.0-514.58.1.el7.s390x.rpm kernel-debug-debuginfo-3.10.0-514.58.1.el7.s390x.rpm kernel-debug-devel-3.10.0-514.58.1.el7.s390x.rpm kernel-debuginfo-3.10.0-514.58.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-514.58.1.el7.s390x.rpm kernel-devel-3.10.0-514.58.1.el7.s390x.rpm kernel-headers-3.10.0-514.58.1.el7.s390x.rpm kernel-kdump-3.10.0-514.58.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-514.58.1.el7.s390x.rpm kernel-kdump-devel-3.10.0-514.58.1.el7.s390x.rpm perf-3.10.0-514.58.1.el7.s390x.rpm perf-debuginfo-3.10.0-514.58.1.el7.s390x.rpm python-perf-3.10.0-514.58.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.s390x.rpm x86_64: kernel-3.10.0-514.58.1.el7.x86_64.rpm kernel-debug-3.10.0-514.58.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-514.58.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-514.58.1.el7.x86_64.rpm kernel-devel-3.10.0-514.58.1.el7.x86_64.rpm kernel-headers-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-514.58.1.el7.x86_64.rpm perf-3.10.0-514.58.1.el7.x86_64.rpm perf-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm python-perf-3.10.0-514.58.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional EUS (v. 7.3): ppc64: kernel-debug-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-514.58.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm kernel-tools-libs-devel-3.10.0-514.58.1.el7.ppc64.rpm perf-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.ppc64.rpm ppc64le: kernel-debug-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-514.58.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-514.58.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-514.58.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.ppc64le.rpm x86_64: kernel-debug-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-514.58.1.el7.x86_64.rpm perf-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-514.58.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-5390 https://access.redhat.com/security/cve/CVE-2018-5391 https://access.redhat.com/security/cve/CVE-2018-10675 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW6qe7NzjgjWX9erEAQjNbQ/+IKrFgUV0KKr007GhsyzJeLCUqTrNBcio bsIWQDFE/sV/deohMIBHybvxBeiZkUe8D+d/IcNS/0a1+jSNWytdahR8AO5PdjF1 QxXXnteY7glupPg7oBJzNVtrfWmvo6M7jH2U+EQ0w5agSIBQ+WFChXH5hMwXxx8f nW7hs3ToSWJyrAo6VRQ9IX3goBskn6qIcbTsp4lMNhGa1gQPOFvoT0DyK7V32TWT KmNAK13XYd8nP402PUUyN72HksPwW5fJNG5bQIYUp07WGOgiKt0X8vAgzaSX9srd LBxMG+TP8IJjrNe3RUC/kD3BJ+n7BYp0hnYr1y2k09qHDrDP7K0qP63fRBPQ+xPs 3gQmmz9AICgF+xA95onoREUJp6rqydFb92OsebwRb2aZ4ho084M7GTsKe7cZn4zL oUXFafA7Tjir+K0oyOLsAF/ieIvzHt35IJKFECXZuAuomgsTTh92DLnMurszyNmi IzIZbenNNhPV6qGLD1gANzvaaRKZNhJVh1DAZgWaMqOf/xZYE2n1mO8XAj5/m97T Sz4RCOUVFMTgcFAQFWv29uLtV0c8gd6X9QNiYeDGqoADskwGpSdBKuNlnHFaOv86 gWhCLv9cY+N8IbrjtSSugY6zzBStigEQ+2BSrqh7YvVjkRhpIqHql0yJzCknPtIh un3AsdlsrV4=O9gE -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce