RHSA-2016:0185 - Security Advisory

Topic

Updated kernel packages that fix two security issues and several bugs are
now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

• It was found that the Linux kernel's keys subsystem did not correctly

garbage collect uninstantiated keyrings. A local attacker could use this
flaw to crash the system or, potentially, escalate their privileges on the
system. (CVE-2015-7872, Important)

• A flaw was found in the way the Linux kernel handled IRET faults during

the processing of NMIs. An unprivileged, local user could use this flaw to
crash the system or, potentially (although highly unlikely), escalate their
privileges on the system. (CVE-2015-5157, Moderate)

This update also fixes the following bugs:

• Previously, processing packets with a lot of different IPv6 source

addresses caused the kernel to return warnings concerning soft-lockups due
to high lock contention and latency increase. With this update, lock
contention is reduced by backing off concurrent waiting threads on the
lock. As a result, the kernel no longer issues warnings in the described
scenario. (BZ#1285370)

• Prior to this update, block device readahead was artificially limited.

As a consequence, the read performance was poor, especially on RAID
devices. Now, per-device readahead limits are used for each device instead
of a global limit. As a result, read performance has improved, especially
on RAID devices. (BZ#1287550)

• After injecting an EEH error, the host was previously not recovering and

observing I/O hangs in HTX tool logs. This update makes sure that when one
or both of EEH_STATE_MMIO_ACTIVE and EEH_STATE_MMIO_ENABLED flags is marked
in the PE state, the PE's IO path is regarded as enabled as well. As a
result, the host no longer hangs and recovers as expected. (BZ#1289101)

• The genwqe device driver was previously using the GFP_ATOMIC flag for

allocating consecutive memory pages from the kernel's atomic memory pool,
even in non-atomic situations. This could lead to allocation failures
during memory pressure. With this update, the genwqe driver's memory
allocations use the GFP_KERNEL flag, and the driver can allocate memory
even during memory pressure situations. (BZ#1289450)

• The nx842 co-processor for IBM Power Systems could in some circumstances

provide invalid data due to a data corruption bug during uncompression.
With this update, all compression and uncompression calls to the nx842
co-processor contain a cyclic redundancy check (CRC) flag, which forces all
compression and uncompression operations to check data integrity and
prevents the co-processor from providing corrupted data. (BZ#1289451)

• A failed "updatepp" operation on the little-endian variant of IBM Power

Systems could previously cause a wrong hash value to be used for the next
hash insert operation in the page table. This could result in a missing
hash pte update or invalidate operation, potentially causing memory
corruption. With this update, the hash value is always recalculated after a
failed "updatepp" operation, avoiding memory corruption. (BZ#1289452)

• Large Receive Offload (LRO) flag disabling was not being propagated

downwards from above devices in vlan and bond hierarchy, breaking the flow
of traffic. This problem has been fixed and LRO flags now propagate
correctly. (BZ#1292072)

• Due to rounding errors in the CPU frequency of the intel_pstate driver,

the CPU frequency never reached the value requested by the user. A kernel
patch has been applied to fix these rounding errors. (BZ#1296276)

• When running several containers (up to 100), reports of hung tasks were

previously reported. This update fixes the AB-BA deadlock in the
dm_destroy() function, and the hung reports no longer occur. (BZ#1296566)

All kernel users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The system must be
rebooted for this update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.2 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.2 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.2 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.2 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.2 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - TUS 7.2 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.2 x86_64

Fixes

• BZ - 1259577 - CVE-2015-5157 kernel: x86-64: IRET faults during NMIs processing
• BZ - 1272371 - CVE-2015-7872 kernel: Keyrings crash triggerable by unprivileged user

CVEs

• CVE-2015-5157
• CVE-2015-7872

References

• http://www.redhat.com/security/updates/classification/#normal