Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
  • Products & Services

    Products

    Support

    • Production Support
    • Development Support
    • Product Life Cycles

    Services

    • Consulting
    • Technical Account Management
    • Training & Certifications

    Documentation

    • Red Hat Enterprise Linux
    • Red Hat JBoss Enterprise Application Platform
    • Red Hat OpenStack Platform
    • Red Hat OpenShift Container Platform
    All Documentation

    Ecosystem Catalog

    • Red Hat Partner Ecosystem
    • Partner Resources
  • Tools

    Tools

    • Troubleshoot a product issue
    • Packages
    • Errata

    Customer Portal Labs

    • Configuration
    • Deployment
    • Security
    • Troubleshoot
    All labs

    Red Hat Insights

    Increase visibility into IT operations to detect and resolve technical issues before they impact your business.

    Learn More
    Go to Insights
  • Security

    Red Hat Product Security Center

    Engage with our Red Hat Product Security team, access security updates, and ensure your environments are not exposed to any known security vulnerabilities.

    Product Security Center

    Security Updates

    • Security Advisories
    • Red Hat CVE Database
    • Security Labs

    Keep your systems secure with Red Hat's specialized responses to security vulnerabilities.

    View Responses

    Resources

    • Security Blog
    • Security Measurement
    • Severity Ratings
    • Backporting Policies
    • Product Signing (GPG) Keys
  • Community

    Customer Portal Community

    • Discussions
    • Private Groups
    Community Activity

    Customer Events

    • Red Hat Convergence
    • Red Hat Summit

    Stories

    • Red Hat Subscription Value
    • You Asked. We Acted.
    • Open Source Communities
Or troubleshoot an issue.

Select Your Language

  • English
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Integration
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
  • Red Hat JBoss Data Virtualization
  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager
All Products
Red Hat Product Errata RHSA-2016:0224 - Security Advisory
Issued:
2016-02-16
Updated:
2016-02-16

RHSA-2016:0224 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Important: kernel-rt security, bug fix, and enhancement update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated kernel-rt packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise MRG 2.5.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

  • It was found that the Linux kernel's keys subsystem did not correctly

garbage collect uninstantiated keyrings. A local attacker could use this
flaw to crash the system or, potentially, escalate their privileges on the
system. (CVE-2015-7872, Important)

  • A flaw was found in the way the Linux kernel handled IRET faults during

the processing of NMIs. An unprivileged, local user could use this flaw to
crash the system or, potentially (although highly unlikely), escalate their
privileges on the system. (CVE-2015-5157, Moderate)

This update provides a build of the kernel-rt package for Red Hat
Enterprise MRG 2.5 that is layered on Red Hat Enterprise Linux 6, and
provides a number of bug fixes and enhancements, including:

  • [md] dm: fix AB-BA deadlock in __dm_destroy()
  • [md] revert "dm-mpath: fix stalls when handling invalid ioctl
  • [cpufreq] intel_pstate: Fix limits->max_perf and limits->max_policy_pct

rounding errors

  • [cpufreq] revert "intel_pstate: fix rounding error in max_freq_pct"
  • [crypto] nx: 842 - Add CRC and validation support
  • [of] return NUMA_NO_NODE from fallback of_node_to_nid()

(BZ#1277670)

The HP Smart Array (hpsa) SCSI driver has been updated to the latest
version included in a Red Hat release. (BZ#1224096)

This update also fixes the following bugs:

  • A heavy load of incoming packets on a fast networking driver (like the

i40e) will both stress the softirq mechanism on the realtime kernel (as
described in BZ#1293229) and exercise the possible livelock in the netpoll
NAPI/busy polling routines (as described in BZ#1293230). The fixes applied
to both BZ#1293229 and BZ#1293230 will address these issues by hardening
the locking mechanism for the netpoll NAPI/busy polling and by enhancing
the way softirqs are serviced. These fixes also create a failsafe to
avoiding RCU stalls on a heavily loaded system and allows the networking
driver to work as expected. (BZ#1200766)

  • The nohz_full code in older versions of the MRG-Realtime kernels was

incomplete and known to be problematic due to the way the old
implementation interacted with the real time features in the kernel.
The nohz_full kernel code has been updated enabling this feature to
function as expected and allowing this feature to be enabled in the
realtime kernel. (BZ#1278511)

  • Because the realtime kernel replaces most of the spinlocks with

rtmutexes, the locking scheme used in both NAPI polling and busy polling
could become out of synchronization with the State Machine they protected.
This could cause system performance degradation or even a livelock
situation when a machine with faster NICs (10g or 40g) was subject to a
heavy pressure receiving network packets. The locking schemes on NAPI
polling and busy polling routines were hardened to enforce the State
machine sanity to help ensure the system continues to function properly
under pressure. (BZ#1295884)

  • A possible livelock in the NAPI polling and busy polling routines could

lead the system to a livelock on threads running at high, realtime,
priorities. The threads running at priorities lower than the ones of the
threads involved in the livelock would be prevented from running on the
CPUs affected by the livelock. Among those lower priority threads are the
rcuc/ threads. Right before (4 jiffies) a RCU stall is detected, the rcuc/
threads on the CPUs facing the livelock have their priorities boosted above
the priority of the threads involved in the livelock. The softirq code was
also updated to be more robust. These modifications allowed the rcuc/
threads to execute even under system pressure, mitigating the RCU stalls.
(BZ#1295885)

All kernel-rt users are advised to upgrade to these updated packages, which
correct these issues and add these enhancements. The system must be
rebooted for this update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • MRG Realtime 2 x86_64

Fixes

  • BZ - 1259577 - CVE-2015-5157 kernel: x86-64: IRET faults during NMIs processing
  • BZ - 1272371 - CVE-2015-7872 kernel: Keyrings crash triggerable by unprivileged user
  • BZ - 1277670 - update the MRG 2.5.x 3.10 kernel-rt sources
  • BZ - 1278511 - nohz_full still not working even with nohz=on

CVEs

  • CVE-2015-7872
  • CVE-2015-5157

References

  • https://access.redhat.com/security/updates/classification/#important
Note: More recent versions of these packages may be available. Click a package name for more details.

MRG Realtime 2

SRPM
kernel-rt-3.10.0-327.rt56.171.el6rt.src.rpm SHA-256: 54b611a8e8279310ef8b21e0302f8e6022e55689966e5f9d45474869eb5ff3b2
x86_64
kernel-rt-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 62b9b9232be88b7135b718d8f1dbc27dc01792e790d5003966e441d49c1dd66b
kernel-rt-debug-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: ebb4bebd54d467c4da0ee535338eefc65cfabc8de0df7d260264a77db317262b
kernel-rt-debug-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 097e823f52a8b4c7d94dab70d80726419272dc21470700167df2680d7d40ca84
kernel-rt-debug-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 417fcf68a8466f0991acfd677507205e0909ef1e09eff8c61d8e2d0533e976b0
kernel-rt-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 708c2c029dc0cfa59e911d0f5245419e940135b31a13e346e11721663e97540c
kernel-rt-debuginfo-common-x86_64-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: e807c6ae597a5b9fa7e7ef36d8cc634750ebe744e1ac2e87a687ce4d60889735
kernel-rt-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 5e6b2b9c26e246baaeeec2794d927247739d1b23cb5266a27ee719c17108dbfb
kernel-rt-doc-3.10.0-327.rt56.171.el6rt.noarch.rpm SHA-256: c8a799d03ad9e05232719092e72c0dc26f0ec50ea0c96eae19d5e692adffb446
kernel-rt-firmware-3.10.0-327.rt56.171.el6rt.noarch.rpm SHA-256: 62f280e7b312afcd909ae38b71ed51adf7f245160f77011f7c847c8a6cadf578
kernel-rt-trace-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 48179f05b10e13b72071f5a7f6e69b78a230fdd9fd63abc24d44630ae8d385f1
kernel-rt-trace-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: b1909e652a06560471b419943cb7ec7ca5297ebb5b4457f8c911989b062fd6d3
kernel-rt-trace-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 914e9076587f9d074ce09b132cc272c7761c866257f31be29932d54568f69506
kernel-rt-vanilla-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 3e291b6cfcae5a13a78c296b4fa1cc63a1c05cee2c54c797b50395739a015f0b
kernel-rt-vanilla-debuginfo-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 62b698f7584434f5c336eb5a15d3988f6ac2ee806405f1d97d4e3da7789fba93
kernel-rt-vanilla-devel-3.10.0-327.rt56.171.el6rt.x86_64.rpm SHA-256: 1d722b62dce78d1954bd3c13bd8ef6c9b399a77606cd8a7755abab48301f86a1

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

About

  • Red Hat Subscription Value
  • About Red Hat
  • Red Hat Jobs
Copyright © 2023 Red Hat, Inc.
  • Privacy Statement
  • Customer Portal Terms of Use
  • All Policies and Guidelines
Red Hat Summit
Twitter