Synopsis

Important: realtime-kernel security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel-rt is now available for Red Hat Enterprise MRG 2.5.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

It was found that the RFC 5961 challenge ACK rate limiting as implemented
in the Linux kernel's networking subsystem allowed an off-path attacker to
leak certain information about a given connection by creating congestion on
the global challenge ACK rate limit counter and then measuring the changes
by probing packets. An off-path attacker could use this flaw to either
terminate TCP connection and/or inject payload into non-secured TCP
connection between two endpoints on the network. (CVE-2016-5696, Important)

Red Hat would like to thank Yue Cao from Cyber Security Group in the CS
department of University of California, Riverside, for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• MRG Realtime 2 x86_64

Fixes

• BZ - 1354708 - CVE-2016-5696 kernel: challenge ACK counter information disclosure.

CVEs

• CVE-2016-5696

References

• http://www.redhat.com/security/updates/classification/#normal

MRG Realtime 2

SRPM
kernel-rt-3.10.0-327.rt56.195.el6rt.src.rpm	SHA-256: 41f3ca43bf1940c9f188cdef1dcbf28434297c0fcc0b15f8bb6b0e8b2e3bda63
x86_64
kernel-rt-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: a7a3e60f27ea7a88538e7432baef0504777110fcdc115ff8f25e31fe0785284f
kernel-rt-debug-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: 23068facfa3fde37c8282d08e86d32eeae5d80b0536ccc98ea8469bdebee3a2b
kernel-rt-debug-debuginfo-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: b74939f1d1c0495f9460a65decd5e73ddf253a256d138b60793a17d22b88a807
kernel-rt-debug-devel-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: d4209c3a6fde7e4aa94f182bf53bdc52e49df475bb772fc7b8e62cde276765f4
kernel-rt-debuginfo-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: 34ee7f71c1efc2c8364a3182f8901ade17ac77a45d9dcbff20aa2cbbf25bbfbd
kernel-rt-debuginfo-common-x86_64-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: d9805cc4659a76c28f65c51dcbc0ddad736a18b40bbf0525ea376a3de9878801
kernel-rt-devel-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: 5b636f328c941d5d0e48ef57508faadf94c785182bb08ba4ba13829991e8f892
kernel-rt-doc-3.10.0-327.rt56.195.el6rt.noarch.rpm	SHA-256: 96d60c88e35cdf6304bfeaddaeee6e545b364d95f327e1c48d9c72c6fa08003e
kernel-rt-firmware-3.10.0-327.rt56.195.el6rt.noarch.rpm	SHA-256: 38045b5b4668261acf6cab7dac580a690cc50f01ace77152a5ff390d7723d3f2
kernel-rt-trace-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: b6ac1fa4e0e5bd993714d0d0fc25d9c2a3c04dae8f7bf499c01d403eb8303c81
kernel-rt-trace-debuginfo-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: 64ef57b1f8e1624932d91a7e0668d0223d611c03d79a6361cdb3d5c5ae023000
kernel-rt-trace-devel-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: 727cc2e3e0d84939943fe3f8dd1774c08b51a0e3420bfc7741f284d4ff5421b1
kernel-rt-vanilla-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: b6eeaffd7c5aae80fe32d9383184a165e90b05cf22d71df539b7fa24198c9d15
kernel-rt-vanilla-debuginfo-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: 07e55fac077468ab7f62681b81f1d82260fd36c5c392624112bbe1eac4fd0e65
kernel-rt-vanilla-devel-3.10.0-327.rt56.195.el6rt.x86_64.rpm	SHA-256: 04a6c1301114a31544db587f2773b8f848568cbe52270638787c954b3018c2f1