Synopsis

Important: kernel security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult. (CVE-2017-1000364, Important)
  
• A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system. (CVE-2017-2636, Important)
  

Red Hat would like to thank Qualys Research Labs for reporting CVE-2017-1000364 and Alexander Popov for reporting CVE-2017-2636.

Bug Fix(es):

• Previously, the kdump mechanism was trying to get the lock by the vmalloc_sync_all() function during a kernel panic. Consequently, a deadlock occurred, and the crashkernel did not boot. This update fixes the vmalloc_sync_all() function to avoid synchronizing the vmalloc area on the crashing CPU. As a result, the crashkernel parameter now boots as expected, and the kernel dump is collected successfully under the described circumstances. (BZ#1443497)
  
• Previously, a kernel panic occurred when the mcelog daemon executed a huge page memory offline. This update fixes the HugeTLB feature of the Linux kernel to check for the Page Table Entry (PTE) NULL pointer in the page_check_address() function. As a result, the kernel panic no longer occurs under the described circumstances. (BZ#1444349)
  
• Previously, the vmw_pvscsi driver reported most successful aborts as FAILED due to a bug in vmw_pvscsi abort handler. This update fixes the handler, and successful aborts are no longer reported as FAILED. (BZ#1442966)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server - AUS 6.6 x86_64
• Red Hat Enterprise Linux Server - TUS 6.6 x86_64

Fixes

• BZ - 1428319 - CVE-2017-2636 kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()
• BZ - 1461333 - CVE-2017-1000364 kernel: heap/stack gap jumping via unbounded stack allocations

CVEs

• CVE-2017-1000364
• CVE-2017-1000379
• CVE-2017-2636

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/stackguard

Red Hat Enterprise Linux Server - AUS 6.6

SRPM
kernel-2.6.32-504.60.2.el6.src.rpm	SHA-256: b7f8e7c6c58f0002460efc7433c21f46c513b5ea10be6e687e4c1c2723959570
x86_64
kernel-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 1ce2f11bc6d09ef640a6c00e99dde7bea4170df6027df7e62802255d45829db9
kernel-abi-whitelists-2.6.32-504.60.2.el6.noarch.rpm	SHA-256: 7c6c55d0c0de871f23c02fdb67913f31efed8ba58dc4e7e1ab223ebbd58ae765
kernel-debug-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 7e1c78c8d1465c7d4aae0cc715b5866437f2e90fd339f95057afd63bf0b9f9e4
kernel-debug-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: f990c2442389680b6cb3584bcc59b332d904aef95d97b19e08dd0fa142b72e0e
kernel-debug-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: f990c2442389680b6cb3584bcc59b332d904aef95d97b19e08dd0fa142b72e0e
kernel-debug-devel-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: d8eef592634605bd00a589679602f8332b6ce2d6c7e7f52426d55be5f1b49937
kernel-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: c7102af14bc7f3f42dbd54da1507b8f6ca0f0cdf0e7c3b430169785c39dad507
kernel-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: c7102af14bc7f3f42dbd54da1507b8f6ca0f0cdf0e7c3b430169785c39dad507
kernel-debuginfo-common-x86_64-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 87328f58cc19fce78fd217581215584eb841dcb4d2e84f842480192c15348391
kernel-debuginfo-common-x86_64-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 87328f58cc19fce78fd217581215584eb841dcb4d2e84f842480192c15348391
kernel-devel-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 09ca347907197f0e7f4f45fe3120d26a62942c7fb150a567726d1199142c572a
kernel-doc-2.6.32-504.60.2.el6.noarch.rpm	SHA-256: c09116f92963a7ecb185484dadc2db3ccface12059285084af8d044a23e48157
kernel-firmware-2.6.32-504.60.2.el6.noarch.rpm	SHA-256: fc540aad999c953b4e81ff02e335720c4ad7f68bf9c0a3ccf0095216e80c0425
kernel-headers-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 58cb103af851545048fe1191340c3410b4465592d80828b46a70fe2c8a994716
perf-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 80930612c88c99ecc1b3bb3bdf667fed73d40400bddb060b2cefcc8cca6fd2bc
perf-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: fea6d7fa0d29ea0d6d6206eddd9539979e1ee917cda6ef9524abb69d9422319f
perf-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: fea6d7fa0d29ea0d6d6206eddd9539979e1ee917cda6ef9524abb69d9422319f
python-perf-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: b3a56f1442a8ea2581226abeef32a673cccdb83fb9399c996c082fd0d68ab108
python-perf-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 18d6c7e816b0082c469b3d241a723f39ef725aa09c503b132de4f3a0f322f5f9
python-perf-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 18d6c7e816b0082c469b3d241a723f39ef725aa09c503b132de4f3a0f322f5f9

Red Hat Enterprise Linux Server - TUS 6.6

SRPM
kernel-2.6.32-504.60.2.el6.src.rpm	SHA-256: b7f8e7c6c58f0002460efc7433c21f46c513b5ea10be6e687e4c1c2723959570
x86_64
kernel-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 1ce2f11bc6d09ef640a6c00e99dde7bea4170df6027df7e62802255d45829db9
kernel-abi-whitelists-2.6.32-504.60.2.el6.noarch.rpm	SHA-256: 7c6c55d0c0de871f23c02fdb67913f31efed8ba58dc4e7e1ab223ebbd58ae765
kernel-debug-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 7e1c78c8d1465c7d4aae0cc715b5866437f2e90fd339f95057afd63bf0b9f9e4
kernel-debug-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: f990c2442389680b6cb3584bcc59b332d904aef95d97b19e08dd0fa142b72e0e
kernel-debug-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: f990c2442389680b6cb3584bcc59b332d904aef95d97b19e08dd0fa142b72e0e
kernel-debug-devel-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: d8eef592634605bd00a589679602f8332b6ce2d6c7e7f52426d55be5f1b49937
kernel-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: c7102af14bc7f3f42dbd54da1507b8f6ca0f0cdf0e7c3b430169785c39dad507
kernel-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: c7102af14bc7f3f42dbd54da1507b8f6ca0f0cdf0e7c3b430169785c39dad507
kernel-debuginfo-common-x86_64-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 87328f58cc19fce78fd217581215584eb841dcb4d2e84f842480192c15348391
kernel-debuginfo-common-x86_64-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 87328f58cc19fce78fd217581215584eb841dcb4d2e84f842480192c15348391
kernel-devel-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 09ca347907197f0e7f4f45fe3120d26a62942c7fb150a567726d1199142c572a
kernel-doc-2.6.32-504.60.2.el6.noarch.rpm	SHA-256: c09116f92963a7ecb185484dadc2db3ccface12059285084af8d044a23e48157
kernel-firmware-2.6.32-504.60.2.el6.noarch.rpm	SHA-256: fc540aad999c953b4e81ff02e335720c4ad7f68bf9c0a3ccf0095216e80c0425
kernel-headers-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 58cb103af851545048fe1191340c3410b4465592d80828b46a70fe2c8a994716
perf-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 80930612c88c99ecc1b3bb3bdf667fed73d40400bddb060b2cefcc8cca6fd2bc
perf-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: fea6d7fa0d29ea0d6d6206eddd9539979e1ee917cda6ef9524abb69d9422319f
perf-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: fea6d7fa0d29ea0d6d6206eddd9539979e1ee917cda6ef9524abb69d9422319f
python-perf-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: b3a56f1442a8ea2581226abeef32a673cccdb83fb9399c996c082fd0d68ab108
python-perf-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 18d6c7e816b0082c469b3d241a723f39ef725aa09c503b132de4f3a0f322f5f9
python-perf-debuginfo-2.6.32-504.60.2.el6.x86_64.rpm	SHA-256: 18d6c7e816b0082c469b3d241a723f39ef725aa09c503b132de4f3a0f322f5f9