Synopsis

Important: kernel security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel is now available for Red Hat Enterprise Linux 6.2 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult. (CVE-2017-1000364, Important)
  

Red Hat would like to thank Qualys Research Labs for reporting this issue.

Bug Fix(es):

• Previously, a kernel panic occurred when the mcelog daemon executed a huge page memory offline. This update fixes the HugeTLB feature of the Linux kernel to check for the Page Table Entry (PTE) NULL pointer in the page_check_address() function. As a result, the kernel panic no longer occurs under the described circumstances. (BZ#1444342)
  
• Previously, the kdump mechanism was trying to get the lock by the vmalloc_sync_all() function during a kernel panic. Consequently, a deadlock occurred, and the crashkernel did not boot. This update fixes the vmalloc_sync_all() function to avoid synchronizing the vmalloc area on the crashing CPU. As a result, the crashkernel parameter now boots as expected, and the kernel dump is collected successfully under the described circumstances. (BZ#1443494)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server - AUS 6.2 x86_64

Fixes

• BZ - 1461333 - CVE-2017-1000364 kernel: heap/stack gap jumping via unbounded stack allocations

CVEs

• CVE-2017-1000364
• CVE-2017-1000379

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/stackguard

Red Hat Enterprise Linux Server - AUS 6.2

SRPM
kernel-2.6.32-220.72.2.el6.src.rpm	SHA-256: c71d41d2e55ed71cc98ab3e120120cccf80ffe3fbce39ad3dc6e0c5ecb7a1e34
x86_64
kernel-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 35cc3011fb514374432a51c783952d69bcb71ceee0ca4853f63e4f2970f54131
kernel-debug-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: fd8f1e8b79548b336de60317b0a1495f4a8184300445c0cec514183e3d85dc75
kernel-debug-debuginfo-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: bde8fa7b5fd057b6fadd38e31e9eb48254d2e9e6be55a4eca4dc9999906d6d35
kernel-debug-debuginfo-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: bde8fa7b5fd057b6fadd38e31e9eb48254d2e9e6be55a4eca4dc9999906d6d35
kernel-debug-devel-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 4ff5eb60b75071af4d97d53c4b411670394e3b1329e63429618652f2f353c916
kernel-debuginfo-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 61bf02ff1bef0a80b833cd52521ca7ca183fbe2d49d75815aa26a07f66842b57
kernel-debuginfo-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 61bf02ff1bef0a80b833cd52521ca7ca183fbe2d49d75815aa26a07f66842b57
kernel-debuginfo-common-x86_64-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 8e2ccb69f9362a4f2503d1d6be099d3fd13d4b56f94b581fc3b896e4b5ef081d
kernel-debuginfo-common-x86_64-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 8e2ccb69f9362a4f2503d1d6be099d3fd13d4b56f94b581fc3b896e4b5ef081d
kernel-devel-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: a3831ea986fccb65aff8218094ccde01ce9bde44446a9f938a5742fec3f5f5a6
kernel-doc-2.6.32-220.72.2.el6.noarch.rpm	SHA-256: 4062bb109c08051b1dc4134ca270b050292ef723348a980f2c6f5a4460b994df
kernel-firmware-2.6.32-220.72.2.el6.noarch.rpm	SHA-256: 803fa22971734a160e0d59718efdd0f813451609bbe1672ad447c2acd58deac8
kernel-headers-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 8109684f998f663f8ae5692ba5c077762b9704c10c9d5947202f75eafb422673
perf-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 587de30851b2349d7d4f68ebf4421be957630cd7a8b4119260c3e5576ebe7bb0
perf-debuginfo-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: dfe526b625b426252d7e451723e990db2a76dcba5e1a0f78f6cd8e816a53aaed
perf-debuginfo-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: dfe526b625b426252d7e451723e990db2a76dcba5e1a0f78f6cd8e816a53aaed
python-perf-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 6aa14c16f58455c3dfb8032188a664fd7fa89e8534e0aa779d6177a6db0ff3e8
python-perf-debuginfo-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 629809e4fe193c8c2a1cfebaa103552cc365b3c17ceb5ada1b2d8a41e769027c
python-perf-debuginfo-2.6.32-220.72.2.el6.x86_64.rpm	SHA-256: 629809e4fe193c8c2a1cfebaa103552cc365b3c17ceb5ada1b2d8a41e769027c