Synopsis

Important: kernel-rt security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotify_handle_event() and vfs_rename() while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be corrupted with attacker-controlled data, which may lead to the privilege escalation. (CVE-2017-7533, Important)
  

Red Hat would like to thank Leilei Lin (Alibaba Group), Fan Wu (The University of Hong Kong), and Shixiong Zhao (The University of Hong Kong) for reporting this issue.

Bug Fix(es):

• The kernel-rt packages have been upgraded to the 3.10.0-693.2.1 source tree, which provides a number of bug fixes over the previous version. (BZ#1473393) (BZ#1473393)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for Real Time 7 x86_64
• Red Hat Enterprise Linux for Real Time for NFV 7 x86_64

Fixes

• BZ - 1468283 - CVE-2017-7533 kernel: a race between inotify_handle_event() and sys_rename()
• BZ - 1473393 - kernel-rt: update to the RHEL7.4.z batch#1 source tree

CVEs

• CVE-2017-7533

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for Real Time 7

SRPM
kernel-rt-3.10.0-693.2.1.rt56.620.el7.src.rpm	SHA-256: b70fa9efba78fc2326edef34e6838804c93c20abb04ee4cdf8f913225fbfe22a
x86_64
kernel-rt-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: e7c8e970623b90af5d93055a09f0738394cae22ce7951c7978820c57f4149f99
kernel-rt-debug-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 4ead7a44109eb6b66f16fc3c8a3e5a2ff88cc683876587b8fac5e60c0e6b35a4
kernel-rt-debug-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 47bd0c8c535bd79f2480a2c8563daaecdbeff34670f05db3ce2ff857f947a87f
kernel-rt-debug-devel-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: e9a48573eb36a093b4fe7c3be56360655b8793019644351e6979af3cf37e1331
kernel-rt-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 4e2f518de13ca067c6cdb13398e4fa388c18355a9608266e7aa525add3e41daa
kernel-rt-debuginfo-common-x86_64-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: e72d95baa2e8b1878c08033aa0eac69a57791e78478c1a26ae7b85fbb27ded02
kernel-rt-devel-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 7059fef334035181d90411e2b5f4ffa6c7606e0ba55d44c51e4b402665a96bd2
kernel-rt-doc-3.10.0-693.2.1.rt56.620.el7.noarch.rpm	SHA-256: 3fd65b21d098d491006b2000704ff059e079562286102db50d389749f1754388
kernel-rt-trace-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 42b08bc29ee50e72e7e8523d7e9785f402e5703a3049c0baffc59bbfbc4dbf11
kernel-rt-trace-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 9911ed80ce1007748802626885399b06da08e98cf53d93e6856d3a1d2ec5aa99
kernel-rt-trace-devel-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 890e6fcdd58dafa9dbe1757325d7dc9e9cfa813738e87ab961e149dc20e86004

Red Hat Enterprise Linux for Real Time for NFV 7

SRPM
kernel-rt-3.10.0-693.2.1.rt56.620.el7.src.rpm	SHA-256: b70fa9efba78fc2326edef34e6838804c93c20abb04ee4cdf8f913225fbfe22a
x86_64
kernel-rt-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: e7c8e970623b90af5d93055a09f0738394cae22ce7951c7978820c57f4149f99
kernel-rt-debug-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 4ead7a44109eb6b66f16fc3c8a3e5a2ff88cc683876587b8fac5e60c0e6b35a4
kernel-rt-debug-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 47bd0c8c535bd79f2480a2c8563daaecdbeff34670f05db3ce2ff857f947a87f
kernel-rt-debug-devel-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: e9a48573eb36a093b4fe7c3be56360655b8793019644351e6979af3cf37e1331
kernel-rt-debug-kvm-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: dba0d3ca8cf7b2de52e28ec6b0d66be2a5bea3a48046e793a0dc0d187acd4d6e
kernel-rt-debug-kvm-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 3762276cf1e64f14a5f28c87ce8c47560160e0afd6ed444fdd9f60623e28310e
kernel-rt-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 4e2f518de13ca067c6cdb13398e4fa388c18355a9608266e7aa525add3e41daa
kernel-rt-debuginfo-common-x86_64-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: e72d95baa2e8b1878c08033aa0eac69a57791e78478c1a26ae7b85fbb27ded02
kernel-rt-devel-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 7059fef334035181d90411e2b5f4ffa6c7606e0ba55d44c51e4b402665a96bd2
kernel-rt-doc-3.10.0-693.2.1.rt56.620.el7.noarch.rpm	SHA-256: 3fd65b21d098d491006b2000704ff059e079562286102db50d389749f1754388
kernel-rt-kvm-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 920071b0f5f4ed6e60e892bea82e2b880fc41517b3ae64bfb3183c9d42f614a0
kernel-rt-kvm-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: a40a0576ecd074ee7622cd96ece0c42123a075d67233e1bcb5e980907893fb59
kernel-rt-trace-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 42b08bc29ee50e72e7e8523d7e9785f402e5703a3049c0baffc59bbfbc4dbf11
kernel-rt-trace-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 9911ed80ce1007748802626885399b06da08e98cf53d93e6856d3a1d2ec5aa99
kernel-rt-trace-devel-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 890e6fcdd58dafa9dbe1757325d7dc9e9cfa813738e87ab961e149dc20e86004
kernel-rt-trace-kvm-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: 45ed814adc95132b0a9ad72c5082f8e01068949c42fe354495c6e64d67c1e227
kernel-rt-trace-kvm-debuginfo-3.10.0-693.2.1.rt56.620.el7.x86_64.rpm	SHA-256: d0f25a6104bfd2f9291acae5ed9d5d63fd31ffdd1c8466d5e5604b66076e4c8f