Synopsis

Important: kernel security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel is now available for Red Hat Enterprise Linux 6.2 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lacked certain checks for the end of a buffer. A remote attacker could trigger a pointer-arithmetic error or possibly cause other unspecified impacts using crafted requests related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c. (CVE-2017-7895, Important)
  
• A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures other than s390x and ppc64[le]), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although we believe it is unlikely. On systems without the stack protection feature (ppc64[le]; the Bluetooth modules are not built on s390x), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. (CVE-2017-1000251, Important)
  

Red Hat would like to thank Ari Kauppi for reporting CVE-2017-7895 and Armis Labs for reporting CVE-2017-1000251.

Bug Fix(es):

• Previously, while the MAP_GROWSDOWN flag was set, writing to the memory which was mapped with the mmap system call failed with the SIGBUS signal. This update fixes memory management in the Linux kernel by backporting an upstream patch that enlarges the stack guard page gap. As a result, mmap now works as expected under the described circumstances. (BZ#1474720)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server - AUS 6.2 x86_64

Fixes

• BZ - 1446103 - CVE-2017-7895 kernel: NFSv3 server does not properly handle payload bounds checking of WRITE requests
• BZ - 1489716 - CVE-2017-1000251 kernel: stack buffer overflow in the native Bluetooth stack

CVEs

• CVE-2017-1000251
• CVE-2017-7895

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/CVE-2017-1000251

Red Hat Enterprise Linux Server - AUS 6.2

SRPM
kernel-2.6.32-220.75.1.el6.src.rpm	SHA-256: a4a2958c08ba5bf40f518df005805504c13cba1e5a85cc99f9e57fea6560a19e
x86_64
kernel-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 603930f406233c14dc736dd033fcc30bf3b5d789a0528ba5f74c48f1d5f7aff5
kernel-debug-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 90c89966b466e1a1ebc4de6fcdd4c0fe866d1cd29e6188d2d7f9c8cc4923206f
kernel-debug-debuginfo-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 12ad5ddbc02a7ade34bdcbc3ba0b0bf0ec00a255c94102bd5e5d42105a8bae97
kernel-debug-debuginfo-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 12ad5ddbc02a7ade34bdcbc3ba0b0bf0ec00a255c94102bd5e5d42105a8bae97
kernel-debug-devel-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 00f666b68ca2dfa5857a60d59b8e0aaa52217bc1df14dbed103ebb9803589ec1
kernel-debuginfo-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 10bb8f915c779f6dc2acc23d6e0190f17f095592dc76fdef3c466a9663f9da49
kernel-debuginfo-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 10bb8f915c779f6dc2acc23d6e0190f17f095592dc76fdef3c466a9663f9da49
kernel-debuginfo-common-x86_64-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 38a4f5b6b89a3c80e492b6ec7143d98f8bea4c17a9b1c1b8434f6f6b50d09061
kernel-debuginfo-common-x86_64-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 38a4f5b6b89a3c80e492b6ec7143d98f8bea4c17a9b1c1b8434f6f6b50d09061
kernel-devel-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: ccd50fbd905969902cdd07ad9889951bbc38811f95276e3477e51909234b46af
kernel-doc-2.6.32-220.75.1.el6.noarch.rpm	SHA-256: 01d95aea33c94e5cb6f3d803afaeb237b35114dc37de25f12da86f695ee2066e
kernel-firmware-2.6.32-220.75.1.el6.noarch.rpm	SHA-256: 04a8a967cc44942c0e00b488176cd8efcb6f59465af3c64ea78c33f1393f88c8
kernel-headers-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: d34ed35723ca429911480c0e7249a62ff34d1e69437849db6b2779e02d65eb00
perf-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 8ac69efe96690aeaae9518d29862763f9a54011edb7ee877b61ddea71cf09f60
perf-debuginfo-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: bd690fd6962ea7b31057db97f0e456c2dd4c51a4b145fec1bfab7826fc0e524e
perf-debuginfo-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: bd690fd6962ea7b31057db97f0e456c2dd4c51a4b145fec1bfab7826fc0e524e
python-perf-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: 31b58e665be4a7b0c3514c628449e43c13a102a0324add3ea90e3a081e275ab1
python-perf-debuginfo-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: fc2124288c1a30b0be03ea41bae3d4c46daf15471d1c0eebc53c4f8958e6f7fe
python-perf-debuginfo-2.6.32-220.75.1.el6.x86_64.rpm	SHA-256: fc2124288c1a30b0be03ea41bae3d4c46daf15471d1c0eebc53c4f8958e6f7fe