Synopsis

Important: kernel-alt security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es):

• A flaw was found in the patches used to fix the 'dirtycow' vulnerability (CVE-2016-5195). An attacker, able to run local code, can exploit a race condition in transparent huge pages to modify usually read-only huge pages. (CVE-2017-1000405)
  

Red Hat would like to thank Eylon Ben Yaakov and Daniel Shapiro for reporting this issue.

Bug Fix(es):

• Previously, Red Hat Enterprise Linux 7.4 with the kernel version provided by the kernel-alt package, did not support turning off transactional memory (TM) on the POWER9 systems. With this update it is now possible to turn off TM on the POWER9 systems. (BZ#1509974)
  
• Due to a bug in the ixgbe and i40e drivers, the socket buffer list (skb list) in some cases got corrupted when running Red Hat Enterprise Linux 7.4 with the kernel version provided by the kernel-alt package on the POWER9 systems. Consequently, a kernel panic occurred. This update fixes ixgbe and i40e, and the kernel no longer panics due to this behavior. (BZ#1518412)
  
• Users can lower the max_sectors_kb setting in the sysfs file system to accommodate certain workloads. Previously, users needed to set the maximum I/O size to either the block layer default or the optional preferred I/O size reported by the device. This update fixes the scsi driver to keep the current heuristic function for the initial setting of max_sectors_kb. As a result, for subsequent invocations, the driver now only updates the current queue limit if it exceeds the capabilities of the hardware. (BZ#1518432)
  
• When performing full-bootme tests on Boston ESS systems running Red Hat Enterprise Linux 7.4 with the kernel version provided in the kernel-alt package, a kernel panic occurred and the operating system dropped into the XMON software. This update fixes the Multi-Queue Block IO Queueing Mechanism (blk-mq), and the kernel no longer panics in these circumstances. (BZ#1518433)
  
• When running the stress test on the file system with the gssstress command, and pulling one disk from one recovery group, "kernel I/O error" was reported, and gssstress became unresponsive. Gssstress now works as expected under the described circumstances. (BZ#1522645)
  
• When using the fwupdate_xl710 utility to apply updates for NVM Intel Ethernet Converged Network Adapter XL710 on machines running Red Hat Enterpise Linux 7.4 with the kernel version provided in the kernel-alt package, a deadlock sometimes occurred when the i40e driver was acquiring access to the Non-Volatile Memory (NVM) of the device. Consequently, NVM acquire timeouts occurred, the firmware update failed with the following error message: "Failed Acquiring NVM resource for read err=-53 status=0xa", and left the device's memory in a corrupted state. This update fixes the i40e driver, and the firmware updates no longer fail due to this behavior. (BZ#1522843)
  
• Previously, on POWER9 systems with more than 100 Pstates, the cpufreq driver did not handle the cases when the NxN matrix denominated transition table (trans_table) overflowed beyond the PAGE_SIZE boundary correctly. Consequently, reading trans_table for any of the CPUs failed with the following error:
  

"fill_read_buffer: show+0x0/0xa0 returned bad count"

With this update reading trans_table for any of the CPUs now proceeds as expected under the described circumstances. (BZ#1522844)

• Previously, the /sys/firmware/opal/exports directory did not contain an export node. Consequently, a range of memory in the Open Power Abstraction Layer (OPAL) that the operating system attempted to export to user space for debugging purposes was not available. With this update the sysfs file under /sys/firmware/opal/exports is now available for each property found there, and this file can be used for debugging purposes. (BZ#1522845)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le

Fixes

• BZ - 1516514 - CVE-2017-1000405 kernel: pmd can become dirty without going through a COW cycle

CVEs

• CVE-2017-1000405

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for ARM 64 7

SRPM
kernel-alt-4.11.0-44.4.1.el7a.src.rpm	SHA-256: 0155afa6a47cb1da796ca1cdd8d4d72bc89f408b056bef2983727c7c50928d54
aarch64
kernel-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: a0439308799fdbf43b8ec88db771bd6a5c8f8801c008ef8256c5e98fc4401b87
kernel-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: a0439308799fdbf43b8ec88db771bd6a5c8f8801c008ef8256c5e98fc4401b87
kernel-abi-whitelists-4.11.0-44.4.1.el7a.noarch.rpm	SHA-256: 9cee6589bc22381450e77e63c383693160b3c58c1a8c138149eac49f9da4e7ae
kernel-debug-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: aea1b6acb9e7b3e757b1792b1a28710aeddc8f38f8b1b8721a0f753679e64bfe
kernel-debug-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 76fb60363bbbef6ea65eb1d74c4a8e6fac3e8b2625b76cda6501d0d99a990ee8
kernel-debug-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 76fb60363bbbef6ea65eb1d74c4a8e6fac3e8b2625b76cda6501d0d99a990ee8
kernel-debug-devel-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 1b6e356f9d3a5732cfe6f7484417059517cfdfe62fb485b41c2ca26a036e9304
kernel-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: d8073bb7e0de224f1e75f9605cd830ee3431b532b60468dc1b0370c2ef247354
kernel-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: d8073bb7e0de224f1e75f9605cd830ee3431b532b60468dc1b0370c2ef247354
kernel-debuginfo-common-aarch64-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 7a3cccc6c8e7942a34b941bd1d3c7bebd2b0525a7116bc4ad7e97a711ee6e94c
kernel-debuginfo-common-aarch64-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 7a3cccc6c8e7942a34b941bd1d3c7bebd2b0525a7116bc4ad7e97a711ee6e94c
kernel-devel-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 59b932780852a666993bc9230d05995662ef701c90adfe7d7a66d866af0482a1
kernel-doc-4.11.0-44.4.1.el7a.noarch.rpm	SHA-256: 7f97c8ef92afd78063cf03a3fd69deec68bc749f40ce1dad9cffde443fdb2deb
kernel-headers-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: ab19c7f1b59f1d66ed9eaee053e8c4e325b2e5a670e0f78815ad0711a7f0c527
kernel-tools-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 0746e7151a20949311341acca64de820b679afeaa8a0580ed783270ae4ba22b2
kernel-tools-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 69d09c384f2125a7c9be6da8c0254e02befffc5f947be6f03701521c55b5bc9b
kernel-tools-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 69d09c384f2125a7c9be6da8c0254e02befffc5f947be6f03701521c55b5bc9b
kernel-tools-libs-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 71fad8c35f604d8220f869916f52c1fc89e9cc75192337261217671f0bd9d68e
kernel-tools-libs-devel-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: de4fde1cddf9ca447147b97eb99aacc4e14a0f20114fd186495ee6f495a673f9
perf-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 467e1eb261a58bbdf9b98101afb03866cdc4c2d60ab577ce5da435de4df791f8
perf-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: ae8b5b618ca623352647633926a2dfcacc02f116a58c445b6ef62c1633ea0ce6
perf-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: ae8b5b618ca623352647633926a2dfcacc02f116a58c445b6ef62c1633ea0ce6
python-perf-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: 61445ccc3326471378653a4e48e8287886392cabf4fe1c037f9198afe6238169
python-perf-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: d799744d146094eddc63b483b20564cf249d2a81e126cb4002cd55bfd399b6e6
python-perf-debuginfo-4.11.0-44.4.1.el7a.aarch64.rpm	SHA-256: d799744d146094eddc63b483b20564cf249d2a81e126cb4002cd55bfd399b6e6

Red Hat Enterprise Linux for Power 9 7

SRPM
kernel-alt-4.11.0-44.4.1.el7a.src.rpm	SHA-256: 0155afa6a47cb1da796ca1cdd8d4d72bc89f408b056bef2983727c7c50928d54
ppc64le
kernel-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: e8fc76e42d4dbcd7c0266c6218864ef6839fa6318699f737420d5a5ace2324ea
kernel-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: e8fc76e42d4dbcd7c0266c6218864ef6839fa6318699f737420d5a5ace2324ea
kernel-abi-whitelists-4.11.0-44.4.1.el7a.noarch.rpm	SHA-256: 9cee6589bc22381450e77e63c383693160b3c58c1a8c138149eac49f9da4e7ae
kernel-bootwrapper-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 1f0bb3d02c8c08476cdb6e7e74dd691e574a49e25a67b393b0c37339fdad7629
kernel-debug-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 0533b1e9234281290965fdfa461bcbc2d4eca725ae272629f3e6ae1fc78c5f1b
kernel-debug-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 1475fafd9960e36e380d7c2f740da4b5d20d53b68501f4cd01e2584267db80e6
kernel-debug-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 1475fafd9960e36e380d7c2f740da4b5d20d53b68501f4cd01e2584267db80e6
kernel-debug-devel-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: d53397a6eea4dce3b331eae9fb6e663de6e41327d6e3cb372125a29a65a96bc9
kernel-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 83c7714ad0f33c2307e29eb981ee175f2b2800170a4e55eb5166411942c51f4f
kernel-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 83c7714ad0f33c2307e29eb981ee175f2b2800170a4e55eb5166411942c51f4f
kernel-debuginfo-common-ppc64le-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 967260cc2069e4ccd0bbe891d3b3e0e4ed86d3940697654e30618df46a8e03b5
kernel-debuginfo-common-ppc64le-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 967260cc2069e4ccd0bbe891d3b3e0e4ed86d3940697654e30618df46a8e03b5
kernel-devel-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 3c0baec578dc709461f3d1ddcfc1ce1359b25f63bccbb4470f2b92506c244a9a
kernel-doc-4.11.0-44.4.1.el7a.noarch.rpm	SHA-256: 7f97c8ef92afd78063cf03a3fd69deec68bc749f40ce1dad9cffde443fdb2deb
kernel-headers-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 341eaffb0d57f56f9bacf26b8b71f430f5535496836f374171cffb292f213da0
kernel-tools-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: a7addb17794127529caebde815767ea39378027509a37d32b4d59c5ee74efa05
kernel-tools-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 79d286d6510f02964a78d29210ff8e7b0e38de53de791707b0fe1fd1233eba97
kernel-tools-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 79d286d6510f02964a78d29210ff8e7b0e38de53de791707b0fe1fd1233eba97
kernel-tools-libs-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 96ab989e376c98e68479713ba4f188d923277ab71e4756ca8b872171e802ce6c
kernel-tools-libs-devel-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 9f48a62283f95879c079e5d21d0ee66e3b8a750fbd44f370e819fb4177065662
perf-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 1beff5f031b96ef669f73d75957710949f591c08b4ffec66ac9397656eeb0ed2
perf-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 544067578db2696be0e49d85d750dace5a6541bffede0cc8459523987e29ffb0
perf-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 544067578db2696be0e49d85d750dace5a6541bffede0cc8459523987e29ffb0
python-perf-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: 5984c4b648f32354423324417f70d3e9907c2b5d629ee11b48250fa2a73931b5
python-perf-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: c50da914c0f442560dcd39e1f15b504b481760de55767c14fae75d37605b0f71
python-perf-debuginfo-4.11.0-44.4.1.el7a.ppc64le.rpm	SHA-256: c50da914c0f442560dcd39e1f15b504b481760de55767c14fae75d37605b0f71