Synopsis

Important: kernel security update

Type/Severity

Security Advisory: Important

Topic

An update for kernel is now available for Red Hat Enterprise Linux 6.5 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639)
  

Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software side of the mitigation for this hardware issue. To be fully functional, up-to-date CPU microcode applied on the system is required. Please refer to References section for further information about this issue, CPU microcode requirements and the potential performance impact.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server - AUS 6.5 x86_64

Fixes

• BZ - 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass

CVEs

• CVE-2018-3639

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/ssbd

Red Hat Enterprise Linux Server - AUS 6.5

SRPM
kernel-2.6.32-431.89.4.el6.src.rpm	SHA-256: ce26b427f66f20f98b3d8f77a6dcd6285d35b1f7ef140dcfb4a58f028713f378
x86_64
kernel-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 9447af46f25fb3f7c12de63ceb749fc2bcb2569ecf84bfe0c699b9c57feca6ea
kernel-abi-whitelists-2.6.32-431.89.4.el6.noarch.rpm	SHA-256: d8d74c4ee4df17987c0acf629f234e9093059c4a719cd07ca022d6ce4398a8da
kernel-debug-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 9c835005fe376daad674844cbe71cfb565491d693ba7f75f75792c07b1378547
kernel-debug-debuginfo-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 301de2d663ea705f751405239bb5bd1ff2f6a671f61eb396bc0816059e7580fa
kernel-debug-debuginfo-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 301de2d663ea705f751405239bb5bd1ff2f6a671f61eb396bc0816059e7580fa
kernel-debug-devel-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 1ed6686f98670ac7365f128a4ed1c23633eeebac72dbf9d221d7ecc856ff19e0
kernel-debuginfo-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 0f2cdcf9b7c79284076bcedccda4855c5f332838c1c5158eea8db284c477bd4a
kernel-debuginfo-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 0f2cdcf9b7c79284076bcedccda4855c5f332838c1c5158eea8db284c477bd4a
kernel-debuginfo-common-x86_64-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: e5db346d27e3e847283ea28449342d14353ab23bbe5f5a43f55f4b013f2ecfbf
kernel-debuginfo-common-x86_64-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: e5db346d27e3e847283ea28449342d14353ab23bbe5f5a43f55f4b013f2ecfbf
kernel-devel-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: e8f8f9e904f32bef84bb418ce3870077d3a3e0da811ba78d501d5f9b5f850108
kernel-doc-2.6.32-431.89.4.el6.noarch.rpm	SHA-256: 1688368134610743872342d146ccae88c84841a16942cf21892dae35610e47d9
kernel-firmware-2.6.32-431.89.4.el6.noarch.rpm	SHA-256: b0d497e75553f255cc536c9e283a056b5990ae021c82fd4b1aa5dc82c01c2c62
kernel-headers-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 9a368cc5855e0da2367ad24d591fc60eabae19759d0ac3d0be3e62cf5bb05509
perf-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: f97164fe2c9ef514391e47a9b9caf96dfbb64ab6dffecb659591aaf419d75f0e
perf-debuginfo-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 5dd7f2c5f9c9fcae794769529846b2581e631e464c4d87aebddc176eb26a9540
perf-debuginfo-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: 5dd7f2c5f9c9fcae794769529846b2581e631e464c4d87aebddc176eb26a9540
python-perf-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: bd29317e050ef5fc38fd96802c3cb0eb59c157e94f14dab26ea41878cceeb961
python-perf-debuginfo-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: f349d046ae9e5330b609079b0eaf25016f2edab5325d5b297f9471f4ee72c5d3
python-perf-debuginfo-2.6.32-431.89.4.el6.x86_64.rpm	SHA-256: f349d046ae9e5330b609079b0eaf25016f2edab5325d5b297f9471f4ee72c5d3