Synopsis

Important: kernel-alt security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es):

• An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, PowerPC)
  
• This release also includes next iteration of the CVE-2017-5715 mitigation that includes the SMCCC (Secure Monitor Call Calling Convention) 1.1 support. (CVE-2017-5715, ARM)
  

Red Hat would like to thank Google Project Zero for reporting CVE-2017-5715 and Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting CVE-2018-3639.

Bug Fix(es):

These updated kernel-alt packages include numerous bug fixes. Space precludes documenting all of the bug fixes in this advisory. See the descriptions in the related Knowledge Article: https://access.redhat.com/articles/3485851

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x

Fixes

• BZ - 1519780 - CVE-2017-5715 hw: cpu: speculative execution branch target injection
• BZ - 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass

CVEs

• CVE-2018-3639

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/cve/CVE-2018-3639
• https://access.redhat.com/security/cve/CVE-2017-5715
• https://access.redhat.com/articles/3485851

Red Hat Enterprise Linux for ARM 64 7

SRPM
kernel-alt-4.14.0-49.8.1.el7a.src.rpm	SHA-256: 95dc95b3a0f99f6d1768a26106cd6b84d41c7b1e15011080a0f9dda98088d16f
aarch64
kernel-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 503ad5d0dfddb2ea03b484db05c343318e4535109ba5fa7cf0f892809eefa8b3
kernel-abi-whitelists-4.14.0-49.8.1.el7a.noarch.rpm	SHA-256: a6430d0e9cdb8b9fe62e9fd5313d88a906a0992713602250451e134669553d4c
kernel-debug-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 01512a5936cebe2bc79c9cb03fb47798943b7c48199b2b85101597d3cba68a30
kernel-debug-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 8f58e038a3c3959c8dc166c3a9d1b0bae1752b1bb423a1875d42602ad5c6a1e0
kernel-debug-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 8f58e038a3c3959c8dc166c3a9d1b0bae1752b1bb423a1875d42602ad5c6a1e0
kernel-debug-devel-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 198462feef3d1d9b2b3d87dec2d4015d9cbd622ee24f61ed50a5af363ae42af0
kernel-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 0fe1fc1c213b1ef8f77ed278ea58b8f85ca3bbe9be8eb899e4a2586aaa5d6f0b
kernel-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 0fe1fc1c213b1ef8f77ed278ea58b8f85ca3bbe9be8eb899e4a2586aaa5d6f0b
kernel-debuginfo-common-aarch64-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 2fb274ded21ea1f8ba9c973f537ce2ff4b8b9328229c556da202c9c9700d6734
kernel-debuginfo-common-aarch64-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 2fb274ded21ea1f8ba9c973f537ce2ff4b8b9328229c556da202c9c9700d6734
kernel-devel-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: d14b7b90c2173444608588b5ba1f4be521a6f17437144dde5fa9eece1a7fed82
kernel-doc-4.14.0-49.8.1.el7a.noarch.rpm	SHA-256: e589a229006569d64574369fa2397f6eea6682e8f771d53ce04f1d3e87ae65a0
kernel-headers-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 02f19f8c670f21ed0ff1567aa9fdc020a19b30c28d8f097f2e856cc11d25e2a9
kernel-tools-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 6324187a4321cedc3b8fe97636eb30b1e3ff1440e708e6f1b8d173d886b8a1fb
kernel-tools-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 9a5fbe3721ed349bb52ef195cd5012b87068c9b4bab2db570209ae2cae16f712
kernel-tools-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 9a5fbe3721ed349bb52ef195cd5012b87068c9b4bab2db570209ae2cae16f712
kernel-tools-libs-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: a57987064e9ebd7478ce74245e2574295f496b673cc737130c94b12fd8dbc9b0
kernel-tools-libs-devel-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 2f05ce581f580b6863e1ea0de3fbb5a5daaf336b8ae2f6f723228564af003be2
perf-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 23a11943e1a6ea7c81552ed07c78a3288e086e1cd9d8d31e638fb92454a333fd
perf-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: bb9b64b4ba3e024ecd384ed8a9cd74f6e321e25a93264e7deee0fdca8155257b
perf-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: bb9b64b4ba3e024ecd384ed8a9cd74f6e321e25a93264e7deee0fdca8155257b
python-perf-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: ddc2a76a1198d3cbeaa9873a25dd46e1c804470d2203424f3eb315f87a5d3afb
python-perf-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 5482d3b593aa2c61deafe707b62ffb61a7c2e78feff4af21a4ce1830814697f1
python-perf-debuginfo-4.14.0-49.8.1.el7a.aarch64.rpm	SHA-256: 5482d3b593aa2c61deafe707b62ffb61a7c2e78feff4af21a4ce1830814697f1

Red Hat Enterprise Linux for Power 9 7

SRPM
kernel-alt-4.14.0-49.8.1.el7a.src.rpm	SHA-256: 95dc95b3a0f99f6d1768a26106cd6b84d41c7b1e15011080a0f9dda98088d16f
ppc64le
kernel-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 9b2ed064fa00563d816a17602c64256382836c8471fd7c36095c0663300f19d3
kernel-abi-whitelists-4.14.0-49.8.1.el7a.noarch.rpm	SHA-256: a6430d0e9cdb8b9fe62e9fd5313d88a906a0992713602250451e134669553d4c
kernel-bootwrapper-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: b7e47618a001a3013730da5c75ab7847217dce6113c567568a2e0da6f7d9a6f1
kernel-debug-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 26f6c76c9ea841feb1db0957e4b9819a09421230b6673d5cd9d9285b7ee6aff0
kernel-debug-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 13a3c2cea6637deb708fb5eb5f869fad789a681859ea1901b1469eaefaaac497
kernel-debug-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 13a3c2cea6637deb708fb5eb5f869fad789a681859ea1901b1469eaefaaac497
kernel-debug-devel-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 6b852aa9bc6d52077c36d306ae9f553179f6a594e0871dafd1ca50a5ab055a69
kernel-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 04425853057398ca2b901baecf477491a36279fbde4198eded391c42cc0576c0
kernel-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 04425853057398ca2b901baecf477491a36279fbde4198eded391c42cc0576c0
kernel-debuginfo-common-ppc64le-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: e1c84e963c88f21fcfd5fdc3832ad123f65b288d045568eb8cfdd171a5495cd3
kernel-debuginfo-common-ppc64le-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: e1c84e963c88f21fcfd5fdc3832ad123f65b288d045568eb8cfdd171a5495cd3
kernel-devel-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 59d6e1b9f79a1abb0f46fef22ac741baa020d11406889b3aeaa78254a0cbb3aa
kernel-doc-4.14.0-49.8.1.el7a.noarch.rpm	SHA-256: e589a229006569d64574369fa2397f6eea6682e8f771d53ce04f1d3e87ae65a0
kernel-headers-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 795bf653eb622d71c3d20ee896046dde16603affdde5df92e6936591a09d6883
kernel-tools-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: d9f5d211f731a29d09f86691c36815bd1d444a5b0cddcc344462a75f99388a76
kernel-tools-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 72160ac7fcc1034537129fe910d66386b6fcd680b6e099962bb00432a206e7e2
kernel-tools-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 72160ac7fcc1034537129fe910d66386b6fcd680b6e099962bb00432a206e7e2
kernel-tools-libs-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 8dee26e65c454e1ec24eda486d2fc4e4acb84c3eb72236dca342deb022fa55b6
kernel-tools-libs-devel-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: abbcc2d0377604aa6cd080485060ae268aece68bcfc391d4956048d059845d21
perf-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 5377487ad49b3cef938313da50870c5ad79c800f044384480a56d4a7ba6c0859
perf-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: d01bd8321a4ae3d0e70e0929aa91c2333de9ff593cf6a3ae8ca9a2b20acb146c
perf-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: d01bd8321a4ae3d0e70e0929aa91c2333de9ff593cf6a3ae8ca9a2b20acb146c
python-perf-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 06b382c2ca665ca637c3aa9add70070f886793469ab11ead4b14b9a19970ad8b
python-perf-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 0ba8956745e5bcba839d04893ace9f1181062199aff5d7c92be9b4823f09b15a
python-perf-debuginfo-4.14.0-49.8.1.el7a.ppc64le.rpm	SHA-256: 0ba8956745e5bcba839d04893ace9f1181062199aff5d7c92be9b4823f09b15a

Red Hat Enterprise Linux for IBM System z (Structure A) 7

SRPM
kernel-alt-4.14.0-49.8.1.el7a.src.rpm	SHA-256: 95dc95b3a0f99f6d1768a26106cd6b84d41c7b1e15011080a0f9dda98088d16f
s390x
kernel-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: f633465d03b8b517b509d26acf07832a45cab14671d02d9c877ef61fa971bbd8
kernel-abi-whitelists-4.14.0-49.8.1.el7a.noarch.rpm	SHA-256: a6430d0e9cdb8b9fe62e9fd5313d88a906a0992713602250451e134669553d4c
kernel-debug-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: e5883545a1ef230e3a0b69df2efc19d64ff78adfca134a3855388105e9e6f5e0
kernel-debug-debuginfo-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 6aa4dd56dc9f4374ab06206c15e60886dcb744ce4d0ebe91c62ac09e832f4c0b
kernel-debug-devel-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: c1384bf4a73017582836f9826865be74aa30fb34de23675575384cb02a0694e5
kernel-debuginfo-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 5971fe9fa940b5558eb6b05da5760380931c246220d57464cbda42865576d399
kernel-debuginfo-common-s390x-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 23a7770dc1d6fbf227966a3976990d32a615dcf8ae1a284dd8e58e2fe8b71564
kernel-devel-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: ac7f2bfe18db556b65bc88064c2a635e7ef183663255c522fdafeb524c21034c
kernel-doc-4.14.0-49.8.1.el7a.noarch.rpm	SHA-256: e589a229006569d64574369fa2397f6eea6682e8f771d53ce04f1d3e87ae65a0
kernel-headers-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 1a9c37e86316d4184e24726593d2a81f2d39c3100aa8c8b0e1834d67c9a1543c
kernel-kdump-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: d040f305843ccb640b18237aa35579b38e9a6a2d6302021571933e654943ff53
kernel-kdump-debuginfo-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: d955b8229bbb8789102aff647d095ef5ae30e778ea17be41fd495d24139c8ff1
kernel-kdump-devel-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 39840b2e1325ec613f276b77056e57c3169a72bd140d3c26f102a6f6aaa58616
perf-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 90a64a2bcbb12a3050944256069408da8a1399107cb371ecc899a70731afcc18
perf-debuginfo-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 05cfb5fd61a2e6202f5a5af192a700677e9ef09d8f87f6ed5094dcf13bae76c6
python-perf-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 1acbd09a7bba5fd1f85b2f72c5044853fe4b568ebb03960a33329a004080b378
python-perf-debuginfo-4.14.0-49.8.1.el7a.s390x.rpm	SHA-256: 62619631505d9d2bff15dbc4603c448c063b9641af0f3ed840c380ddc616222e