Synopsis

Important: kernel security update

Type/Severity

Security Advisory: Important

Topic

An update for kernel is now available for Red Hat Enterprise Linux 5 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639)
  
• kernel: A divide-by-zero vulnerability was found in the __tcp_select_window function in the Linux kernel. This can result in a kernel panic causing a local denial of service. (CVE-2017-14106)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting CVE-2018-3639.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server - Extended Life Cycle Support 5 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 5 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 5 s390x

Fixes

• BZ - 1487295 - CVE-2017-14106 kernel: Divide-by-zero in __tcp_select_window
• BZ - 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass

CVEs

• CVE-2017-14106
• CVE-2018-3639

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/ssbd

Red Hat Enterprise Linux Server - Extended Life Cycle Support 5

SRPM
kernel-2.6.18-433.el5.src.rpm	SHA-256: 1b484d055239f223928ed009295feac0519a8448f061cb784095c5bca61bf318
x86_64
kernel-2.6.18-433.el5.x86_64.rpm	SHA-256: fd27dc30e99b9e45889d66a72abd118f176afef29d6d1bc9e9b948cea668498b
kernel-debug-2.6.18-433.el5.x86_64.rpm	SHA-256: c1a559048718975e57a66250564fb8999dd90da8c1d02da81274ded7759d5e4a
kernel-debug-debuginfo-2.6.18-433.el5.x86_64.rpm	SHA-256: cea6efe271c6662eba7f61fab1e5cbcf232cf421013787b22c468e432ad63acb
kernel-debug-devel-2.6.18-433.el5.x86_64.rpm	SHA-256: c49aa2c5ea15e37a0060a78b1f7c8feb17e7f6e5b8f8e058ea6522b6ee6d77bc
kernel-debuginfo-2.6.18-433.el5.x86_64.rpm	SHA-256: 6e5a35040779da7bc45880039ac83130dbbd6817f2433f9af12f762275e70374
kernel-debuginfo-common-2.6.18-433.el5.x86_64.rpm	SHA-256: b385da990d8886ef215554eff855fd6b247badc3107382530fff53491cfeb34c
kernel-devel-2.6.18-433.el5.x86_64.rpm	SHA-256: 8b47cb525ccd1f5885334247d45661c63db9e2b491036deb4bf69681f3d6a7c1
kernel-doc-2.6.18-433.el5.noarch.rpm	SHA-256: 1c6d29ca12f54c7bd0b2457c9c9f55126e3517387101f5cc000e8a0255028db2
kernel-headers-2.6.18-433.el5.x86_64.rpm	SHA-256: 6cf3171a4ccd513fad5e8329011fd01726187caab23b4f077ade21e2a1a20833
kernel-xen-2.6.18-433.el5.x86_64.rpm	SHA-256: f0bad20f6cd97ae2f9a44bc409bcc9a02dc35ecf7f0c2a8704f2ade5b4d0a752
kernel-xen-debuginfo-2.6.18-433.el5.x86_64.rpm	SHA-256: 0f43ed9050877a8e16c6e5629d1ceb48184828cb5c14d5bbc249686e3de24224
kernel-xen-devel-2.6.18-433.el5.x86_64.rpm	SHA-256: 85a95dc540f5e376701d68f3f557d6d3c245f9c230c9517423a3f6f3ae8cec9d
i386
kernel-2.6.18-433.el5.i686.rpm	SHA-256: 1d7703975d7661bdcaaf083cda4a9fe02ef3c5cb3a47c0b5aa54740ff8f7c0a9
kernel-PAE-2.6.18-433.el5.i686.rpm	SHA-256: dc7ee85d0acb7860864e1fc8250076b2e54ccb0e89faf4d68752d38a78e022fc
kernel-PAE-debuginfo-2.6.18-433.el5.i686.rpm	SHA-256: 54a8d5eed0815324561e6fcffcdc7329f6f14d64cad0d3dd1a9e47659a6239f1
kernel-PAE-devel-2.6.18-433.el5.i686.rpm	SHA-256: 6297ab6c958444d5a7d8105f25f7b1ea27ce2bdde75a71f8949730256d115183
kernel-debug-2.6.18-433.el5.i686.rpm	SHA-256: 24fe869da2a80b268c78a6d9d6d839fb53139e485bf46b4865bcc6822010e63a
kernel-debug-debuginfo-2.6.18-433.el5.i686.rpm	SHA-256: d2eeb40e9bbb89350a790cbba4bc15ae9cd599a769c9d895f3f292147bed1fe9
kernel-debug-devel-2.6.18-433.el5.i686.rpm	SHA-256: 2a5171f67809a6ec1b0127b65c44934e88e0359ee512740b59d5cfa415318937
kernel-debuginfo-2.6.18-433.el5.i686.rpm	SHA-256: db9e07e31320550fa2977ab3cb228ff57f1370875be4c1e67ba789ecda9d8f90
kernel-debuginfo-common-2.6.18-433.el5.i686.rpm	SHA-256: 5395c0cc7f3034c5000f335b0252e058e84a5830c286afbd8f2a27777affb8cb
kernel-devel-2.6.18-433.el5.i686.rpm	SHA-256: 5ff6774cfdfed79f8ff8b4a8f5eac7dab28053d62d9c011811665dbd831e65d3
kernel-doc-2.6.18-433.el5.noarch.rpm	SHA-256: 1c6d29ca12f54c7bd0b2457c9c9f55126e3517387101f5cc000e8a0255028db2
kernel-headers-2.6.18-433.el5.i386.rpm	SHA-256: 571f322a5df5e4ca782d294d9ca82ff87301171e2712524325f1e3ffd58af99f
kernel-xen-2.6.18-433.el5.i686.rpm	SHA-256: 14815a008b449df83f93f3b4797f3adbce37366c6909f835f610a61196a6ed40
kernel-xen-debuginfo-2.6.18-433.el5.i686.rpm	SHA-256: 1bbfc61aae76c3b422e6e0be0b9d284a78d4856e7eedb020c820d3a595d5f141
kernel-xen-devel-2.6.18-433.el5.i686.rpm	SHA-256: 96814dd424c8aabafc44c94aad8718023771bd36882d38819bcfb464707421ad

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 5

SRPM
kernel-2.6.18-433.el5.src.rpm	SHA-256: 1b484d055239f223928ed009295feac0519a8448f061cb784095c5bca61bf318
s390x
kernel-2.6.18-433.el5.s390x.rpm	SHA-256: 53139b0ac88a48b13fd00c8f049816257ee4abf90e29c6193f89242a9bcc7efb
kernel-debug-2.6.18-433.el5.s390x.rpm	SHA-256: 884982a121ceda4b3fbbceee85327d68a147b9b628801f6e369d082752bc06ad
kernel-debug-debuginfo-2.6.18-433.el5.s390x.rpm	SHA-256: 65dc7c53faa9b6e4aee945a2111bf0fb4ee56646f46ab4095ee71b5aed56597d
kernel-debug-devel-2.6.18-433.el5.s390x.rpm	SHA-256: 42f366895a15b878b39fd1f17a5e0d54eb5df421a5525919e9464c2cd5e28b41
kernel-debuginfo-2.6.18-433.el5.s390x.rpm	SHA-256: b5bca18607538cfd38a023bfefa4ee920b3969f67ed6a9633356c60dd4e7aeeb
kernel-debuginfo-common-2.6.18-433.el5.s390x.rpm	SHA-256: a12a40f338085b77985499f91e7a9ee6c3580f7d7987c60325123df45286c37d
kernel-devel-2.6.18-433.el5.s390x.rpm	SHA-256: 5f930ae20cf419f5367c3b3d51cdb4300e590ee1ad0df754adff4d15ea9e471e
kernel-doc-2.6.18-433.el5.noarch.rpm	SHA-256: 1c6d29ca12f54c7bd0b2457c9c9f55126e3517387101f5cc000e8a0255028db2
kernel-headers-2.6.18-433.el5.s390x.rpm	SHA-256: a044b3c18afacb7cf089d63ff8cd70d3cef804ee948c79e5c0644272d8f0e824
kernel-kdump-2.6.18-433.el5.s390x.rpm	SHA-256: e0aed39a4b7e9a039e1fd4c815117c6aca5fc09616c9275be02be6e692b7ce85
kernel-kdump-debuginfo-2.6.18-433.el5.s390x.rpm	SHA-256: 0a10afc1a5e6f910140d047450adbd78849ba177a6db96dbab14658c1681bd88
kernel-kdump-devel-2.6.18-433.el5.s390x.rpm	SHA-256: d792fa68256ecb305d40e5efe885039e52ca37512172535b32e320ba8daee52f