Synopsis

Important: kernel security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port, thus the attacks cannot be performed using spoofed IP addresses. (CVE-2018-5390)
  
• A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391)
  
• kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact (CVE-2018-10675)
  
• kernel: Integer overflow in Linux's create_elf_tables function (CVE-2018-14634)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and CVE-2018-5391 and Qualys Research Labs for reporting CVE-2018-14634.

Bug Fix(es):

• After updating the system to prevent the L1 Terminal Fault (L1TF) vulnerability, only one thread was detected on systems that offer processing of two threads on a single processor core. With this update, the "__max_smt_threads()" function has been fixed. As a result, both threads are now detected correctly in the described situation. (BZ#1625334)
  
• Previously, a kernel panic occurred when the kernel tried to make an out of bound access to the array that describes the L1 Terminal Fault (L1TF) mitigation state on systems without Extended Page Tables (EPT) support. This update extends the array of mitigation states to cover all the states, which effectively prevents out of bound array access. Also, this update enables rejecting invalid, irrelevant values, that might be erroneously provided by the userspace. As a result, the kernel no longer panics in the described scenario. (BZ#1629633)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server - AUS 6.6 x86_64
• Red Hat Enterprise Linux Server - TUS 6.6 x86_64

Fixes

• BZ - 1575065 - CVE-2018-10675 kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact
• BZ - 1601704 - CVE-2018-5390 kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack)
• BZ - 1609664 - CVE-2018-5391 kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack)
• BZ - 1624498 - CVE-2018-14634 kernel: Integer overflow in Linux's create_elf_tables function

CVEs

• CVE-2018-5390
• CVE-2018-5391
• CVE-2018-10675
• CVE-2018-14634

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/articles/3553061
• https://access.redhat.com/security/vulnerabilities/mutagen-astronomy

Red Hat Enterprise Linux Server - AUS 6.6

SRPM
kernel-2.6.32-504.76.2.el6.src.rpm	SHA-256: 318696e20c1f16db57736516a1b4485f67b64572427f99de574f5c403c024bd2
x86_64
kernel-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: b6add5935d538adb94abae9ebe89458218b99dcd9f5d6ddf36f3ae6f5231497f
kernel-abi-whitelists-2.6.32-504.76.2.el6.noarch.rpm	SHA-256: 4f9bfd461fee02fe11bbb44f02f7584683fa963e3bcf757aecea3b4b40b9dd8b
kernel-debug-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 37e0282f74e438726f213c689851443991b045ab2e743bf3923abf0aa5cda02d
kernel-debug-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 7b99972bfd9aea2844f6da81111d05cd13d2ce086d01a7179fb15ff92954b002
kernel-debug-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 7b99972bfd9aea2844f6da81111d05cd13d2ce086d01a7179fb15ff92954b002
kernel-debug-devel-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 8304bc977cc75cb941bbd5dadffeb8c6bb2f26d22d5f8704a2f45ee29733c29a
kernel-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 5f27ab6ba2eef2caab802e95d3301fe0e42be2b2e068b0b1080daca6389f3a56
kernel-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 5f27ab6ba2eef2caab802e95d3301fe0e42be2b2e068b0b1080daca6389f3a56
kernel-debuginfo-common-x86_64-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: b07a00c15e7551a644fe9389fb9c5fce6a8a51e37a21abb183aa2ebaf436229f
kernel-debuginfo-common-x86_64-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: b07a00c15e7551a644fe9389fb9c5fce6a8a51e37a21abb183aa2ebaf436229f
kernel-devel-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: bc53910dbebc5d45d3ad4c902ac11176a00273b4c47da3db940cc4e72c975ec3
kernel-doc-2.6.32-504.76.2.el6.noarch.rpm	SHA-256: 7fd036bbb62b42b90be6e1dc076e31a0b4c26381dadf97ba75d1cca9f3ee1188
kernel-firmware-2.6.32-504.76.2.el6.noarch.rpm	SHA-256: ed07d7b13f9ad53bc439c7fc911d83620ac37a2aaf91d6eba13b9a9bbaca4ff8
kernel-headers-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 6059f44131ffc0dcfb9c3d374ab419e369d43f507d04cb194ef7749e29e8973c
perf-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 3d67a24897757bd8b0d0b7aa9237556b6cf991a81af247a3d48072ac7b164585
perf-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 3ba9abf17838d835cac514083a1c566aba940c3a3c07f4abe1d4bb135d70ae7f
perf-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 3ba9abf17838d835cac514083a1c566aba940c3a3c07f4abe1d4bb135d70ae7f
python-perf-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: ccdb9439889fc4d04b54d315cb0519d5a9f8a1a8629a833117925da976141fa9
python-perf-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: e365d198e488a92edf225ffa96f1b5ba9fefe09435f47345568c5b2e0febfb97
python-perf-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: e365d198e488a92edf225ffa96f1b5ba9fefe09435f47345568c5b2e0febfb97

Red Hat Enterprise Linux Server - TUS 6.6

SRPM
kernel-2.6.32-504.76.2.el6.src.rpm	SHA-256: 318696e20c1f16db57736516a1b4485f67b64572427f99de574f5c403c024bd2
x86_64
kernel-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: b6add5935d538adb94abae9ebe89458218b99dcd9f5d6ddf36f3ae6f5231497f
kernel-abi-whitelists-2.6.32-504.76.2.el6.noarch.rpm	SHA-256: 4f9bfd461fee02fe11bbb44f02f7584683fa963e3bcf757aecea3b4b40b9dd8b
kernel-debug-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 37e0282f74e438726f213c689851443991b045ab2e743bf3923abf0aa5cda02d
kernel-debug-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 7b99972bfd9aea2844f6da81111d05cd13d2ce086d01a7179fb15ff92954b002
kernel-debug-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 7b99972bfd9aea2844f6da81111d05cd13d2ce086d01a7179fb15ff92954b002
kernel-debug-devel-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 8304bc977cc75cb941bbd5dadffeb8c6bb2f26d22d5f8704a2f45ee29733c29a
kernel-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 5f27ab6ba2eef2caab802e95d3301fe0e42be2b2e068b0b1080daca6389f3a56
kernel-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 5f27ab6ba2eef2caab802e95d3301fe0e42be2b2e068b0b1080daca6389f3a56
kernel-debuginfo-common-x86_64-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: b07a00c15e7551a644fe9389fb9c5fce6a8a51e37a21abb183aa2ebaf436229f
kernel-debuginfo-common-x86_64-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: b07a00c15e7551a644fe9389fb9c5fce6a8a51e37a21abb183aa2ebaf436229f
kernel-devel-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: bc53910dbebc5d45d3ad4c902ac11176a00273b4c47da3db940cc4e72c975ec3
kernel-doc-2.6.32-504.76.2.el6.noarch.rpm	SHA-256: 7fd036bbb62b42b90be6e1dc076e31a0b4c26381dadf97ba75d1cca9f3ee1188
kernel-firmware-2.6.32-504.76.2.el6.noarch.rpm	SHA-256: ed07d7b13f9ad53bc439c7fc911d83620ac37a2aaf91d6eba13b9a9bbaca4ff8
kernel-headers-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 6059f44131ffc0dcfb9c3d374ab419e369d43f507d04cb194ef7749e29e8973c
perf-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 3d67a24897757bd8b0d0b7aa9237556b6cf991a81af247a3d48072ac7b164585
perf-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 3ba9abf17838d835cac514083a1c566aba940c3a3c07f4abe1d4bb135d70ae7f
perf-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: 3ba9abf17838d835cac514083a1c566aba940c3a3c07f4abe1d4bb135d70ae7f
python-perf-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: ccdb9439889fc4d04b54d315cb0519d5a9f8a1a8629a833117925da976141fa9
python-perf-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: e365d198e488a92edf225ffa96f1b5ba9fefe09435f47345568c5b2e0febfb97
python-perf-debuginfo-2.6.32-504.76.2.el6.x86_64.rpm	SHA-256: e365d198e488a92edf225ffa96f1b5ba9fefe09435f47345568c5b2e0febfb97