Issued:
2018-11-13
Updated:
2018-11-13

RHSA-2018:3586 - Security Advisory

Synopsis

Important: kernel-rt security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel-rt is now available for Red Hat Enterprise MRG 2.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

  • A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391)
  • kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)
  • kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact (CVE-2018-10675)
  • kernel: Integer overflow in Linux's create_elf_tables function (CVE-2018-14634)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and Networking and Nokia Bell Labs) for reporting CVE-2018-5391 and Qualys Research Labs for reporting CVE-2018-14634.

Bug Fix(es):

  • The kernel-rt packages have been upgraded to the 3.10.0-693.43.1 source tree, which provides a number of bug fixes over the previous version. (BZ#1632422)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

  • MRG Realtime 2 x86_64

Fixes

  • BZ - 1575065 - CVE-2018-10675 kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact
  • BZ - 1609664 - CVE-2018-5391 kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack)
  • BZ - 1610958 - CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c
  • BZ - 1624498 - CVE-2018-14634 kernel: Integer overflow in Linux's create_elf_tables function

CVEs

References

MRG Realtime 2

SRPM
kernel-rt-3.10.0-693.43.1.rt56.630.el6rt.src.rpm SHA-256: e3dcda0baf1854319a3063e53956cbebe49cd4bc11f8556bc5a8d32280b9c865
x86_64
kernel-rt-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: faf502c2bab8c605b8e2a57ad998fe596506a104826647ee14601b4898cc4fe0
kernel-rt-debug-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 5ebbb6432db3f4dc4e9d7cffa5e96ac77bc85d8b4314be71a31be8b02ea3bc3e
kernel-rt-debug-debuginfo-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: d7c8efb67c1016243229fdc624615512a976d4f111e6d9230dfd936d8874cae2
kernel-rt-debug-devel-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 19888676c0611c09dd86331dd45ed0231581136563448c03fcbcad44fbeb6d14
kernel-rt-debuginfo-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 417cf4b5e34166670649b0e9a7a204f6c502a7503c369e039a34b77db11ddfdf
kernel-rt-debuginfo-common-x86_64-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 7346f137c44acdf61519053adf442e60c60b59a917f37e79bb1fcbc40c062c6c
kernel-rt-devel-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 78fb7b75a6b591d390104302133ac442e18481f5784ece51b3cf3d66238e95fc
kernel-rt-doc-3.10.0-693.43.1.rt56.630.el6rt.noarch.rpm SHA-256: 80bc75677eb08cd8b1283dc5d8283a0a670dc47bd262d637df50237fa1324bbc
kernel-rt-firmware-3.10.0-693.43.1.rt56.630.el6rt.noarch.rpm SHA-256: 035ca9f08669b8e337e3d1753d4ce3a3dffdc201ebb20a43b9e34c83fee5a954
kernel-rt-trace-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 3091ca540825b189b9c7a0b4fa2f4b17b31604d1fac51828635025769a73c461
kernel-rt-trace-debuginfo-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 2aa381fac7f689239ae466e23780766e476a2206fabd1de326a45d50bb00d691
kernel-rt-trace-devel-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: d1b27b4a9c8f8544d2cf5b0e827a6747f5ebd817356d659a5f0f5bc2e48a7ac5
kernel-rt-vanilla-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 0c594d7bfe95c3c8633d3adeb647ae864f885f4f97ad993234103a6252288e8d
kernel-rt-vanilla-debuginfo-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 0a258a6e7898314f4f752ea6d0e95390ff6fe5de94b1a9c946338168c8c63bc2
kernel-rt-vanilla-devel-3.10.0-693.43.1.rt56.630.el6rt.x86_64.rpm SHA-256: 59d26460c0929d4d65bb293ade2908d46e1d71b4a02bc614d2b5b1202e947f17

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.