RHSA-2019:0525 - Security Advisory

Topic

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es):

• kernel: out-of-bounds memcpy in fs/ext4/inline.c:ext4_read_inline_data() with crafted ext4 image (CVE-2018-11412)
• kernel: use-after-free in jbd2_journal_commit_transaction funtion (CVE-2018-10876)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• blk-mq IO hang in null_blk test (BZ#1581223)
• lpfc remove lpfc_enable_pbde module parameter. (BZ#1615875)
• RHEL-Alt-7.6 - [Power9][DD2.2][4.14.0-109]package installation segfaults inside debian chroot env in P9 KVM guest with HTM enabled (kvm) (BZ#1628817)
• Pegas1.1 - [P9] "threads=2" or higher is required to boot up VM with above 256 vcpu [rhel-alt-7.6.z] (BZ#1634653)
• RHEL-Alt-7.6 Snapshot5 - System crashed under stress-ng & HTX on the mix mode guest (kvm) (BZ#1637890)
• RHEL-Alt-7.6 - BostonESS:P9:DD2.01 - Testing Ethtool options 'r' and 'p' for the i40e driver causes the kernel to crash and reboots the server (i40e) (CORAL) (BZ#1644606)
• RHEL-Alt-7.6 Host/RHV4.2: system crashed and kdump failed to collect CPUs in KVM guests (BZ#1649196)
• RHEL-Alt-7.6 Host:BostonLC:P9:boslcp1: system crashed in __find_linux_pte+0xac (kvm) (BZ#1651065)
• [LLNL 7.7 Bug] Rasdaemon doesn’t seem to collect APEI errors (BZ#1664495)

Users of kernel are advised to upgrade to these updated packages, which fix these bugs.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x

Fixes

• BZ - 1582358 - CVE-2018-11412 kernel: out-of-bounds memcpy in fs/ext4/inline.c:ext4_read_inline_data() with crafted ext4 image
• BZ - 1596773 - CVE-2018-10876 kernel: use-after-free in jbd2_journal_commit_transaction funtion

CVEs

• CVE-2018-10876
• CVE-2018-11412

References

• https://access.redhat.com/security/updates/classification/#moderate