Synopsis

Important: kernel-rt security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for kernel-rt is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege escalation (CVE-2019-11085)
  
• kernel: DMA attack using peripheral devices (Thunderclap) (BZ#1690716)
  
• kernel: infinite loop in update_blocked_averages() in kernel/sched/fair.c leading to denial of service (CVE-2018-20784)
  
• kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS (CVE-2019-11810)
  
• kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c (CVE-2019-11811)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update to the RHEL8.0.z batch#2 source tree (BZ#1717516)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for Real Time 8 x86_64
• Red Hat Enterprise Linux for Real Time for NFV 8 x86_64

Fixes

• BZ - 1680540 - CVE-2018-20784 kernel: infinite loop in update_blocked_averages() in kernel/sched/fair.c leading to denial of service
• BZ - 1690716 - kernel: DMA attack using peripheral devices (Thunderclap)
• BZ - 1709164 - CVE-2019-11810 kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS
• BZ - 1709180 - CVE-2019-11811 kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c
• BZ - 1710405 - CVE-2019-11085 kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege escalation
• BZ - 1717516 - kernel-rt: update to the RHEL8.0.z batch#2 source tree

CVEs

• CVE-2018-20784
• CVE-2019-11085
• CVE-2019-11810
• CVE-2019-11811

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for Real Time 8

SRPM
kernel-rt-4.18.0-80.7.1.rt9.153.el8_0.src.rpm	SHA-256: ec8c146c3d211fab837bdd01ec6f19c7e3e93e126303d4c87bbb05b5ec7d6d9c
x86_64
kernel-rt-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: b28075edc87fbe8d2e660e1a3471de9393657af4c5c78dd742fd84e4fc5803c9
kernel-rt-core-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 3ca73582af14c6cb987d5d525ce8e1853b229922aab3d26e024b7a0fa70b66cc
kernel-rt-debug-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 77f8699d6db32077a007ff3a354d8fb0727bdc4abd43a3a67e783920c8aaa6c5
kernel-rt-debug-core-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: ae6b1bcb477b105bb953e0a04550aa1d98faa36da5415e76cf6a47b9253cc0c6
kernel-rt-debug-debuginfo-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 41d3a91df0d4a0d6555799e61e3092f2544b4f4f548a8c353efabd61e126640a
kernel-rt-debug-devel-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 0d113c4307fb327223d0bd9465f01d3cd71db67b6d9842d477b2f2a381170a51
kernel-rt-debug-kvm-debuginfo-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 0dc7c2b0931c2eb203ab0cfac40552b51b0f696b78122b4ceede17dca0a3a8ee
kernel-rt-debug-modules-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 490b90a3b2e15476da586fcce1d08fce660eddd584371252e68d5109725dccde
kernel-rt-debug-modules-extra-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 50502211a1509cedf0c5e300db88f009ddf0c4365388714477d125221f547b49
kernel-rt-debuginfo-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: f0236cf4ce981f857a5ab35eb8efd8f5e3323a36985dc2ba6903d9886a579878
kernel-rt-debuginfo-common-x86_64-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: bc5e7d39d138f4797a346353edc8511f378216011ae2994d3450c8fe3307e6b5
kernel-rt-devel-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: d6a7c5703b59711fdbc0bb5f83e9f0dcc86c63ab647bb7eb14edbdb8049a430d
kernel-rt-kvm-debuginfo-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 38589dd6e837ff3bc2309eea5d7ba5189edd3f64f16930f19e9967837e28a981
kernel-rt-modules-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 0ae74aac5698eca2ce2a6acb16146698e97098bf2ac2c508e6254791199afdd2
kernel-rt-modules-extra-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: e091e55dc43c3bce2211ec594a0a6a3b2f72dc8d5b911262187af030bb9efff1

Red Hat Enterprise Linux for Real Time for NFV 8

SRPM
kernel-rt-4.18.0-80.7.1.rt9.153.el8_0.src.rpm	SHA-256: ec8c146c3d211fab837bdd01ec6f19c7e3e93e126303d4c87bbb05b5ec7d6d9c
x86_64
kernel-rt-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: b28075edc87fbe8d2e660e1a3471de9393657af4c5c78dd742fd84e4fc5803c9
kernel-rt-core-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 3ca73582af14c6cb987d5d525ce8e1853b229922aab3d26e024b7a0fa70b66cc
kernel-rt-debug-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 77f8699d6db32077a007ff3a354d8fb0727bdc4abd43a3a67e783920c8aaa6c5
kernel-rt-debug-core-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: ae6b1bcb477b105bb953e0a04550aa1d98faa36da5415e76cf6a47b9253cc0c6
kernel-rt-debug-debuginfo-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 41d3a91df0d4a0d6555799e61e3092f2544b4f4f548a8c353efabd61e126640a
kernel-rt-debug-devel-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 0d113c4307fb327223d0bd9465f01d3cd71db67b6d9842d477b2f2a381170a51
kernel-rt-debug-kvm-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 105737b4db6bd693e19c9f23d8ec9a117c1f53375c6fdd5d0209f8d35f67ecd2
kernel-rt-debug-kvm-debuginfo-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 0dc7c2b0931c2eb203ab0cfac40552b51b0f696b78122b4ceede17dca0a3a8ee
kernel-rt-debug-modules-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 490b90a3b2e15476da586fcce1d08fce660eddd584371252e68d5109725dccde
kernel-rt-debug-modules-extra-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 50502211a1509cedf0c5e300db88f009ddf0c4365388714477d125221f547b49
kernel-rt-debuginfo-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: f0236cf4ce981f857a5ab35eb8efd8f5e3323a36985dc2ba6903d9886a579878
kernel-rt-debuginfo-common-x86_64-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: bc5e7d39d138f4797a346353edc8511f378216011ae2994d3450c8fe3307e6b5
kernel-rt-devel-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: d6a7c5703b59711fdbc0bb5f83e9f0dcc86c63ab647bb7eb14edbdb8049a430d
kernel-rt-kvm-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 145e0dbf158267a487f949efd1cb419cde0760d569fc9bf6922372beb4dd71a1
kernel-rt-kvm-debuginfo-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 38589dd6e837ff3bc2309eea5d7ba5189edd3f64f16930f19e9967837e28a981
kernel-rt-modules-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: 0ae74aac5698eca2ce2a6acb16146698e97098bf2ac2c508e6254791199afdd2
kernel-rt-modules-extra-4.18.0-80.7.1.rt9.153.el8_0.x86_64.rpm	SHA-256: e091e55dc43c3bce2211ec594a0a6a3b2f72dc8d5b911262187af030bb9efff1