Synopsis

Important: kpatch-patch security update

Type/Severity

Security Advisory: Important

Topic

An update for kpatch-patch is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel.

Security Fix(es):

• kernel: Use-after-free in __blk_drain_queue() function in block/blk-core.c (CVE-2018-20856)
  
• kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c (CVE-2019-3846)
  
• hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) (CVE-2019-9506)
  
• kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c (CVE-2019-10126)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.7 x86_64

Fixes

• BZ - 1713059 - CVE-2019-3846 kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c
• BZ - 1716992 - CVE-2019-10126 kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c
• BZ - 1727857 - CVE-2019-9506 hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB)
• BZ - 1738705 - CVE-2018-20856 kernel: Use-after-free in __blk_drain_queue() function in block/blk-core.c

CVEs

• CVE-2018-20856
• CVE-2019-3846
• CVE-2019-9506
• CVE-2019-10126

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 7

SRPM
kpatch-patch-3_10_0-1062-1-5.el7.src.rpm	SHA-256: 610a0b7262b2a5b870e6e192ba1046b604a5236106162bf4d4517230e08aad7b
kpatch-patch-3_10_0-1062_1_1-1-4.el7.src.rpm	SHA-256: 9caeaa01b9474204443234fe77d1de931e4c6777bed9dc5c8e374275b019c96d
kpatch-patch-3_10_0-1062_1_2-1-3.el7.src.rpm	SHA-256: be55a9b0822f8757327ec5d43e360fdbc08baa9ff3f864cd44ddae0919ee7bda
x86_64
kpatch-patch-3_10_0-1062-1-5.el7.x86_64.rpm	SHA-256: 813ea5bdc9ad60b0dd131d985eb95913dbd19cd22a4054d1b7714d769dad54a8
kpatch-patch-3_10_0-1062-debuginfo-1-5.el7.x86_64.rpm	SHA-256: 65904c515957de77ff84f3bf73e3a6a277978e7c5e7c893c138f6c7be7b88761
kpatch-patch-3_10_0-1062_1_1-1-4.el7.x86_64.rpm	SHA-256: 5d9d18c85cccbb45271077af889061b1190dc93de07bb91c859a325482e83aa5
kpatch-patch-3_10_0-1062_1_1-debuginfo-1-4.el7.x86_64.rpm	SHA-256: 5df2b0941b9c24891d9e3ec0ef0070298b34d0493959d78240ac97a8cd6023d5
kpatch-patch-3_10_0-1062_1_2-1-3.el7.x86_64.rpm	SHA-256: 3bde0f579ec0270c1f13d78cb32fa9bb00c3cc3530c172b393f7b26d3fdd5a23
kpatch-patch-3_10_0-1062_1_2-debuginfo-1-3.el7.x86_64.rpm	SHA-256: 7371eb70cb8ec217550db396c01aa8845b0c94f051572b0d3ef479d8912f0038

Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7

SRPM
kpatch-patch-3_10_0-1062-1-5.el7.src.rpm	SHA-256: 610a0b7262b2a5b870e6e192ba1046b604a5236106162bf4d4517230e08aad7b
kpatch-patch-3_10_0-1062_1_1-1-4.el7.src.rpm	SHA-256: 9caeaa01b9474204443234fe77d1de931e4c6777bed9dc5c8e374275b019c96d
kpatch-patch-3_10_0-1062_1_2-1-3.el7.src.rpm	SHA-256: be55a9b0822f8757327ec5d43e360fdbc08baa9ff3f864cd44ddae0919ee7bda
x86_64
kpatch-patch-3_10_0-1062-1-5.el7.x86_64.rpm	SHA-256: 813ea5bdc9ad60b0dd131d985eb95913dbd19cd22a4054d1b7714d769dad54a8
kpatch-patch-3_10_0-1062-debuginfo-1-5.el7.x86_64.rpm	SHA-256: 65904c515957de77ff84f3bf73e3a6a277978e7c5e7c893c138f6c7be7b88761
kpatch-patch-3_10_0-1062_1_1-1-4.el7.x86_64.rpm	SHA-256: 5d9d18c85cccbb45271077af889061b1190dc93de07bb91c859a325482e83aa5
kpatch-patch-3_10_0-1062_1_1-debuginfo-1-4.el7.x86_64.rpm	SHA-256: 5df2b0941b9c24891d9e3ec0ef0070298b34d0493959d78240ac97a8cd6023d5
kpatch-patch-3_10_0-1062_1_2-1-3.el7.x86_64.rpm	SHA-256: 3bde0f579ec0270c1f13d78cb32fa9bb00c3cc3530c172b393f7b26d3fdd5a23
kpatch-patch-3_10_0-1062_1_2-debuginfo-1-3.el7.x86_64.rpm	SHA-256: 7371eb70cb8ec217550db396c01aa8845b0c94f051572b0d3ef479d8912f0038

Red Hat Enterprise Linux Server - AUS 7.7

SRPM
kpatch-patch-3_10_0-1062-1-5.el7.src.rpm	SHA-256: 610a0b7262b2a5b870e6e192ba1046b604a5236106162bf4d4517230e08aad7b
kpatch-patch-3_10_0-1062_1_1-1-4.el7.src.rpm	SHA-256: 9caeaa01b9474204443234fe77d1de931e4c6777bed9dc5c8e374275b019c96d
kpatch-patch-3_10_0-1062_1_2-1-3.el7.src.rpm	SHA-256: be55a9b0822f8757327ec5d43e360fdbc08baa9ff3f864cd44ddae0919ee7bda
x86_64
kpatch-patch-3_10_0-1062-1-5.el7.x86_64.rpm	SHA-256: 813ea5bdc9ad60b0dd131d985eb95913dbd19cd22a4054d1b7714d769dad54a8
kpatch-patch-3_10_0-1062-debuginfo-1-5.el7.x86_64.rpm	SHA-256: 65904c515957de77ff84f3bf73e3a6a277978e7c5e7c893c138f6c7be7b88761
kpatch-patch-3_10_0-1062_1_1-1-4.el7.x86_64.rpm	SHA-256: 5d9d18c85cccbb45271077af889061b1190dc93de07bb91c859a325482e83aa5
kpatch-patch-3_10_0-1062_1_1-debuginfo-1-4.el7.x86_64.rpm	SHA-256: 5df2b0941b9c24891d9e3ec0ef0070298b34d0493959d78240ac97a8cd6023d5
kpatch-patch-3_10_0-1062_1_2-1-3.el7.x86_64.rpm	SHA-256: 3bde0f579ec0270c1f13d78cb32fa9bb00c3cc3530c172b393f7b26d3fdd5a23
kpatch-patch-3_10_0-1062_1_2-debuginfo-1-3.el7.x86_64.rpm	SHA-256: 7371eb70cb8ec217550db396c01aa8845b0c94f051572b0d3ef479d8912f0038

Red Hat Enterprise Linux for Power, little endian 7

SRPM
kpatch-patch-3_10_0-1062-1-5.el7.src.rpm	SHA-256: 610a0b7262b2a5b870e6e192ba1046b604a5236106162bf4d4517230e08aad7b
kpatch-patch-3_10_0-1062_1_1-1-4.el7.src.rpm	SHA-256: 9caeaa01b9474204443234fe77d1de931e4c6777bed9dc5c8e374275b019c96d
kpatch-patch-3_10_0-1062_1_2-1-3.el7.src.rpm	SHA-256: be55a9b0822f8757327ec5d43e360fdbc08baa9ff3f864cd44ddae0919ee7bda
ppc64le
kpatch-patch-3_10_0-1062-1-5.el7.ppc64le.rpm	SHA-256: ce145625c49fa4b34993b0124ba23f2fd10d1cb3890e7c15cfbe129d636674e5
kpatch-patch-3_10_0-1062-debuginfo-1-5.el7.ppc64le.rpm	SHA-256: 3b1d31630fcfa08fcefe2c19043fd52fb8504faf29f28467199f2ecb7991948a
kpatch-patch-3_10_0-1062_1_1-1-4.el7.ppc64le.rpm	SHA-256: 5266d7d1b6ee6c2f93a1d0abeca0ef53e37d3f3c069b92811f9bfc04ea42786f
kpatch-patch-3_10_0-1062_1_1-debuginfo-1-4.el7.ppc64le.rpm	SHA-256: a4ee957585db7b39b249571475ebbef4aeaf1d9fe0ae8c661f66968c4036a6c8
kpatch-patch-3_10_0-1062_1_2-1-3.el7.ppc64le.rpm	SHA-256: e0a25cc30ae2991cca777c29cd21edac6fb989610c1aea116ec59fbd79d3415f
kpatch-patch-3_10_0-1062_1_2-debuginfo-1-3.el7.ppc64le.rpm	SHA-256: b723324f79beb26f067557638029047d8dba63669e6224794013769878381011

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7

SRPM
kpatch-patch-3_10_0-1062-1-5.el7.src.rpm	SHA-256: 610a0b7262b2a5b870e6e192ba1046b604a5236106162bf4d4517230e08aad7b
kpatch-patch-3_10_0-1062_1_1-1-4.el7.src.rpm	SHA-256: 9caeaa01b9474204443234fe77d1de931e4c6777bed9dc5c8e374275b019c96d
kpatch-patch-3_10_0-1062_1_2-1-3.el7.src.rpm	SHA-256: be55a9b0822f8757327ec5d43e360fdbc08baa9ff3f864cd44ddae0919ee7bda
ppc64le
kpatch-patch-3_10_0-1062-1-5.el7.ppc64le.rpm	SHA-256: ce145625c49fa4b34993b0124ba23f2fd10d1cb3890e7c15cfbe129d636674e5
kpatch-patch-3_10_0-1062-debuginfo-1-5.el7.ppc64le.rpm	SHA-256: 3b1d31630fcfa08fcefe2c19043fd52fb8504faf29f28467199f2ecb7991948a
kpatch-patch-3_10_0-1062_1_1-1-4.el7.ppc64le.rpm	SHA-256: 5266d7d1b6ee6c2f93a1d0abeca0ef53e37d3f3c069b92811f9bfc04ea42786f
kpatch-patch-3_10_0-1062_1_1-debuginfo-1-4.el7.ppc64le.rpm	SHA-256: a4ee957585db7b39b249571475ebbef4aeaf1d9fe0ae8c661f66968c4036a6c8
kpatch-patch-3_10_0-1062_1_2-1-3.el7.ppc64le.rpm	SHA-256: e0a25cc30ae2991cca777c29cd21edac6fb989610c1aea116ec59fbd79d3415f
kpatch-patch-3_10_0-1062_1_2-debuginfo-1-3.el7.ppc64le.rpm	SHA-256: b723324f79beb26f067557638029047d8dba63669e6224794013769878381011

Red Hat Enterprise Linux Server - TUS 7.7

SRPM
kpatch-patch-3_10_0-1062-1-5.el7.src.rpm	SHA-256: 610a0b7262b2a5b870e6e192ba1046b604a5236106162bf4d4517230e08aad7b
kpatch-patch-3_10_0-1062_1_1-1-4.el7.src.rpm	SHA-256: 9caeaa01b9474204443234fe77d1de931e4c6777bed9dc5c8e374275b019c96d
kpatch-patch-3_10_0-1062_1_2-1-3.el7.src.rpm	SHA-256: be55a9b0822f8757327ec5d43e360fdbc08baa9ff3f864cd44ddae0919ee7bda
x86_64
kpatch-patch-3_10_0-1062-1-5.el7.x86_64.rpm	SHA-256: 813ea5bdc9ad60b0dd131d985eb95913dbd19cd22a4054d1b7714d769dad54a8
kpatch-patch-3_10_0-1062-debuginfo-1-5.el7.x86_64.rpm	SHA-256: 65904c515957de77ff84f3bf73e3a6a277978e7c5e7c893c138f6c7be7b88761
kpatch-patch-3_10_0-1062_1_1-1-4.el7.x86_64.rpm	SHA-256: 5d9d18c85cccbb45271077af889061b1190dc93de07bb91c859a325482e83aa5
kpatch-patch-3_10_0-1062_1_1-debuginfo-1-4.el7.x86_64.rpm	SHA-256: 5df2b0941b9c24891d9e3ec0ef0070298b34d0493959d78240ac97a8cd6023d5
kpatch-patch-3_10_0-1062_1_2-1-3.el7.x86_64.rpm	SHA-256: 3bde0f579ec0270c1f13d78cb32fa9bb00c3cc3530c172b393f7b26d3fdd5a23
kpatch-patch-3_10_0-1062_1_2-debuginfo-1-3.el7.x86_64.rpm	SHA-256: 7371eb70cb8ec217550db396c01aa8845b0c94f051572b0d3ef479d8912f0038

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.7

SRPM
kpatch-patch-3_10_0-1062-1-5.el7.src.rpm	SHA-256: 610a0b7262b2a5b870e6e192ba1046b604a5236106162bf4d4517230e08aad7b
kpatch-patch-3_10_0-1062_1_1-1-4.el7.src.rpm	SHA-256: 9caeaa01b9474204443234fe77d1de931e4c6777bed9dc5c8e374275b019c96d
kpatch-patch-3_10_0-1062_1_2-1-3.el7.src.rpm	SHA-256: be55a9b0822f8757327ec5d43e360fdbc08baa9ff3f864cd44ddae0919ee7bda
ppc64le
kpatch-patch-3_10_0-1062-1-5.el7.ppc64le.rpm	SHA-256: ce145625c49fa4b34993b0124ba23f2fd10d1cb3890e7c15cfbe129d636674e5
kpatch-patch-3_10_0-1062-debuginfo-1-5.el7.ppc64le.rpm	SHA-256: 3b1d31630fcfa08fcefe2c19043fd52fb8504faf29f28467199f2ecb7991948a
kpatch-patch-3_10_0-1062_1_1-1-4.el7.ppc64le.rpm	SHA-256: 5266d7d1b6ee6c2f93a1d0abeca0ef53e37d3f3c069b92811f9bfc04ea42786f
kpatch-patch-3_10_0-1062_1_1-debuginfo-1-4.el7.ppc64le.rpm	SHA-256: a4ee957585db7b39b249571475ebbef4aeaf1d9fe0ae8c661f66968c4036a6c8
kpatch-patch-3_10_0-1062_1_2-1-3.el7.ppc64le.rpm	SHA-256: e0a25cc30ae2991cca777c29cd21edac6fb989610c1aea116ec59fbd79d3415f
kpatch-patch-3_10_0-1062_1_2-debuginfo-1-3.el7.ppc64le.rpm	SHA-256: b723324f79beb26f067557638029047d8dba63669e6224794013769878381011

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.7

SRPM
kpatch-patch-3_10_0-1062-1-5.el7.src.rpm	SHA-256: 610a0b7262b2a5b870e6e192ba1046b604a5236106162bf4d4517230e08aad7b
kpatch-patch-3_10_0-1062_1_1-1-4.el7.src.rpm	SHA-256: 9caeaa01b9474204443234fe77d1de931e4c6777bed9dc5c8e374275b019c96d
kpatch-patch-3_10_0-1062_1_2-1-3.el7.src.rpm	SHA-256: be55a9b0822f8757327ec5d43e360fdbc08baa9ff3f864cd44ddae0919ee7bda
x86_64
kpatch-patch-3_10_0-1062-1-5.el7.x86_64.rpm	SHA-256: 813ea5bdc9ad60b0dd131d985eb95913dbd19cd22a4054d1b7714d769dad54a8
kpatch-patch-3_10_0-1062-debuginfo-1-5.el7.x86_64.rpm	SHA-256: 65904c515957de77ff84f3bf73e3a6a277978e7c5e7c893c138f6c7be7b88761
kpatch-patch-3_10_0-1062_1_1-1-4.el7.x86_64.rpm	SHA-256: 5d9d18c85cccbb45271077af889061b1190dc93de07bb91c859a325482e83aa5
kpatch-patch-3_10_0-1062_1_1-debuginfo-1-4.el7.x86_64.rpm	SHA-256: 5df2b0941b9c24891d9e3ec0ef0070298b34d0493959d78240ac97a8cd6023d5
kpatch-patch-3_10_0-1062_1_2-1-3.el7.x86_64.rpm	SHA-256: 3bde0f579ec0270c1f13d78cb32fa9bb00c3cc3530c172b393f7b26d3fdd5a23
kpatch-patch-3_10_0-1062_1_2-debuginfo-1-3.el7.x86_64.rpm	SHA-256: 7371eb70cb8ec217550db396c01aa8845b0c94f051572b0d3ef479d8912f0038