RHSA-2021:1578 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362)
• kernel: memory leak in sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c (CVE-2019-18811)
• kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver (CVE-2019-19523)
• kernel: use-after-free bug caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver (CVE-2019-19528)
• kernel: possible out of bounds write in kbd_keycode of keyboard.c (CVE-2020-0431)
• kernel: DoS by corrupting mountpoint reference counter (CVE-2020-12114)
• kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c (CVE-2020-12464)
• kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)
• kernel: Use After Free vulnerability in cgroup BPF component (CVE-2020-14356)
• kernel: NULL pointer dereference in serial8250_isa_init_ports function in drivers/tty/serial/8250/8250_core.c (CVE-2020-15437)
• kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)
• kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)
• kernel: incomplete permission checking for access to rbd devices (CVE-2020-25284)
• kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c (CVE-2020-25285)
• kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow (CVE-2020-25643)
• kernel: perf_event_parse_addr_filter memory (CVE-2020-25704)
• kernel: use-after-free in kernel midi subsystem (CVE-2020-27786)
• kernel: child process is able to access parent mm through hfi dev file handle (CVE-2020-27835)
• kernel: slab-out-of-bounds read in fbcon (CVE-2020-28974)
• kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent (CVE-2020-35508)
• kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations (CVE-2020-36322)
• kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege (CVE-2021-0342)
• kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in drivers/media/usb/gspca/ov519.c (CVE-2020-11608)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64

Fixes

• BZ - 1777455 - CVE-2019-18811 kernel: memory leak in sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c
• BZ - 1783434 - CVE-2019-19523 kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver
• BZ - 1783507 - CVE-2019-19528 kernel: use-after-free bug caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver
• BZ - 1831726 - CVE-2020-12464 kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c
• BZ - 1833445 - CVE-2020-11608 kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in drivers/media/usb/gspca/ov519.c
• BZ - 1848084 - i_version is turned off whenever filesystem is remounted
• BZ - 1848652 - CVE-2020-12114 kernel: DoS by corrupting mountpoint reference counter
• BZ - 1853922 - CVE-2020-14314 kernel: buffer uses out of index in ext3/4 filesystem
• BZ - 1859244 - Failure when modifying bridge multicast-snooping from 0 to 1
• BZ - 1860479 - Unable to attach VLAN-based logical networks to a bond
• BZ - 1868453 - CVE-2020-14356 kernel: Use After Free vulnerability in cgroup BPF component
• BZ - 1869141 - CVE-2020-24394 kernel: umask not applied on filesystem without ACL support
• BZ - 1876840 - logs are filled with: sending ioctl to DM device without required privilege
• BZ - 1877575 - CVE-2020-25212 kernel: TOCTOU mismatch in the NFS client code
• BZ - 1879981 - CVE-2020-25643 kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow
• BZ - 1882591 - CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
• BZ - 1882594 - CVE-2020-25284 kernel: incomplete permission checking for access to rbd devices
• BZ - 1890373 - kernel version update cause qemu live migration failed
• BZ - 1895961 - CVE-2020-25704 kernel: perf_event_parse_addr_filter memory
• BZ - 1900933 - CVE-2020-27786 kernel: use-after-free in kernel midi subsystem
• BZ - 1901161 - CVE-2020-15437 kernel: NULL pointer dereference in serial8250_isa_init_ports function in drivers/tty/serial/8250/8250_core.c
• BZ - 1901709 - CVE-2020-27835 kernel: child process is able to access parent mm through hfi dev file handle
• BZ - 1902724 - CVE-2020-35508 kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
• BZ - 1903126 - CVE-2020-28974 kernel: slab-out-of-bounds read in fbcon
• BZ - 1903387 - fsfreeze of xfs filesystem can be significantly delayed in xfs_wait_buftarg if a process continues to grab and release buffers
• BZ - 1903983 - rootless mode doesn't work
• BZ - 1911343 - blk_alloc_queue() ABI change
• BZ - 1915799 - CVE-2021-0342 kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege
• BZ - 1919889 - CVE-2020-0431 kernel: possible out of bounds write in kbd_keycode of keyboard.c
• BZ - 1930246 - CVE-2020-12362 kernel: Integer overflow in Intel(R) Graphics Drivers
• BZ - 1949560 - CVE-2020-36322 kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations

CVEs

• CVE-2019-18811
• CVE-2019-19523
• CVE-2019-19528
• CVE-2020-0431
• CVE-2020-11608
• CVE-2020-12114
• CVE-2020-12362
• CVE-2020-12363
• CVE-2020-12364
• CVE-2020-12464
• CVE-2020-14314
• CVE-2020-14356
• CVE-2020-15437
• CVE-2020-24394
• CVE-2020-25212
• CVE-2020-25284
• CVE-2020-25285
• CVE-2020-25643
• CVE-2020-25704
• CVE-2020-27786
• CVE-2020-27835
• CVE-2020-28974
• CVE-2020-35508
• CVE-2020-36322
• CVE-2020-36557
• CVE-2020-36694
• CVE-2021-0342
• CVE-2021-0605
• CVE-2021-3428
• CVE-2023-1390

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/