RHSA-2015:0726: Important: kernel security and bug fix update

First published: Thu Mar 26 2015(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br><li> It was found that the Linux kernel's Infiniband subsystem did not</li> properly sanitize input parameters while registering memory regions from<br>user space via the (u)verbs API. A local user with access to a<br>/dev/infiniband/uverbsX device could use this flaw to crash the system or,<br>potentially, escalate their privileges on the system. (CVE-2014-8159,<br>Important)<br><li> A use-after-free flaw was found in the way the Linux kernel's SCTP</li> implementation handled authentication key reference counting during INIT<br>collisions. A remote attacker could use this flaw to crash the system or,<br>potentially, escalate their privileges on the system. (CVE-2015-1421,<br>Important)<br>Red Hat would like to thank Mellanox for reporting the CVE-2014-8159 issue.<br>The CVE-2015-1421 issue was discovered by Sun Baoliang of Red Hat.<br>This update also fixes the following bugs:<br><li> In certain systems with multiple CPUs, when a crash was triggered on one</li> CPU with an interrupt handler and this CPU sent Non-Maskable Interrupt<br>(NMI) to another CPU, and, at the same time, ioapic_lock had already been<br>acquired, a deadlock occurred in ioapic_lock. As a consequence, the kdump<br>service could become unresponsive. This bug has been fixed and kdump now<br>works as expected. (BZ#1197742)<br><li> On Lenovo X1 Carbon 3rd Gen, X250, and T550 laptops, the thinkpad_acpi</li> module was not properly loaded, and thus the function keys and radio<br>switches did not work. This update applies a new string pattern of BIOS<br>version, which fixes this bug, and function keys and radio switches now<br>work as intended. (BZ#1197743)<br><li> During a heavy file system load involving many worker threads, all worker</li> threads in the pool became blocked on a resource, and no manager thread<br>existed to create more workers. As a consequence, the running processes<br>became unresponsive. With this update, the logic around manager creation<br>has been changed to assure that the last worker thread becomes a manager<br>thread and does not start executing work items. Now, a manager thread<br>exists, spawns new workers as needed, and processes no longer hang.<br>(BZ#1197744)<br><li> If a thin-pool's metadata enters read-only or fail mode, for example, due</li> to thin-pool running out of metadata or data space, any attempt to make<br>metadata changes such as creating a thin device or snapshot thin device<br>should error out cleanly. However, previously, the kernel code returned<br>verbose and alarming error messages to the user. With this update, due to<br>early trapping of attempt to make metadata changes, informative errors are<br>displayed, no longer unnecessarily alarming the user. (BZ#1197745)<br><li> When running Red Hat Enterprise Linux as a guest on Microsoft Hyper-V</li> hypervisor, the storvsc module did not return the correct error code for<br>the upper level Small Computer System Interface (SCSI) subsystem. As a<br>consequence, a SCSI command failed and storvsc did not handle such a<br>failure properly under some conditions, for example, when RAID devices were<br>created on top of storvsc devices. An upstream patch has been applied to<br>fix this bug, and storvsc now returns the correct error code in the<br>described situation. (BZ#1197749)<br>All kernel users are advised to upgrade to these updated packages, which<br>contain backported patches to correct these issues. The system must be<br>rebooted for this update to take effect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2015:0726
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• package-manager/redhat