RHSA-2015:2411: Important: kernel-rt security, bug fix, and enhancement update

First published: Thu Nov 19 2015(Updated: )

The kernel-rt packages contain the Linux kernel, the core of any Linux<br>operating system.<br><li> A flaw was found in the way the Linux kernel's file system implementation</li> handled rename operations in which the source was inside and the<br>destination was outside of a bind mount. A privileged user inside a<br>container could use this flaw to escape the bind mount and, potentially,<br>escalate their privileges on the system. (CVE-2015-2925, Important)<br><li> A race condition flaw was found in the way the Linux kernel's IPC</li> subsystem initialized certain fields in an IPC object structure that were<br>later used for permission checking before inserting the object into a<br>globally visible list. A local, unprivileged user could potentially use<br>this flaw to elevate their privileges on the system. (CVE-2015-7613,<br>Important)<br><li> It was found that the Linux kernel memory resource controller's (memcg)</li> handling of OOM (out of memory) conditions could lead to deadlocks.<br>An attacker able to continuously spawn new processes within a single<br>memory-constrained cgroup during an OOM event could use this flaw to lock<br>up the system. (CVE-2014-8171, Moderate)<br><li> A race condition flaw was found between the chown and execve system</li> calls. When changing the owner of a setuid user binary to root, the race<br>condition could momentarily make the binary setuid root. A local,<br>unprivileged user could potentially use this flaw to escalate their<br>privileges on the system. (CVE-2015-3339, Moderate)<br><li> A flaw was discovered in the way the Linux kernel's TTY subsystem handled</li> the tty shutdown phase. A local, unprivileged user could use this flaw to<br>cause a denial of service on the system by holding a reference to the ldisc<br>lock during tty shutdown, causing a deadlock. (CVE-2015-4170, Moderate)<br><li> A NULL pointer dereference flaw was found in the SCTP implementation.</li> A local user could use this flaw to cause a denial of service on the system<br>by triggering a kernel panic when creating multiple sockets in parallel<br>while the system did not have the SCTP module loaded. (CVE-2015-5283,<br>Moderate)<br><li> A flaw was found in the way the Linux kernel's Crypto subsystem handled</li> automatic loading of kernel modules. A local user could use this flaw to<br>load any installed kernel module, and thus increase the attack surface of<br>the running kernel. (CVE-2013-7421, CVE-2014-9644, Low)<br><li> An information leak flaw was found in the way the Linux kernel changed</li> certain segment registers and thread-local storage (TLS) during a context<br>switch. A local, unprivileged user could use this flaw to leak the user<br>space TLS base address of an arbitrary process. (CVE-2014-9419, Low)<br><li> A flaw was found in the way the Linux kernel handled the securelevel</li> functionality after performing a kexec operation. A local attacker could<br>use this flaw to bypass the security mechanism of the<br>securelevel/secureboot combination. (CVE-2015-7837, Low)<br>Red Hat would like to thank Linn Crosetto of HP for reporting the<br>CVE-2015-7837 issue. The CVE-2015-5283 issue was discovered by Ji Jianwen<br>from Red Hat engineering.<br>The kernel-rt packages have been upgraded to version 3.10.0-326.rt56.204,<br>which provides a number of bug fixes and enhancements. (BZ#1201915,<br>BZ#1211724)<br>This update also fixes several bugs and adds multiple enhancements.<br>Refer to the following Red Hat Knowledgebase article for information on the<br>most significant of these changes:<br><a href="https://access.redhat.com/articles/2055783" target="_blank">https://access.redhat.com/articles/2055783</a> All kernel-rt users are advised to upgrade to these updated packages, which<br>correct these issues and add these enhancements. The system must be<br>rebooted for this update to take effect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2015:2411
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• package-manager/redhat