RHSA-2018:0676: Important: kernel-rt security, bug fix, and enhancement update

First published: Tue Apr 10 2018(Updated: )

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.<br>Security Fix(es):<br><li> kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important)</li> <li> kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important)</li> <li> Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important)</li> <li> kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important)</li> <li> kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate)</li> <li> kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)</li> <li> kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate)</li> <li> kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)</li> <li> kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate)</li> <li> kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126, Moderate)</li> <li> kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)</li> <li> kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate)</li> <li> kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-after-free (CVE-2017-17053, Moderate)</li> <li> kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)</li> <li> kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate)</li> <li> kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558, Moderate)</li> <li> kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)</li> <li> kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203, Moderate)</li> <li> kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate)</li> <li> Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate)</li> <li> kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)</li> <li> kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750, Moderate)</li> <li> kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)</li> <li> kernel: unlimiting the stack disables ASLR (CVE-2016-3672, Low)</li> <li> kernel: Missing permission check in move_pages system call (CVE-2017-14140, Low)</li> <li> kernel: Null pointer dereference in rngapi_reset function (CVE-2017-15116, Low)</li> <li> kernel: Improper error handling of VM_SHARED hugetlbfs mapping in mm/hugetlb.c (CVE-2017-15127, Low)</li> <li> kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact (CVE-2018-6927, Low)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.<br>Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633; Mohamed Ghannam for reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for reporting CVE-2017-15129; Jan H. Schönherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and the CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat).<br>Additional Changes:<br>See the Red Hat Enterprise Linux 7.5 Release Notes linked from References.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/softwarecombine
• agent/last-modified-date
• agent/type
• agent/first-publish-date
• agent/title
• agent/weakness
• agent/remedy
• agent/references
• agent/description
• agent/tags
• agent/event
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2018:0676
• agent/software-canonical-lookup
• package-manager/redhat