Low: thunderbird security update

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

Low: curl security update

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.

A flaw was found in Ansible if an ansible user sets ANSIBLEASYNCDIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.

An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.

A null pointer dereference issue was found in the IDE disk emulator of QEMU. It could occur while cancelling an i/o operation via idecanceldmasync() routine, if a block drive pointer is null. A guest may use this flaw to crash the QEMU process on the host resulting in DoS scenario.

Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg01568.html

A PGP signature bypass was found in fwupd, which could lead to possible installation of unsigned firmware.

As per upstream:

For Red Hat Enterprise Linux 7: LVFS (LVFS (Linux Vendor Firmware Service) is: a secure portal which allows hardware vendors to upload firmware updates. The site is used by all major Linux distributions to provide metadata for clients such as fwupdmgr and GNOME Software.) was never enabled there although the PGP bypass is possible but not implementable.

For Red Hat Enterprise Linux 8: The LVFS is disabled and never used the Amazon CDN. PGP bypass possible, but not implementable.

More information available at: https://bugzilla.redhat.com/showbug.cgi?id=1841462

An unspecified vulnerability in Java SE related to the Networking component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments. Thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.

Upstream patch: --------------- -> https://www.redhat.com/archives/virt-tools-list/2019-July/msg00014.html

Reference: ---------- -> https://virt-manager.org/download/ -> https://www.openwall.com/lists/oss-security/2019/07/03/1

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified.

Bugzilla issue:

https://bugzilla.redhat.com/showbug.cgi?id=1713512

A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux (since version v219-62.2) and CentOS. Function dispatchmessagereal() in journald-server.c does not free the memory allocated by setiovecfieldfree() to store the CMDLINE= entry. A local attacker may use this flaw to make systemd-journald crash.

However systemd-journald crash is automatically restarted by systemd by default.

Oracle Java SE 8u201 fixes an unspecified vulnerability in the Deployment component (CVE-2019-2449). Upstream has CVSS scored this issue as: 3.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

External Reference:

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixJAVA

The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.

A password generation weakness exists in xquest through 2016-06-13.

In sgio, blkrqmapuser{,iov} may allocate a set of bounce buffer pages to do the bio, if it finds the user buffer cannot be directly mapped. But the allocated pages are not cleared.

If the bounce buffer is also not written to by device, garbage data is left, and copied back to user in blkrqunmapuser.

The allocated pages should be cleared. This also eliminates the risk of leaking sensitive information to userspace, which may have a security impact.

This flaw is specific to RHEL-7 and does not affect the current upstream kernel.

A vulnerability was found in the RHEL7.2 kernel. When RHEL 7.2 is booted with UEFI Secure Boot enabled, securelevel is set. The kernel uses the state of securelevel to prevent userspace from inserting untrusted privileged code at runtime.

The ACPI tables provided by firmware can be overwritten using the initrd. From the kernel documentation:

If the ACPIINITRDTABLEOVERRIDE compile option is true, it is possible to override nearly any ACPI table provided by the BIOS with an instrumented, modified one.

RHEL 7.2 has CONFIGACPIINITRDTABLEOVERRIDE kernel config option enabled, and will load ACPI tables appended to the initrd, even if booted with UEFI Secure Boot enabled and securelevel set.

Upstream patch:

https://github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76

A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required iowarrior driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1283390

A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required powermate driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1283384

Public via:

http://seclists.org/bugtraq/2016/Mar/85

This was assigned CVE-2016-2186 by Red Hat.

A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required mctu232 driver. The kernel would panic caused by a null pointer dereference.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1283370

A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required cypressm8 driver. The kernel would panic causing null pointer dereference.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1283368

Kernel crash occurs when presented a buggy USB device which requires digiacceleport driver, causing null pointer dereference.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1283378

Kernel crash occurs when presented a buggy USB device which requires wacom driver, causing null pointer dereference.

Product bugs:

https://bugzilla.redhat.com/showbug.cgi?id=1283375 https://bugzilla.redhat.com/showbug.cgi?id=1283377

Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors.

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication.

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication.

Quoting from bug #1262904: """ Description of problem:

Long long ago somebody committed http://pkgs.devel.redhat.com/cgit/rpms/grub2/commit/?h=rhel-7.2&id=909ac684df7a662e7afd9d45d546ad97d363d197 to our grub2 packages in RHEL 7. While the first hunk is correct, the second hunk is pretty much purely wrong. The last two changes got reverted immediately, but the multiboot and multiboot2 modules remained built in.

Those modules /should not/ function on UEFI systems, but there's no code in them that actually stops them from doing so, and therefore they allow a user to load non-verified code, such as tools to circumvent Secure Boot.

Since Secure Boot is a security feature of RHEL 7, that means this is a security problem in RHEL 7.

Version-Release number of selected component (if applicable):

It's everything in RHEL 7.

How reproducible:

100% of the time; there's no conditional behavior here. The user can do it from the boot menu of there's no password set, or if they've already rooted the machine they can do it from the config file.

Steps to Reproduce: 1. write a multiboot module that replaces some EFI runtime call pointers or whatever other attack you might like 2. add it to the configfile to load before the linux kernel, loading the kernel as a mutliboot module. 3. reboot.

Actual results:

linux thinks secure boot is intact when in fact it has been circumvented and boot time rootkits are present.

Expected results:

the module is rejected. """

Qemu emulator built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing transmit descriptor data when sending a network packet.

A privileged user inside guest could use this flaw to crash the Qemu instance resulting in DoS.

Upstream fix: ------------- -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg01199.html