Sigurnosni nedostaci jezgre operacijskog sustava

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: kernel security and bug fix update
Advisory ID: RHSA-2020:5430-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:5430
Issue date: 2020-12-15
CVE Names: CVE-2017-18551 CVE-2019-9454 CVE-2019-19447
CVE-2019-20636 CVE-2020-12770
=====================================================================

1. Summary:

An update for kernel is now available for Red Hat Enterprise Linux 7.4
Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update
Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP
Solutions.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 7.4) – noarch, x86_64
Red Hat Enterprise Linux Server E4S (v. 7.4) – noarch, ppc64le, x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) – x86_64
Red Hat Enterprise Linux Server Optional E4S (v. 7.4) – ppc64le, x86_64
Red Hat Enterprise Linux Server Optional TUS (v. 7.4) – x86_64
Red Hat Enterprise Linux Server TUS (v. 7.4) – noarch, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es):

* kernel: out of bounds write in function i2c_smbus_xfer_emulated in
drivers/i2c/i2c-core-smbus.c (CVE-2017-18551)

* kernel: out of bounds write in i2c driver leads to local escalation of
privilege (CVE-2019-9454)

* kernel: mounting a crafted ext4 filesystem image, performing some
operations, and unmounting can lead to a use-after-free in ext4_put_super
in fs/ext4/super.c (CVE-2019-19447)

* kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

* kernel: sg_write function lacks an sg_remove_request call in a certain
failure case (CVE-2020-12770)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* Secure boot key is not loaded with kernel-3.10.0-1159.el7: MODSIGN:
Couldn’t get UEFI MokListRT (BZ#1876951)

* RHEL7.6: no-carrier configured interfaces causes soft lockups by
mount.nfs and hang booting/shutdown process (BZ#1889770)

* [Intel Bug]: hrtimer (rdmavt RNR timer) was lost sometimes (BZ#1892996)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1757368 – CVE-2017-18551 kernel: out of bounds write in function i2c_smbus_xfer_emulated in drivers/i2c/i2c-core-smbus.c
1781679 – CVE-2019-19447 kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c
1818818 – CVE-2019-9454 kernel: out of bounds write in i2c driver leads to local escalation of privilege
1824059 – CVE-2019-20636 kernel: out-of-bounds write via crafted keycode table
1834845 – CVE-2020-12770 kernel: sg_write function lacks an sg_remove_request call in a certain failure case

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 7.4):

Source:
kernel-3.10.0-693.81.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-693.81.1.el7.noarch.rpm
kernel-doc-3.10.0-693.81.1.el7.noarch.rpm

x86_64:
kernel-3.10.0-693.81.1.el7.x86_64.rpm
kernel-debug-3.10.0-693.81.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-693.81.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.81.1.el7.x86_64.rpm
kernel-devel-3.10.0-693.81.1.el7.x86_64.rpm
kernel-headers-3.10.0-693.81.1.el7.x86_64.rpm
kernel-tools-3.10.0-693.81.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-693.81.1.el7.x86_64.rpm
perf-3.10.0-693.81.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm
python-perf-3.10.0-693.81.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server E4S (v. 7.4):

Source:
kernel-3.10.0-693.81.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-693.81.1.el7.noarch.rpm
kernel-doc-3.10.0-693.81.1.el7.noarch.rpm

ppc64le:
kernel-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-bootwrapper-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-debug-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-devel-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-headers-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-tools-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-tools-libs-3.10.0-693.81.1.el7.ppc64le.rpm
perf-3.10.0-693.81.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm
python-perf-3.10.0-693.81.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm

Red Hat Enterprise Linux Server TUS (v. 7.4):

Source:
kernel-3.10.0-693.81.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-693.81.1.el7.noarch.rpm
kernel-doc-3.10.0-693.81.1.el7.noarch.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 7.4):

x86_64:
kernel-debug-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.81.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-693.81.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.81.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Optional E4S (v. 7.4):

ppc64le:
kernel-debug-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-debug-devel-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm
kernel-tools-libs-devel-3.10.0-693.81.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-693.81.1.el7.ppc64le.rpm

Red Hat Enterprise Linux Server Optional TUS (v. 7.4):

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2017-18551
https://access.redhat.com/security/cve/CVE-2019-9454
https://access.redhat.com/security/cve/CVE-2019-19447
https://access.redhat.com/security/cve/CVE-2019-20636
https://access.redhat.com/security/cve/CVE-2020-12770
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX9h7HNzjgjWX9erEAQg+vQ//XZ9WZYL+Rw8YmKoU72KSbrviHIdI+8zE
DOS7CZhijg3HH8/lxmpek6O35Uzj+4x0ztRnroAxJnRNbom0SdXGqMvhEUQwoT4r
Lv8Uncj+GNAzt5jVybmMyK4xImLFm/fO3z+JuomIKQbf872vgW7szAdsZwxtJNec
v4T/9OHYyXxXCxUBNouFeNBTlOpc+W72imMsQTTwJP4lYFrkRv9ChCLekd2UNlG1
63u4lE3uCHkoS5v5HOlReO9rxeiaJCxXQZf2becp/MmaS3Z2E5k9vnb1BFSa2G8k
86SUrlY1ijDTF1welaaE0xCs5ATSxXoe6KgKmhCWnuiNTQ7reAKHLjF/wcUW3VqK
rJhOlb5Qg94cJIHBh+cMavTA3oiCyhq9HMWQf8t8hnRX5tyfH5rFuOEo3AhQWmSU
IEO48fZeDnO0RsTRZUJ9g2H1Fzz9GUMvIK4IaEnexMfkjnlUyocnQr1eHcm1olDU
NehMY6d49GPGbkgoKFF0lHqBxR8HMpfnhmyKh3diZHGqns3lOkpFqjEZkF/rOKjQ
wQImlUYs+afep99etb32KWgdhNLpKjjfEXph5hjCSUmaWSWejMrYNdgdpQehSYTz
WTRxnaOaSQ0DU0ID1C5/ZpFRvrkni9Sto6KHfc4LMHtqcnussCIBXi5U2ucmhBi2
6S2CGcOaiP8=
=k8gH
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: kernel security and bug fix update
Advisory ID: RHSA-2020:5418-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:5418
Issue date: 2020-12-15
CVE Names: CVE-2020-16166
=====================================================================

1. Summary:

An update for kernel is now available for Red Hat Enterprise Linux 8.2
Extended Update Support.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder EUS (v. 8.2) – aarch64, ppc64le, x86_64
Red Hat Enterprise Linux BaseOS EUS (v. 8.2) – aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es):

* kernel: information exposure in drivers/char/random.c and
kernel/time/timer.c (CVE-2020-16166)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* [RHEL-8.3][arm64] CN99xx: DIMM errors not populated in EDAC sysfs
(BZ#1857754)

* sctp: backports from upstream, 2nd phase (BZ#1878308)

* Backport upstream OVS performance patch fix (BZ#1879936)

* avoid flush_backlog IPI for isolated CPUs by configuring RPS cpumask
(BZ#1883315)

* Unexpected fragmentation needed error, OpenShift 4, OVS, VXLAN, GSO,
Azure (BZ#1885767)

* XFS: reflinked file data corruption (BZ#1886896)

* Scheduler: rq->tmp_alone_branch != &rq->leaf_cfs_rq_list (BZ#1890123)

* geneve: add transport ports in route lookup for geneve (BZ#1891819)

* BUG: using smp_processor_id() in preemptible [00000000] code:
handler106/3082 (BZ#1893282)

* HRTICK not armed in specific cases with SCHED_DEADLINE (BZ#1894074)

* RHEL8.1 – ibmveth is producing TX errors over VXLAN when large send (TSO)
is enabled (-> related to Red Hat bug 1816254 – OCP 4.3 – Authentication
clusteroperator is in unknown state on POWER 9 servers”) (BZ#1896300)

* RHEL8.2 – mm/gup: fix gup_fast with dynamic page table folding
(BZ#1896352)

* block layer: update to upstream v5.8 (BZ#1896788)

* [Regression] RHEL8.2 zstream – Undetected Data corruption in MPI
workloads that use VSX for reductions on POWER9 DD2.1 systems (BZ#1897279)

* ARO: excessive pod memory allocation causes node lockup (BZ#1901549)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1865751 – CVE-2020-16166 kernel: information exposure in drivers/char/random.c and kernel/time/timer.c

6. Package List:

Red Hat Enterprise Linux BaseOS EUS (v. 8.2):

Source:
kernel-4.18.0-193.37.1.el8_2.src.rpm

aarch64:
bpftool-4.18.0-193.37.1.el8_2.aarch64.rpm
bpftool-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-core-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-cross-headers-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debug-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debug-core-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debug-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debug-devel-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debug-modules-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debug-modules-extra-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debuginfo-common-aarch64-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-devel-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-headers-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-modules-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-modules-extra-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-tools-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-tools-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-tools-libs-4.18.0-193.37.1.el8_2.aarch64.rpm
perf-4.18.0-193.37.1.el8_2.aarch64.rpm
perf-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
python3-perf-4.18.0-193.37.1.el8_2.aarch64.rpm
python3-perf-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm

noarch:
kernel-abi-whitelists-4.18.0-193.37.1.el8_2.noarch.rpm
kernel-doc-4.18.0-193.37.1.el8_2.noarch.rpm

ppc64le:
bpftool-4.18.0-193.37.1.el8_2.ppc64le.rpm
bpftool-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-core-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-cross-headers-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debug-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debug-core-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debug-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debug-devel-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debug-modules-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debug-modules-extra-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-devel-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-headers-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-modules-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-modules-extra-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-tools-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-tools-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-tools-libs-4.18.0-193.37.1.el8_2.ppc64le.rpm
perf-4.18.0-193.37.1.el8_2.ppc64le.rpm
perf-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
python3-perf-4.18.0-193.37.1.el8_2.ppc64le.rpm
python3-perf-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm

s390x:
bpftool-4.18.0-193.37.1.el8_2.s390x.rpm
bpftool-debuginfo-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-core-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-cross-headers-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-debug-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-debug-core-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-debug-debuginfo-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-debug-devel-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-debug-modules-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-debug-modules-extra-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-debuginfo-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-debuginfo-common-s390x-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-devel-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-headers-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-modules-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-modules-extra-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-tools-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-tools-debuginfo-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-zfcpdump-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-zfcpdump-core-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-zfcpdump-debuginfo-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-zfcpdump-devel-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-zfcpdump-modules-4.18.0-193.37.1.el8_2.s390x.rpm
kernel-zfcpdump-modules-extra-4.18.0-193.37.1.el8_2.s390x.rpm
perf-4.18.0-193.37.1.el8_2.s390x.rpm
perf-debuginfo-4.18.0-193.37.1.el8_2.s390x.rpm
python3-perf-4.18.0-193.37.1.el8_2.s390x.rpm
python3-perf-debuginfo-4.18.0-193.37.1.el8_2.s390x.rpm

x86_64:
bpftool-4.18.0-193.37.1.el8_2.x86_64.rpm
bpftool-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-core-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-cross-headers-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debug-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debug-core-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debug-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debug-devel-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debug-modules-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debug-modules-extra-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debuginfo-common-x86_64-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-devel-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-headers-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-modules-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-modules-extra-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-tools-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-tools-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-tools-libs-4.18.0-193.37.1.el8_2.x86_64.rpm
perf-4.18.0-193.37.1.el8_2.x86_64.rpm
perf-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
python3-perf-4.18.0-193.37.1.el8_2.x86_64.rpm
python3-perf-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm

Red Hat CodeReady Linux Builder EUS (v. 8.2):

aarch64:
bpftool-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debug-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-debuginfo-common-aarch64-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-tools-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
kernel-tools-libs-devel-4.18.0-193.37.1.el8_2.aarch64.rpm
perf-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm
python3-perf-debuginfo-4.18.0-193.37.1.el8_2.aarch64.rpm

ppc64le:
bpftool-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debug-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-tools-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
kernel-tools-libs-devel-4.18.0-193.37.1.el8_2.ppc64le.rpm
perf-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm
python3-perf-debuginfo-4.18.0-193.37.1.el8_2.ppc64le.rpm

x86_64:
bpftool-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debug-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-debuginfo-common-x86_64-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-tools-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
kernel-tools-libs-devel-4.18.0-193.37.1.el8_2.x86_64.rpm
perf-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm
python3-perf-debuginfo-4.18.0-193.37.1.el8_2.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-16166
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX9h7N9zjgjWX9erEAQj+iRAAoMqIuOXvbImVZ8miWLY116Ly3q0VZf4x
mLjV94BiuBWcjhwx6aqADj3JmD3YtG28mffF5eMxiW8XxqXJzaQ/dsqWI16iac2r
9qRIAxvjOg9Rn9pk9x5nvGv5s7yguI/SRQFMnP+UYzEcTTaCiPvBZwoRVgccYUJB
Q53VIFMuCZaGWoxkRb9Ru4uCzHQKuTkFo21Hh4osPdaOzqO9b32xPFMQS109SVDU
mqNVyDFsU7gzo5UCBCI+P6jJd1nJihY718tS/CgxRdx7m7F24l3v3Cmm6RYciRjp
o5BO+xYYZqENqzuy1wO+9/kFjCGoYJGdvmxg/r+uhmzcrF4/d1+gJnlZ04qDR7qW
rMln6z9M0gxOKejR5VGvdaQReAXwgSF0Ao46GrPqMyjV0M41/5cO1VEOHKSVnEGv
5lq/PKfgsXtKXJ6qHEa1GUweDUGFZwvVSqhGiiQas+0iBoFZslaJrJcZafWF8JmN
zeqQRuHI86T3kVNxom32cwzXUSwYD2cLNoSQdOhemIML27ihOYv1B5OGrnBsZqjJ
MLnd8/hAF6qnv9Rrvb0nApyZL0n5Vdno53FZYx5XVDysHQTxeAqp6Mbf7OXD/XTb
FGASvAePdFod5dnbzijPZ6EhFeY7XtZXDsX9YhFRXE1vPPYnJRxYAD33cIl2Y1AJ
jW6yUgZ4LFI=
=cfH1
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kernel security and bug fix update
Advisory ID: RHSA-2020:5437-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:5437
Issue date: 2020-12-15
CVE Names: CVE-2019-18282 CVE-2020-10769 CVE-2020-14314
CVE-2020-14385 CVE-2020-24394 CVE-2020-25212
CVE-2020-25643
=====================================================================

1. Summary:

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) – noarch, x86_64
Red Hat Enterprise Linux Client Optional (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) – noarch, x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) – x86_64
Red Hat Enterprise Linux Server (v. 7) – noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) – ppc64, ppc64le, x86_64
Red Hat Enterprise Linux Workstation (v. 7) – noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) – x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es):

* kernel: metadata validator in XFS may cause an inode with a valid,
user-creatable extended attribute to be flagged as corrupt (CVE-2020-14385)

* kernel: The flow_dissector feature allows device tracking
(CVE-2019-18282)

* kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload
longer than 4 bytes is not aligned. (CVE-2020-10769)

* kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

* kernel: umask not applied on filesystem without ACL support
(CVE-2020-24394)

* kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

* kernel: improper input validation in ppp_cp_parse_cr function leads to
memory corruption and read overflow (CVE-2020-25643)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* WARNING in set_restore_sigmask at
./arch/x86/include/asm/thread_info.h:298 sigsuspend+0x6d/0x70 (BZ#1704650)

* [i40e] VFs see other VF’s outgoing traffic (BZ#1845677)

* [Hyper-V][RHEL7] Two fixes for kdump over network (BZ#1846667)

* Loop in __run_timers() because base->timer_jiffies is very far behind
causes a lockup condition. (BZ#1849716)

* XFS transaction overrun when running docker on VMWARE (overlay fs)
(BZ#1857203)

* RHEL 7.9 NVMe/IB – Host crash encountered during array upgrade
(BZ#1857397)

* False positive hard lockup detected while disabling the hard lockup
detector via sysctl -w kernel.watchdog=0 (BZ#1860661)

* [Hyper-V][RHEL-7] Only notify Hyper-V for die events that are oops
(BZ#1868130)

* Linux kernel crash due to openvswitch module (BZ#1869190)

* ‘nodfs’ option not working when using SMB2+ (BZ#1873033)

* RHEL7.7 zstream – ESS – kernel panic triggered by freelist pointer
corruption (BZ#1873189)

* destroy_cfs_bandwidth() is called by free_fair_sched_group() without
calling init_cfs_bandwidth() (BZ#1878000)

* NULL pointer at nvme_rdma_setup_ctrl+0x1c2/0x8d0 [nvme_rdma] when
discover E5700 (BZ#1878950)

* IB Infiniband RDMA mlx5_ib is freeing a kmalloc-512 cache that it does
not own causing memory corruption. (BZ#1880184)

* [Azure][RHEL7] Two Patches Needed To Enable Azure Host Time-syncing in
VMs (BZ#1884735)

* connect AF_UNSPEC on a connecting AF_INET6 socket returns an error
(BZ#1886305)

* Rebuilding the grub with the CPU flag ‘avx’ disabled (clearcpuid=156)
triggers kernel panic in xor_avx_2() (BZ#1886792)

* nf_conntrack_sctp.h is not usable due to a missing commit (BZ#1887975)

* Starting pvmove on top of physical volumes on MD devices causes IO error
on ongoing IO (BZ#1890059)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1708775 – CVE-2020-10769 kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not aligned.
1796360 – CVE-2019-18282 kernel: The flow_dissector feature allows device tracking
1853922 – CVE-2020-14314 kernel: buffer uses out of index in ext3/4 filesystem
1869141 – CVE-2020-24394 kernel: umask not applied on filesystem without ACL support
1874800 – CVE-2020-14385 kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt
1877575 – CVE-2020-25212 kernel: TOCTOU mismatch in the NFS client code
1879981 – CVE-2020-25643 kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow
1886305 – connect AF_UNSPEC on a connecting AF_INET6 socket returns an error

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
kernel-3.10.0-1160.11.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1160.11.1.el7.noarch.rpm
kernel-doc-3.10.0-1160.11.1.el7.noarch.rpm

x86_64:
bpftool-3.10.0-1160.11.1.el7.x86_64.rpm
bpftool-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-debug-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-devel-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-headers-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-tools-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-1160.11.1.el7.x86_64.rpm
perf-3.10.0-1160.11.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
python-perf-3.10.0-1160.11.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
bpftool-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-1160.11.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-1160.11.1.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
kernel-3.10.0-1160.11.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1160.11.1.el7.noarch.rpm
kernel-doc-3.10.0-1160.11.1.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Red Hat Enterprise Linux Server (v. 7):

Source:
kernel-3.10.0-1160.11.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1160.11.1.el7.noarch.rpm
kernel-doc-3.10.0-1160.11.1.el7.noarch.rpm

ppc64:
bpftool-3.10.0-1160.11.1.el7.ppc64.rpm
bpftool-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-bootwrapper-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-debug-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-debug-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-debug-devel-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-debuginfo-common-ppc64-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-devel-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-headers-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-tools-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-tools-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-tools-libs-3.10.0-1160.11.1.el7.ppc64.rpm
perf-3.10.0-1160.11.1.el7.ppc64.rpm
perf-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
python-perf-3.10.0-1160.11.1.el7.ppc64.rpm
python-perf-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm

ppc64le:
bpftool-3.10.0-1160.11.1.el7.ppc64le.rpm
bpftool-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-bootwrapper-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-debug-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-devel-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-headers-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-tools-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-tools-libs-3.10.0-1160.11.1.el7.ppc64le.rpm
perf-3.10.0-1160.11.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
python-perf-3.10.0-1160.11.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm

s390x:
bpftool-3.10.0-1160.11.1.el7.s390x.rpm
bpftool-debuginfo-3.10.0-1160.11.1.el7.s390x.rpm
kernel-3.10.0-1160.11.1.el7.s390x.rpm
kernel-debug-3.10.0-1160.11.1.el7.s390x.rpm
kernel-debug-debuginfo-3.10.0-1160.11.1.el7.s390x.rpm
kernel-debug-devel-3.10.0-1160.11.1.el7.s390x.rpm
kernel-debuginfo-3.10.0-1160.11.1.el7.s390x.rpm
kernel-debuginfo-common-s390x-3.10.0-1160.11.1.el7.s390x.rpm
kernel-devel-3.10.0-1160.11.1.el7.s390x.rpm
kernel-headers-3.10.0-1160.11.1.el7.s390x.rpm
kernel-kdump-3.10.0-1160.11.1.el7.s390x.rpm
kernel-kdump-debuginfo-3.10.0-1160.11.1.el7.s390x.rpm
kernel-kdump-devel-3.10.0-1160.11.1.el7.s390x.rpm
perf-3.10.0-1160.11.1.el7.s390x.rpm
perf-debuginfo-3.10.0-1160.11.1.el7.s390x.rpm
python-perf-3.10.0-1160.11.1.el7.s390x.rpm
python-perf-debuginfo-3.10.0-1160.11.1.el7.s390x.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64:
bpftool-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-debug-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-debuginfo-common-ppc64-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-tools-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
kernel-tools-libs-devel-3.10.0-1160.11.1.el7.ppc64.rpm
perf-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm
python-perf-debuginfo-3.10.0-1160.11.1.el7.ppc64.rpm

ppc64le:
bpftool-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-debug-devel-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
kernel-tools-libs-devel-3.10.0-1160.11.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-1160.11.1.el7.ppc64le.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
kernel-3.10.0-1160.11.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1160.11.1.el7.noarch.rpm
kernel-doc-3.10.0-1160.11.1.el7.noarch.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-18282
https://access.redhat.com/security/cve/CVE-2020-10769
https://access.redhat.com/security/cve/CVE-2020-14314
https://access.redhat.com/security/cve/CVE-2020-14385
https://access.redhat.com/security/cve/CVE-2020-24394
https://access.redhat.com/security/cve/CVE-2020-25212
https://access.redhat.com/security/cve/CVE-2020-25643
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX9id4NzjgjWX9erEAQg+FxAAj66LTGLji1wsWkExrb6pWhpMezi6wQzU
Sz+gEEfMnBxsyHAJo3+6rm0mXZET0mcDrHob4WuLQcefb4Wr005hxsv9NfoQ6TdB
JR+QBiW+2EYn5RZCIp7g+7MyAdcn3BaoZQihw5haAgn1YiNhqxcwbexg59Am0oSE
HEOXmkp17UQYCoAE3rQDsTXxNgTfDLKDpFjxfcsym+KZEQQCeEk8Qb1DM02of8bI
j93G5OxgYiv63Y2xa79LGXaCAOjpVKAnAprfH74PXysb2s6nzDlXCAUAgCf8aZV4
QsQdwRdrQrruEzKn6NSuo+V1jzaz/bO5tJi5dkjoq3tgyD4ilDt/p37khGqlxRmS
2rT6365A+P2ngzhzIaQzm7zU8UvyfvMtqYppr34L0MM0nK8Zj0P0vL2NakfO82H4
WD+M/r6VuYz1qSYI2q+IY2svRkMebAaMXbVfp0UOilh7lGP/5TTHmiElSBemnnzu
VmKrNH7NCUahKUYLTj0cMicIUCwr8AX5j2O1H0iWoSKzuyppj5cahQ9FTfFoK2z/
fsUTfsDsnL5RCgmRJ6wDPMG+IesVstdUIBB9hL9wA57I4VCS4T5UKHvFJw7VXBfe
WP3yD5AT1xxl7Y8XFzfFW6/3udE5wW89XHPS94AGr/8/2VRDUDudjlboWKgW5KHD
bQa8aRD5HCM=
=jipV
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Sigurnosni nedostaci jezgre operacijskog sustava

Archives

More in Preporuke

Sigurnosni nedostatak programskog paketa kernel rt