Red Hat Security Advisory: rhvm-appliance security update

Fixed packages 1

Vulnerabilities 3

• Medium 5.6
  CVE-2018-3620

  Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure…

  Intel Multiple linux-raspi2 linux-hwe Debian Ubuntu Alpine
  Aug 14, 2018
• Medium 5.6
  CVE-2018-3646

  Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure…

  Intel Multiple linux-raspi2 linux-hwe Debian Ubuntu Alpine
  Aug 14, 2018
• Unscored —
  CVE-2018-5390 EPSS 72%

  Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

  Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 6, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/L1TF
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1585005
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1601704
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1614066
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2402.json
• report
  https://access.redhat.com/security/cve/CVE-2018-3620
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-3620
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-3620
• article
  https://access.redhat.com/articles/3562741
• article
  https://foreshadowattack.eu/
• article
  https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault
• article
  https://www.redhat.com/en/blog/deeper-look-l1-terminal-fault-aka-foreshadow
• article
  https://www.redhat.com/en/blog/understanding-l1-terminal-fault-aka-foreshadow-what-you-need-know
• report
  https://access.redhat.com/security/cve/CVE-2018-3646
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-3646
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-3646
• report
  https://access.redhat.com/security/cve/CVE-2018-5390
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5390
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5390
• article
  https://access.redhat.com/articles/3553061
• advisory
  https://www.kb.cert.org/vuls/id/962459
• article
  https://www.spinics.net/lists/netdev/msg514742.html